2026-10-06_6d76bed158c41e3ae27a6a8f4306760b_amadey_elex_ramnit_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-06_6d76bed158c41e3ae27a6a8f4306760b_amadey_elex_ramnit_rhadamanthys_smoke-loader_stop
Size 632KB
Sample261006-pterfagw9t
SHA256 ed52883457f00237d90a60b018befae0c8f8f691d681d0e425d22db4f1e4bb22
MD5 6d76bed158c41e3ae27a6a8f4306760b
SHA1 3e0db545029695408d369d030d885430bb6ddea4
SHA512 8c2c9185270db288cf07eb8315adfa9e42f5979b44406fe314873641737eca22c24126de0bd4644137d1eaa49818ffa0e82d7c501b520b4dd9f9b656161a74bd
SSDEEP 12288:ZvqSyJda/aulZAuYL901/gWxiEGwTS/3hRqLREtYb:dUJdaLbY+oGiiTSfKLREt
TLSH
T116D48B92F6408462E353283E867EB266E25DFEA167134287E7D01739DD903DBE5E430E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_6d76bed158c41e3ae27a6a8f4306760b_amadey_elex_ramnit_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-06_6d76bed158c41e3ae27a6a8f4306760b_amadey_elex_ramnit_rhadamanthys_smoke-loader_stop

.exe 632KB

2026-10-06_6d76bed158c41e3ae27a6a8f4306760b_amadey_elex_ramnit_rhadamanthys_smoke-loader_stop

IMPHASH 5d009133348f9a5dbdd49fde8dcb5c28
SHA256 ed52883457f00237d90a60b018befae0c8f8f691d681d0e425d22db4f1e4bb22
MD5 6d76bed158c41e3ae27a6a8f4306760b
SHA1 3e0db545029695408d369d030d885430bb6ddea4
SHA512 8c2c9185270db288cf07eb8315adfa9e42f5979b44406fe314873641737eca22c24126de0bd4644137d1eaa49818ffa0e82d7c501b520b4dd9f9b656161a74bd
SSDEEP 12288:ZvqSyJda/aulZAuYL901/gWxiEGwTS/3hRqLREtYb:dUJdaLbY+oGiiTSfKLREt
TLSH
T116D48B92F6408462E353283E867EB266E25DFEA167134287E7D01739DD903DBE5E430E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

674026

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Projets\vbsedit_source\script2exe\Release\mywscript.pdb

kernel32

FileTimeToLocalFileTime GetFileAttributesW GetFileSizeEx GetFileTime GetStartupInfoW HeapAlloc HeapFree RtlUnwind HeapReAlloc RaiseException VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapSize SetUnhandledExceptionFilter GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetStartupInfoA HeapCreate VirtualFree CreateFileW GetTickCount GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA WriteConsoleW CreateFileA SetEnvironmentVariableA GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile WritePrivateProfileStringW GetModuleHandleA GlobalFlags TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc FileTimeToSystemTime GetCurrentProcessId SetErrorMode GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange InterlockedIncrement lstrlenA lstrcmpA GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom LoadLibraryW CompareStringW LoadLibraryA lstrcmpW GetVersionExA FreeLibrary InterlockedDecrement GetProcAddress GetLastError SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW CloseHandle WriteFile SetConsoleOutputCP GetConsoleOutputCP WideCharToMultiByte GetFileType FlushFileBuffers SetFilePointer ReadFile ExitProcess GetModuleFileNameW ExpandEnvironmentStringsW GetStdHandle CreateThread Sleep GetModuleHandleW GetCommandLineW MultiByteToWideChar FindResourceW LoadResource LockResource QueryPerformanceCounter SizeofResource

user32

CharUpperW SetCursor GrayStringW DrawTextExW DrawTextW TabbedTextOutW ClientToScreen DestroyMenu ShowWindow SetWindowTextW LoadCursorW GetDC ReleaseDC GetSysColorBrush GetWindowThreadProcessId IsWindowEnabled PostQuitMessage SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW EnableMenuItem GetMessageW GetCursorPos ValidateRect RegisterWindowMessageW LoadIconW WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus IsWindow GetWindowTextW GetForegroundWindow GetLastActivePopup GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints GetKeyState SetMenu MessageBoxW GetActiveWindow MsgWaitForMultipleObjects PeekMessageW EnableWindow SetForegroundWindow IsWindowVisible GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW LoadBitmapW TranslateMessage DispatchMessageW GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState UnhookWindowsHookEx GetWindow GetSystemMetrics GetWindowRect GetWindowPlacement IsIconic SystemParametersInfoA SetWindowPos SetWindowLongW GetWindowLongW GetMenu PtInRect GetSysColor AdjustWindowRectEx GetParent GetDlgCtrlID SendMessageW DefWindowProcW CallWindowProcW CopyRect CheckMenuItem

gdi32

DeleteDC GetStockObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape TextOutW RectVisible GetDeviceCaps SetMapMode RestoreDC SaveDC DeleteObject ExtTextOutW CreateBitmap SetBkColor SetTextColor GetClipBox PtVisible

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegSetValueExW RegEnumKeyW RegDeleteKeyW RegQueryValueW RegOpenKeyW RegCreateKeyExW RegCloseKey RegQueryValueExW RegEnumKeyExW RegOpenKeyExW

shlwapi

PathStripToRootW PathIsUNCW PathFindFileNameW PathFindExtensionW

ole32

CoDisconnectObject StringFromGUID2 CoGetObject CoCreateInstance CLSIDFromProgID CoInitialize

oleaut32

SysFreeString VariantInit VariantCopy VariantClear SysAllocStringLen VariantChangeType LoadTypeLibEx LoadRegTypeLi SysAllocString SysStringLen LoadTypeLi

Name

.text

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

299KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

zhlzmmj

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_6d76bed158c41e3ae27a6a8f4306760b_amadey_elex_ramnit_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

ole32

oleaut32

generic