2026-09-30_58fcfc21f831a5719b84e285e67e64ca_amadey_elex_karagany_rhadamanthys_smoke-loader

General

Target
2026-09-30_58fcfc21f831a5719b84e285e67e64ca_amadey_elex_karagany_rhadamanthys_smoke-loader
Size 542KB
Sample260930-nczvlssfnd
SHA256 31da1acbec13b4beaa72efdc5e4cf1ecb2f52ec7e928889208c4560df5c9c05d
MD5 58fcfc21f831a5719b84e285e67e64ca
SHA1 3b51c5cfd231b88c01632594b77a191708f26fa2
SHA512 052e63e6c825a82939a840d107ca0f2349b5d2cd4b3fc8a6cb4e0d6eeaf909ab1e7d8f8f655893963b30b360c2d8f683490cd334c05734c41e9d849ff1f2b486
SSDEEP 12288:h7jvGdjBplZ/Xb2tOvb/NmcrZjgSRqJm3RWBa:kdj7lrT/NmcrZjgBmhWs
TLSH
T171C4F12077E0C038F1B712F649B697B9A92D3DB06B3855CF62D216EA56785E4CC30397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_58fcfc21f831a5719b84e285e67e64ca_amadey_elex_karagany_rhadamanthys_smoke-loader

File Explorer

2026-09-30_58fcfc21f831a5719b84e285e67e64ca_amadey_elex_karagany_rhadamanthys_smoke-loader

.exe 542KB

2026-09-30_58fcfc21f831a5719b84e285e67e64ca_amadey_elex_karagany_rhadamanthys_smoke-loader

IMPHASH 968069613992074265463fec272c56c9
SHA256 31da1acbec13b4beaa72efdc5e4cf1ecb2f52ec7e928889208c4560df5c9c05d
MD5 58fcfc21f831a5719b84e285e67e64ca
SHA1 3b51c5cfd231b88c01632594b77a191708f26fa2
SHA512 052e63e6c825a82939a840d107ca0f2349b5d2cd4b3fc8a6cb4e0d6eeaf909ab1e7d8f8f655893963b30b360c2d8f683490cd334c05734c41e9d849ff1f2b486
SSDEEP 12288:h7jvGdjBplZ/Xb2tOvb/NmcrZjgSRqJm3RWBa:kdj7lrT/NmcrZjgBmhWs
TLSH
T171C4F12077E0C038F1B712F649B697B9A92D3DB06B3855CF62D216EA56785E4CC30397
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xagirevepo\petag\90\rokudocun25\xes45.pdb

kernel32

GetCommandLineW GetThreadContext CopyFileExW TlsGetValue GetCommState InterlockedDecrement GetProfileStringW UnlockFile FreeEnvironmentStringsA GetConsoleAliasesLengthA GetNumberFormatA FindResourceExA GlobalAlloc LoadLibraryW GetConsoleAliasExesLengthW HeapDestroy CreateSemaphoreA GetBinaryTypeA GetModuleFileNameW GetSystemDirectoryA CreateActCtxA lstrlenW LCMapStringA GetPrivateProfileIntW GetStartupInfoA SetThreadLocale GetStdHandle GetCPInfoExW FreeLibraryAndExitThread GetLastError GetCurrentDirectoryW GetProcAddress CreateNamedPipeA EnterCriticalSection LoadLibraryA OpenMutexA WritePrivateProfileStringA SetThreadIdealProcessor HeapWalk SetSystemTime GlobalWire FindNextFileA CreateIoCompletionPort GetModuleHandleA FindFirstChangeNotificationA WriteProfileStringW SetFileShortNameA FindAtomW EnumResourceLanguagesW UnregisterWaitEx GetSystemTime DeleteFileA GetVolumeInformationW LocalFileTimeToFileTime EncodePointer DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW HeapValidate IsBadReadPtr InterlockedIncrement GetModuleHandleW ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LeaveCriticalSection SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsAlloc TlsSetValue TlsFree SetLastError HeapCreate WriteFile HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree GetACP GetOEMCP GetCPInfo IsValidCodePage RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode OutputDebugStringA WriteConsoleW OutputDebugStringW MultiByteToWideChar IsProcessorFeaturePresent LCMapStringW GetStringTypeW SetStdHandle FlushFileBuffers CreateFileW CloseHandle RaiseException

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_58fcfc21f831a5719b84e285e67e64ca_amadey_elex_karagany_rhadamanthys_smoke-loader

kernel32

generic