2026-10-16_c5dd0cf66eb1b1df690a14e238f0e689_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-10-16_c5dd0cf66eb1b1df690a14e238f0e689_amadey_elex_rhadamanthys_smoke-loader_stop
Size 128KB
Sample261017-h4mfpsyyct
SHA256 db6f30f34b7306d1b487d5f376c12a6558cee21532457aa252529356e9412fa5
MD5 c5dd0cf66eb1b1df690a14e238f0e689
SHA1 a31c5807462491398a3fa102b254926eba0e34b7
SHA512 1fa2f083be5891a660bb2c6ad24156d8aa112e9697f596b155fda7d2a59cd0854a6777b20bfe60be4f3e9c302180e1e8fb2c4d214b87f66bb8ddfd44423ac0d9
SSDEEP 1536:NjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:NTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T16AD3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_c5dd0cf66eb1b1df690a14e238f0e689_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-16_c5dd0cf66eb1b1df690a14e238f0e689_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 128KB

2026-10-16_c5dd0cf66eb1b1df690a14e238f0e689_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 914bfe5d9a7592d183cbe811a2d982fc
SHA256 db6f30f34b7306d1b487d5f376c12a6558cee21532457aa252529356e9412fa5
MD5 c5dd0cf66eb1b1df690a14e238f0e689
SHA1 a31c5807462491398a3fa102b254926eba0e34b7
SHA512 1fa2f083be5891a660bb2c6ad24156d8aa112e9697f596b155fda7d2a59cd0854a6777b20bfe60be4f3e9c302180e1e8fb2c4d214b87f66bb8ddfd44423ac0d9
SSDEEP 1536:NjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:NTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T16AD3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msimg32

TransparentBlt

kernel32

FindFirstFileA GetLastError GetProcessTimes ExitProcess GlobalAlloc GetCurrentProcess GetProcessIoCounters TlsSetValue GetStringTypeW GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep VirtualAlloc HeapReAlloc RtlUnwind HeapSize MultiByteToWideChar GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA

user32

GetDesktopWindow GetClassNameA CreateWindowExA AnyPopup CharPrevA

gdi32

CloseFigure BitBlt StretchBlt

shell32

DragQueryPoint

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_c5dd0cf66eb1b1df690a14e238f0e689_amadey_elex_rhadamanthys_smoke-loader_stop

msimg32

kernel32

user32

gdi32

shell32

generic