2026-10-01_ade8eaa3567b2ee960868cad2ebf8e5f_amadey_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_ade8eaa3567b2ee960868cad2ebf8e5f_amadey_elex_rhadamanthys_smoke-loader_stop
Size 1.6MB
Sample261002-gpab6azfle
SHA256 47c349446e6ae1c10acb3074a0f3f0299d7819da13c416a01fa5d01573b82a8f
MD5 ade8eaa3567b2ee960868cad2ebf8e5f
SHA1 d894d8f3eb44bdbe2a82266a4daf8beb0c280cd8
SHA512 59da65254c95e7379a174358e07645757a62384f3a54be62975d9770085bd516b26437e220c2847e2580ff22113a26c0dd1e4e9eeef040911ae586d5d5ed3e04
SSDEEP 49152:YGF72d7JrQEySunVoGu/QAY3vY2rEU0GsX:YGF7o4SuneGu/QAYXoU0
TLSH
T1B075120037D2D436F1A315B68DAAC7395AADBC711F2682CB77D0356EDF785C29A3021A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_ade8eaa3567b2ee960868cad2ebf8e5f_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-01_ade8eaa3567b2ee960868cad2ebf8e5f_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 1.6MB

2026-10-01_ade8eaa3567b2ee960868cad2ebf8e5f_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 4e347d7c037e59679c1f4837993702ae
SHA256 47c349446e6ae1c10acb3074a0f3f0299d7819da13c416a01fa5d01573b82a8f
MD5 ade8eaa3567b2ee960868cad2ebf8e5f
SHA1 d894d8f3eb44bdbe2a82266a4daf8beb0c280cd8
SHA512 59da65254c95e7379a174358e07645757a62384f3a54be62975d9770085bd516b26437e220c2847e2580ff22113a26c0dd1e4e9eeef040911ae586d5d5ed3e04
SSDEEP 49152:YGF72d7JrQEySunVoGu/QAY3vY2rEU0GsX:YGF7o4SuneGu/QAYXoU0
TLSH
T1B075120037D2D436F1A315B68DAAC7395AADBC711F2682CB77D0356EDF785C29A3021A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

93390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

n:\ARM\BuildResults\bin\Win32\Release\ReaderUpdater.pdb

msi

ord70

kernel32

TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree InterlockedIncrement CompareStringW GetModuleHandleA GetVersionExA LoadLibraryA GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GetCurrentThreadId GlobalFlags LeaveCriticalSection GetSystemTimeAsFileTime HeapFree HeapAlloc GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc SetStdHandle GetFileType HeapSize Sleep ExitProcess GetTimeZoneInformation HeapCreate VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA QueryPerformanceCounter GetTickCount GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryA GetDriveTypeA CreateFileA SetEnvironmentVariableA lstrlenA GetCurrentProcessId GetFileTime GetFileSizeEx FreeLibrary InterlockedDecrement GetModuleHandleW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetProcAddress GetModuleFileNameW GetFullPathNameW GetVolumeInformationW GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile LoadLibraryW WideCharToMultiByte LocalAlloc FindClose lstrlenW lstrcmpW GetFileAttributesW FindFirstFileW lstrcmpA CreateFileW CopyFileW CloseHandle SetLastError MultiByteToWideChar GetExitCodeProcess OpenProcess GetPrivateProfileStringW WaitForSingleObject CreateProcessW SetFileAttributesW LocalFree DeleteFileW LockResource MoveFileW GetLastError GetTempPathW FormatMessageW SizeofResource LoadResource FindResourceW CompareStringA

user32

SetWindowTextW ValidateRect RegisterWindowMessageW LoadIconW WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus IsWindow DispatchMessageW GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos PeekMessageW MapWindowPoints SetMenuItemBitmaps GetKeyState SetMenu SetForegroundWindow GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetDlgCtrlID DefWindowProcW CopyRect PtInRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowTextW GetWindowThreadProcessId SendMessageW GetParent GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow UnhookWindowsHookEx GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu CharUpperW GetSystemMetrics PostQuitMessage DestroyMenu GetForegroundWindow MessageBoxW CallWindowProcW

advapi32

RegOpenKeyExW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW

shell32

ShellExecuteW SHGetFolderPathW

shlwapi

PathStripToRootW PathFindFileNameW PathIsUNCW

crypt32

CryptDecodeObject CertGetNameStringW CertCloseStore CryptMsgGetParam CryptMsgClose CryptQueryObject CertFreeCertificateContext CertFindCertificateInStore

wintrust

WinVerifyTrust

oleacc

CreateStdAccessibleObject LresultFromObject

psapi

GetModuleBaseNameW EnumProcesses EnumProcessModules GetModuleFileNameExW

gdi32

RestoreDC SaveDC GetStockObject SetBkColor SetTextColor CreateBitmap DeleteDC SetMapMode GetClipBox SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx GetDeviceCaps RectVisible PtVisible DeleteObject OffsetViewportOrgEx

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

comdlg32

GetFileTitleW

oleaut32

VariantChangeType VariantClear VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_ade8eaa3567b2ee960868cad2ebf8e5f_amadey_elex_rhadamanthys_smoke-loader_stop

msi

kernel32

user32

advapi32

shell32

shlwapi

crypt32

wintrust

oleacc

psapi

gdi32

winspool.drv

comdlg32

oleaut32

generic