2026-10-01_4958cbf452402df78aef13625645a587_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-10-01_4958cbf452402df78aef13625645a587_amadey_elex_rhadamanthys_smoke-loader_stop
Size 159KB
Sample261002-stde6avy5q
SHA256 5a657d7a4da0d96a46c30e15c35895e756282892756c8b158717d09f23452258
MD5 4958cbf452402df78aef13625645a587
SHA1 64f27f8fd6512234589375be57ed7d878d56daf2
SHA512 c8c80c91bfde22c876bb47ef029cfe4995e2b3c6c3a159f2b026ba6850cdcf4d8207e1a8c3be566f3fab7606da1bb855a53678f4d1d5de61b9c05b80d305be30
SSDEEP 1536:q7lrI8Vnb2pBgHK5N6rJwqV9kUQq4DvcCCQNczcfSO5hdoDUVet/tC+:q7lEEbYBMKirT0saN827XdoDUVMVr
TLSH
T173F3AE1077F0E033E5A36A312930C6AD6A37BDF25A7D894AF344131E5E722F19A64763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_4958cbf452402df78aef13625645a587_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-01_4958cbf452402df78aef13625645a587_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 159KB

2026-10-01_4958cbf452402df78aef13625645a587_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 070739c1bbdf7f99b25ff770de7698e7
SHA256 5a657d7a4da0d96a46c30e15c35895e756282892756c8b158717d09f23452258
MD5 4958cbf452402df78aef13625645a587
SHA1 64f27f8fd6512234589375be57ed7d878d56daf2
SHA512 c8c80c91bfde22c876bb47ef029cfe4995e2b3c6c3a159f2b026ba6850cdcf4d8207e1a8c3be566f3fab7606da1bb855a53678f4d1d5de61b9c05b80d305be30
SSDEEP 1536:q7lrI8Vnb2pBgHK5N6rJwqV9kUQq4DvcCCQNczcfSO5hdoDUVet/tC+:q7lEEbYBMKirT0saN827XdoDUVMVr
TLSH
T173F3AE1077F0E033E5A36A312930C6AD6A37BDF25A7D894AF344131E5E722F19A64763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15361

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cikupuy-yaniyexaka\ru.pdb

kernel32

GetConsoleAliasesLengthW GetEnvironmentStringsW WaitForSingleObject GetLogicalDrives GetProcessHeap GetSystemTimeAsFileTime GetConsoleTitleA WriteFileGather SetHandleCount GlobalAlloc GetFirmwareEnvironmentVariableA InitializeCriticalSectionAndSpinCount Sleep SetConsoleCP GetFileAttributesA SetConsoleCursorPosition GetDevicePowerState FlushFileBuffers LCMapStringA GetConsoleAliasesW SetLastError GetProcAddress VirtualAlloc EnumDateFormatsExA GetAtomNameA LoadLibraryA CreateHardLinkW EnumResourceTypesW GetDefaultCommConfigA IsDebuggerPresent CloseHandle GlobalAddAtomW EnumCalendarInfoExA GetSystemDefaultLangID CreateFileW HeapAlloc EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetCurrentProcess GetLastError HeapFree GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate HeapSize GetFileType DeleteCriticalSection SetFilePointer EnterCriticalSection LeaveCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryW HeapReAlloc RtlUnwind SetStdHandle WriteConsoleW MultiByteToWideChar LCMapStringW GetStringTypeW IsProcessorFeaturePresent

user32

DestroyCaret

advapi32

DeregisterEventSource

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_4958cbf452402df78aef13625645a587_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

generic