2026-10-23_9e67df2541b6632e3d337ae0e88a79b5_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi

General

Target
2026-10-23_9e67df2541b6632e3d337ae0e88a79b5_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi
Size 79KB
Sample261023-k5sefsce77
SHA256 90e887357b0dd922d951e46c1b22a7686398df687ca984a5e75db0c05dba00c4
MD5 9e67df2541b6632e3d337ae0e88a79b5
SHA1 f0d929faba4ea2b2d69399836a413d1b50330340
SHA512 4fea2b37f0fd6d39c9a79a69a9d2325cb4837f05126a270454ef070c0f16f6ab7a9281f2704da608ec589d13c5da14e2152e4f4f3b5473f088af9899a65a7b48
SSDEEP 1536:aa0wstmSpDaGS2RCSxK28otXFQwUxbTGCq2iW7z:HHstlC2R7JbQwUxXGCH
TLSH
T1A2837D11BA90C03AE0A225304DB5D3A28E3EBC31577994CF7794167D1EB27E2ED78366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_9e67df2541b6632e3d337ae0e88a79b5_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi

File Explorer

2026-10-23_9e67df2541b6632e3d337ae0e88a79b5_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi

.exe 79KB

2026-10-23_9e67df2541b6632e3d337ae0e88a79b5_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi

IMPHASH cf4f510acda53bad738cb1d4e01b1c70
SHA256 90e887357b0dd922d951e46c1b22a7686398df687ca984a5e75db0c05dba00c4
MD5 9e67df2541b6632e3d337ae0e88a79b5
SHA1 f0d929faba4ea2b2d69399836a413d1b50330340
SHA512 4fea2b37f0fd6d39c9a79a69a9d2325cb4837f05126a270454ef070c0f16f6ab7a9281f2704da608ec589d13c5da14e2152e4f4f3b5473f088af9899a65a7b48
SSDEEP 1536:aa0wstmSpDaGS2RCSxK28otXFQwUxbTGCq2iW7z:HHstlC2R7JbQwUxXGCH
TLSH
T1A2837D11BA90C03AE0A225304DB5D3A28E3EBC31577994CF7794167D1EB27E2ED78366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

565248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapSize IsProcessorFeaturePresent HeapReAlloc RtlUnwind CompareStringW GetConsoleMode GetConsoleCP SetFilePointer LoadLibraryW SetStdHandle GetStringTypeW WideCharToMultiByte WriteConsoleW CreateFileW IsWow64Process GetModuleFileNameW Sleep CreateProcessW CloseHandle CreateToolhelp32Snapshot Process32NextW Process32FirstW GetStartupInfoW TerminateProcess OpenProcess GetCurrentProcess GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetLastError HeapFree HeapAlloc SetEnvironmentVariableW GetCurrentDirectoryW SetCurrentDirectoryW GetCommandLineW HeapSetInformation UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress HeapCreate ExitProcess WriteFile GetStdHandle MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LCMapStringW FlushFileBuffers

user32

SetWindowPlacement GetWindowRect EnumWindows GetWindowPlacement SetWindowPos ShowWindow IsWindowVisible SetForegroundWindow DialogBoxParamW OpenInputDesktop FindWindowW GetClientRect CloseDesktop EndDialog FindWindowExW MessageBoxW UnregisterHotKey RegisterHotKey GetWindowThreadProcessId GetShellWindow PostMessageW

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegEnumValueW RegRenameKey RegDeleteTreeW RegDeleteValueW RegQueryValueExW RegCreateKeyExW AdjustTokenPrivileges DuplicateTokenEx LookupPrivilegeValueW CreateProcessWithTokenW OpenProcessToken RegSetValueExW

setupapi

SetupDiSetClassInstallParamsW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiCallClassInstaller

Name

.text

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

479KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

��Y|�u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_9e67df2541b6632e3d337ae0e88a79b5_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi

kernel32

user32

advapi32

setupapi

generic