2026-10-02_3ea0462711d09e98879a58a39573659c_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-10-02_3ea0462711d09e98879a58a39573659c_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 400KB
Sample261003-rer5bs1v2l
SHA256 94833a833b099e17a627b662e4f1f97df2dbb7e7f785bb4e9a42456e5e7c3e16
MD5 3ea0462711d09e98879a58a39573659c
SHA1 6f94a7a81edc5afd6b0e65afa23063835cfa8608
SHA512 31fb675bcd6aafc7dbedce9e9ee7e3ca3716131be95549357d17262fa2819308b0225cd612c5b860b76b4d8e544870da9f034217eb8a0febea25e36a28577dd1
SSDEEP 6144:5dSK04ETTZ+4TBpvjLChvTnvtp9fBDSplK3NsZ5TqiijuWwIOWDYl:5oL4EnU4T/vjL8t/RSplK3Ns/yB/Ra
TLSH
T1B194194A311C57E5E5DF18B883CEDAF2D3DEDD2062321462BAB470932E58375ECE8691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_3ea0462711d09e98879a58a39573659c_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-10-02_3ea0462711d09e98879a58a39573659c_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 400KB

2026-10-02_3ea0462711d09e98879a58a39573659c_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 9dd8c0ff4fc84287e5b766563240f983
SHA256 94833a833b099e17a627b662e4f1f97df2dbb7e7f785bb4e9a42456e5e7c3e16
MD5 3ea0462711d09e98879a58a39573659c
SHA1 6f94a7a81edc5afd6b0e65afa23063835cfa8608
SHA512 31fb675bcd6aafc7dbedce9e9ee7e3ca3716131be95549357d17262fa2819308b0225cd612c5b860b76b4d8e544870da9f034217eb8a0febea25e36a28577dd1
SSDEEP 6144:5dSK04ETTZ+4TBpvjLChvTnvtp9fBDSplK3NsZ5TqiijuWwIOWDYl:5oL4EnU4T/vjL8t/RSplK3Ns/yB/Ra
TLSH
T1B194194A311C57E5E5DF18B883CEDAF2D3DEDD2062321462BAB470932E58375ECE8691
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

52463

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RaiseException GetLastError MultiByteToWideChar lstrlenA InterlockedDecrement GetProcAddress LoadLibraryA FreeResource SizeofResource LockResource LoadResource FindResourceA GetModuleHandleA Module32Next CloseHandle Module32First CreateToolhelp32Snapshot GetCurrentProcessId SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA CreateFileA HeapFree GetProcessHeap HeapAlloc GetCommandLineA HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA WideCharToMultiByte GetConsoleCP GetConsoleMode ReadFile TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId FlushFileBuffers SetFilePointer SetHandleCount GetFileType GetStartupInfoA RtlUnwind FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage CompareStringA CompareStringW SetEnvironmentVariableA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle

ole32

OleInitialize

oleaut32

VariantInit SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SafeArrayCreateVector VariantClear SysFreeString SysAllocString

mscoree

CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_3ea0462711d09e98879a58a39573659c_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

ole32

oleaut32

mscoree

generic