2026-09-29_79c477e0d5f61b7570cb520a691346c2_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-09-29_79c477e0d5f61b7570cb520a691346c2_amadey_elex_rhadamanthys_smoke-loader_stop
Size 298KB
Sample260930-xydnya1eqd
SHA256 f4f7010a141d4c6fed28099e863371b5d6a49981d47a7ea6a64b2e0c14317aff
MD5 79c477e0d5f61b7570cb520a691346c2
SHA1 369ccb0415f8cc72b252cccc96b5dc420ad9a0cc
SHA512 3dcf98295bed960d545e77c3518449418fd790a4cf89013f979df1e2e18d639073c5a2fd9b4c5f8d2afa79f5fa8475e7c7dd7cc3020b3926e3d002f70c81b558
SSDEEP 6144:m2ZQ64l6/zVv1L11dwFB3u8UGsDQDWT7snf6/c83:zZj/zVtLo3uP7QDWT7Cf6UQ
TLSH
T12A549E20B7E0C035F1F752F849B993A9A93E7AB06B3450CB62D516EE26346E4DC31793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_79c477e0d5f61b7570cb520a691346c2_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-29_79c477e0d5f61b7570cb520a691346c2_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 298KB

2026-09-29_79c477e0d5f61b7570cb520a691346c2_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 9b494192bab1e0e5f914d8f6d610f95a
SHA256 f4f7010a141d4c6fed28099e863371b5d6a49981d47a7ea6a64b2e0c14317aff
MD5 79c477e0d5f61b7570cb520a691346c2
SHA1 369ccb0415f8cc72b252cccc96b5dc420ad9a0cc
SHA512 3dcf98295bed960d545e77c3518449418fd790a4cf89013f979df1e2e18d639073c5a2fd9b4c5f8d2afa79f5fa8475e7c7dd7cc3020b3926e3d002f70c81b558
SSDEEP 6144:m2ZQ64l6/zVv1L11dwFB3u8UGsDQDWT7snf6/c83:zZj/zVtLo3uP7QDWT7Cf6UQ
TLSH
T12A549E20B7E0C035F1F752F849B993A9A93E7AB06B3450CB62D516EE26346E4DC31793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gegonorenomi_nipex\remuxikikor\jefaxihar\sokunuwotohur78 cij.pdb

kernel32

CallNamedPipeA SetWaitableTimer InterlockedIncrement GetCommState InterlockedDecrement GetProfileStringW SetEvent OpenSemaphoreA FreeEnvironmentStringsA CreateNamedPipeW LocalFlags GetNumberFormatA ReadConsoleOutputA SetProcessPriorityBoost GetSystemTimes GlobalAlloc GetPrivateProfileIntA GetSystemDirectoryW GetVolumeInformationA LoadLibraryW TerminateThread GetConsoleAliasExesLengthW HeapDestroy LeaveCriticalSection FileTimeToSystemTime GetCompressedFileSizeA lstrlenW GetPrivateProfileIntW InterlockedExchange CopyFileExW SetThreadLocale GetCPInfoExW FreeLibraryAndExitThread GetLastError GetCurrentDirectoryW GetProcAddress SetStdHandle LoadLibraryA OpenMutexA CreateSemaphoreW WritePrivateProfileStringA FindAtomA GetModuleFileNameA CreateIoCompletionPort GetModuleHandleA FindFirstChangeNotificationA HeapSetInformation FindNextFileW WriteProfileStringW TlsAlloc LocalSize FindAtomW EnumResourceLanguagesW SetFileValidData GetSystemTime GetProfileSectionW LCMapStringW DeleteFileA GetThreadContext GetStartupInfoA GetCommandLineW GetCommandLineA HeapValidate IsBadReadPtr RaiseException EnterCriticalSection GetFileType WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode GetModuleHandleW Sleep ExitProcess TlsGetValue TlsSetValue GetCurrentThreadId TlsFree SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW RtlUnwind GetACP GetOEMCP GetCPInfo IsValidCodePage DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetStdHandle HeapCreate HeapFree VirtualFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetFilePointer GetStringTypeA GetStringTypeW GetLocaleInfoA DebugBreak OutputDebugStringA OutputDebugStringW LCMapStringA CreateFileA CloseHandle FlushFileBuffers

advapi32

InitiateSystemShutdownA ImpersonateSelf

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_79c477e0d5f61b7570cb520a691346c2_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic