2026-09-30_007151a10e441fba8c4ce2108ae6cfb2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-30_007151a10e441fba8c4ce2108ae6cfb2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
Size 508KB
Sample260930-ry8w7as14m
SHA256 a71e0df14002731ac1e55e84634165507401c94f4e65e457c106a6c8cc2bd270
MD5 007151a10e441fba8c4ce2108ae6cfb2
SHA1 6b3935441089063d75cd4acee4f82315562e6e8a
SHA512 690516dfcfd20e4b02b3e11db6c9551ff027337f57827eedfdc0bdd6ecbfee51b37c9802c344975c1dbd9262f157868c46bae1bebe8a9d30f7dc36684c20a539
SSDEEP 12288:sacxKSPOQUFrmc3qp8JORIq8FH5RPZ66SlJd:smSACpqYQFZ9cd
TLSH
T163B4128034A0E433C99A46314539C7A5567AFD22553C884EFB483BBF6E722F14E7A367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_007151a10e441fba8c4ce2108ae6cfb2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-30_007151a10e441fba8c4ce2108ae6cfb2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 508KB

2026-09-30_007151a10e441fba8c4ce2108ae6cfb2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 92f515ab3dd1c904aa1ddaf0eee2eeca
SHA256 a71e0df14002731ac1e55e84634165507401c94f4e65e457c106a6c8cc2bd270
MD5 007151a10e441fba8c4ce2108ae6cfb2
SHA1 6b3935441089063d75cd4acee4f82315562e6e8a
SHA512 690516dfcfd20e4b02b3e11db6c9551ff027337f57827eedfdc0bdd6ecbfee51b37c9802c344975c1dbd9262f157868c46bae1bebe8a9d30f7dc36684c20a539
SSDEEP 12288:sacxKSPOQUFrmc3qp8JORIq8FH5RPZ66SlJd:smSACpqYQFZ9cd
TLSH
T163B4128034A0E433C99A46314539C7A5567AFD22553C884EFB483BBF6E722F14E7A367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8935

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\kigolegor94\w.pdb

kernel32

GetLocaleInfoA LoadResource InterlockedIncrement ReadConsoleA GetSystemWindowsDirectoryW GetEnvironmentStringsW WaitForSingleObject FindActCtxSectionStringA GetUserDefaultLangID QueryActCtxW LeaveCriticalSection VerifyVersionInfoA WriteConsoleW ReleaseSemaphore GetProcAddress EnterCriticalSection DisableThreadLibraryCalls ResetEvent OpenMutexA LocalAlloc SetConsoleOutputCP GlobalGetAtomNameW WaitForMultipleObjects SetSystemTime GetModuleFileNameA GetModuleHandleA EraseTape FindFirstVolumeA GetCurrentProcessId AddConsoleAliasA GetModuleFileNameW GetCommandLineW GetLastError HeapReAlloc HeapAlloc GetModuleHandleW Sleep ExitProcess GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind HeapFree SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection SetFilePointer HeapCreate VirtualFree VirtualAlloc CloseHandle TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime CreateFileA RaiseException SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize SetEndOfFile GetProcessHeap MultiByteToWideChar ReadFile WriteConsoleA GetConsoleOutputCP GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW

user32

RealChildWindowFromPoint

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_007151a10e441fba8c4ce2108ae6cfb2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

generic