2026-10-01_988334b55c7f25a19a58893ba8a91271_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-10-01_988334b55c7f25a19a58893ba8a91271_amadey_elex_rhadamanthys_smoke-loader_stop
Size 141KB
Sample261002-j4ss6ade69
SHA256 844067f6908cede38af22bbc7fc930a9f828f1499b150a8bfe542d05b4ad0eba
MD5 988334b55c7f25a19a58893ba8a91271
SHA1 fcf1a1c54635593b468695f81fdb98eda3cb79d3
SHA512 2e6dc94e48ecb825e3304b0cfa8d45f93f42f590087e381ff3bbf5daf51fbcb01c4c17a367bbf3e58171ff4373153a037521b4e0e1bd0b22062d5fd0b2ba4005
SSDEEP 1536:xuC+V2TkXvHofC0AL1r1gKBgzxnHe4kkqifbFvxTza6e6EdMqcvi1L/X0FKa3Mc9:x0gIXl0sJXlinTeTFd991X/a8cz0I
TLSH
T1EAE39D1032E1C033E4A716348574DBB55E7BB8326A705DCB37A4E67A5F702C04A7A76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_988334b55c7f25a19a58893ba8a91271_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-01_988334b55c7f25a19a58893ba8a91271_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 141KB

2026-10-01_988334b55c7f25a19a58893ba8a91271_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH a94f72041dffae69c763d924f92e2650
SHA256 844067f6908cede38af22bbc7fc930a9f828f1499b150a8bfe542d05b4ad0eba
MD5 988334b55c7f25a19a58893ba8a91271
SHA1 fcf1a1c54635593b468695f81fdb98eda3cb79d3
SHA512 2e6dc94e48ecb825e3304b0cfa8d45f93f42f590087e381ff3bbf5daf51fbcb01c4c17a367bbf3e58171ff4373153a037521b4e0e1bd0b22062d5fd0b2ba4005
SSDEEP 1536:xuC+V2TkXvHofC0AL1r1gKBgzxnHe4kkqifbFvxTza6e6EdMqcvi1L/X0FKa3Mc9:x0gIXl0sJXlinTeTFd991X/a8cz0I
TLSH
T1EAE39D1032E1C033E4A716348574DBB55E7BB8326A705DCB37A4E67A5F702C04A7A76B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7923

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wabijunehiwebe\jopez.pdb

kernel32

GetDefaultCommConfigW HeapAlloc HeapFree GetEnvironmentStringsW SetConsoleScreenBufferSize BackupSeek GetFirmwareEnvironmentVariableA SizeofResource SetConsoleCursorPosition WriteConsoleW GetModuleFileNameW SetLastError GetProcAddress VirtualAlloc GetAtomNameA LoadLibraryA WriteConsoleA LocalAlloc BeginUpdateResourceA GetModuleFileNameA EraseTape AddConsoleAliasA FindNextVolumeA LCMapStringW lstrcpyA SetProcessAffinityMask GetThreadContext CreateFileW ReadFile EncodePointer DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleW ExitProcess WriteFile GetStdHandle HeapCreate Sleep HeapSize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind SetHandleCount GetFileType DeleteCriticalSection GetLastError SetFilePointer CloseHandle FreeEnvironmentStringsW WideCharToMultiByte TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RaiseException LoadLibraryW HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage CreateFileA GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers MultiByteToWideChar GetStringTypeW SetEndOfFile GetProcessHeap

user32

GetCursorPos

gdi32

GetCharWidth32A

advapi32

DeregisterEventSource

Name

.text

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.zel

Size

1024B

Virtual Size

626B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.daj

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.wololo

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_988334b55c7f25a19a58893ba8a91271_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

generic