2026-09-30_e35100e48a07a8de704adad1c8baa658_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-09-30_e35100e48a07a8de704adad1c8baa658_amadey_elex_rhadamanthys_smoke-loader_stop
Size 527KB
Sample261001-eldt3azx5l
SHA256 ff59236f3c284f946185c098119a2d11fbc30463b85b63d190c1bebef79c45f5
MD5 e35100e48a07a8de704adad1c8baa658
SHA1 d1a003d7bda2ebeb1af2f4af9e3c5cbe6ee60fa3
SHA512 4fb686a50d37bf64a73d6600dc359b5253f404bb40bdef51088cff3446b1cdf7be9857e07c92806d87d22fd7f8256ff0ea7bab1ec764ff8e5c2d2f66ea80ea7b
SSDEEP 12288:LXfLi4oYHeUrmmNcey5BWBCQiWNaAT3XNUsLrDc3:LX5NE2aGiWEqOsLrDc3
TLSH
T127B4D031B6E0C030E5B702F899A693A96929FD715B2053CB62D526EE7634FE8DC30753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_e35100e48a07a8de704adad1c8baa658_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-30_e35100e48a07a8de704adad1c8baa658_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 527KB

2026-09-30_e35100e48a07a8de704adad1c8baa658_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH e603d9ce78d3b843ff0481c06148bc9e
SHA256 ff59236f3c284f946185c098119a2d11fbc30463b85b63d190c1bebef79c45f5
MD5 e35100e48a07a8de704adad1c8baa658
SHA1 d1a003d7bda2ebeb1af2f4af9e3c5cbe6ee60fa3
SHA512 4fb686a50d37bf64a73d6600dc359b5253f404bb40bdef51088cff3446b1cdf7be9857e07c92806d87d22fd7f8256ff0ea7bab1ec764ff8e5c2d2f66ea80ea7b
SSDEEP 12288:LXfLi4oYHeUrmmNcey5BWBCQiWNaAT3XNUsLrDc3:LX5NE2aGiWEqOsLrDc3
TLSH
T127B4D031B6E0C030E5B702F899A693A96929FD715B2053CB62D526EE7634FE8DC30753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\pof\basuyi\huf.pdb

kernel32

SetLocalTime CallNamedPipeA SetWaitableTimer InterlockedIncrement GetQueuedCompletionStatus GetCommState InterlockedDecrement GetProfileStringW SetEvent FreeEnvironmentStringsA CreateNamedPipeW GetNumberFormatA ReadConsoleOutputA GetCommandLineA SetProcessPriorityBoost GetSystemTimes GetPrivateProfileIntA GetSystemDirectoryW GetConsoleAliasExesLengthW HeapCreate TerminateProcess FileTimeToSystemTime EnumResourceLanguagesA GetModuleFileNameW GetCompressedFileSizeA lstrlenW GetPrivateProfileIntW InterlockedExchange GetStartupInfoA CopyFileExW GetCPInfoExW FreeLibraryAndExitThread GetLastError GetCurrentDirectoryW GetProcAddress SetStdHandle EnterCriticalSection LoadLibraryA OpenMutexA CreateSemaphoreW LocalAlloc WritePrivateProfileStringA HeapWalk FindAtomA GetModuleHandleA FindFirstChangeNotificationA FreeEnvironmentStringsW FindNextFileW WriteProfileStringW SetFileShortNameA TlsAlloc LocalSize FindAtomW DeleteFileW GetSystemTime LCMapStringW CopyFileExA GetVolumeInformationW SetThreadLocale SetThreadContext MoveFileA GetStartupInfoW HeapValidate IsBadReadPtr RaiseException GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetACP GetOEMCP GetCPInfo IsValidCodePage TlsGetValue GetModuleHandleW TlsSetValue GetCurrentThreadId TlsFree SetLastError Sleep ExitProcess DeleteCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW GetCommandLineW HeapDestroy HeapFree VirtualFree GetModuleFileNameA WriteFile HeapAlloc HeapSize HeapReAlloc VirtualAlloc MultiByteToWideChar GetStringTypeA GetStringTypeW GetLocaleInfoA DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW WideCharToMultiByte LCMapStringA InitializeCriticalSectionAndSpinCount SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleA GetConsoleOutputCP CloseHandle CreateFileA

advapi32

InitiateSystemShutdownA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_e35100e48a07a8de704adad1c8baa658_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic