2026-10-01_2b4980ab00b58da9745b82deb70e4bfd_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_2b4980ab00b58da9745b82deb70e4bfd_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
Size 441KB
Sample261002-v8gr8svs2j
SHA256 5669cbcba45d86676a567a0ce17099da3f8ed63736111f4e99530031aec9b8d2
MD5 2b4980ab00b58da9745b82deb70e4bfd
SHA1 3d75809ebdf9dbce23fb3adf081d2f751be20bc3
SHA512 1f07b2c89160686e29324ee78e9671b94a193a9780c2795490b115d015e67b776a5957852c436392085994dc890748c92d7bb2b8083218a91994491d78b62151
SSDEEP 12288:GQYD+tn/6WVetrV1hEbme1+2S7LAgCJyJB4z70bl:3TCWqhVew2cAdIJizgbl
TLSH
T18DA4011036A2DC3AF5E776302E71DBA15A66FC725535888F3318666E3E313C08AB5763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_2b4980ab00b58da9745b82deb70e4bfd_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-10-01_2b4980ab00b58da9745b82deb70e4bfd_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

.exe 441KB

2026-10-01_2b4980ab00b58da9745b82deb70e4bfd_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH d447c88e5ba79016e49c5de135738a35
SHA256 5669cbcba45d86676a567a0ce17099da3f8ed63736111f4e99530031aec9b8d2
MD5 2b4980ab00b58da9745b82deb70e4bfd
SHA1 3d75809ebdf9dbce23fb3adf081d2f751be20bc3
SHA512 1f07b2c89160686e29324ee78e9671b94a193a9780c2795490b115d015e67b776a5957852c436392085994dc890748c92d7bb2b8083218a91994491d78b62151
SSDEEP 12288:GQYD+tn/6WVetrV1hEbme1+2S7LAgCJyJB4z70bl:3TCWqhVew2cAdIJizgbl
TLSH
T18DA4011036A2DC3AF5E776302E71DBA15A66FC725535888F3318666E3E313C08AB5763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15537

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cegutapede\69_caminomi\yarazecuhufe-lipazanimixa\wek.pdb

kernel32

GetEnvironmentStringsW WaitForSingleObject EnumCalendarInfoExW GetConsoleAliasesLengthA GetSystemTimeAsFileTime GetConsoleTitleA CancelDeviceWakeupRequest EnumResourceTypesA GlobalAlloc GetLocaleInfoW InitializeCriticalSectionAndSpinCount SizeofResource GetProcessHandleCount SetConsoleCursorPosition GetFileAttributesW HeapCompact GetConsoleAliasesW GetHandleInformation GetLastError GetProcAddress VirtualAlloc CopyFileA GetFirmwareEnvironmentVariableW GetAtomNameA LoadLibraryA CreateHardLinkW LockResource WaitForMultipleObjects GetDefaultCommConfigA EnumDateFormatsA FillConsoleOutputAttribute CloseHandle DeleteAtom GlobalAddAtomW CheckRemoteDebuggerPresent LCMapStringA GetSystemDefaultLangID IsProcessorFeaturePresent GetStringTypeW CreateFileW HeapAlloc EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapFree EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType DeleteCriticalSection GetModuleHandleW ExitProcess WriteFile GetModuleFileNameW HeapCreate Sleep HeapSize SetFilePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind LoadLibraryW HeapReAlloc ReadFile SetStdHandle FlushFileBuffers RaiseException WriteConsoleW MultiByteToWideChar LCMapStringW

user32

SetCaretPos

advapi32

CloseEventLog

ole32

CoGetMalloc

winhttp

WinHttpQueryOption WinHttpOpen

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_2b4980ab00b58da9745b82deb70e4bfd_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

advapi32

ole32

winhttp

generic