2026-10-22_b076581f695986117f7ff266923c226d_elex_karagany_maze_rhadamanthys_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_b076581f695986117f7ff266923c226d_elex_karagany_maze_rhadamanthys_smoke-loader_stealc
Size 182KB
Sample261024-alpjca1xav
SHA256 6ff4928242cfcc1fb973930f2efe83e9f74e47ab05f59d54fe9650f0a3fc8bb0
MD5 b076581f695986117f7ff266923c226d
SHA1 250aa61837d6d120cd1932516a01f538d3c92eb5
SHA512 e65d04e7ae3b83cd28eefbae6c6aaa0c922cdff51bf11da87cdaa0412a26357fcec15c483a91624c3ec40dfbf77dda1dfdbdaed32e1cf9979cf5ecbc997f4a15
SSDEEP 3072:IiWsazuWS2X9Xp2bCkKD1uje7zC+DNxKNk+7GN0J3ghFxT:9azuWS2hM3J2C0zf+6hFt
TLSH
T104049C32B9C080B1D8A3023455F8AB3556BEBE75477898D7B3944B4D1E206D2B73B7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_b076581f695986117f7ff266923c226d_elex_karagany_maze_rhadamanthys_smoke-loader_stealc

.exe 182KB

2026-10-22_b076581f695986117f7ff266923c226d_elex_karagany_maze_rhadamanthys_smoke-loader_stealc

IMPHASH 3d5fcdffa82810acd5db47d3e62296a2
SHA256 6ff4928242cfcc1fb973930f2efe83e9f74e47ab05f59d54fe9650f0a3fc8bb0
MD5 b076581f695986117f7ff266923c226d
SHA1 250aa61837d6d120cd1932516a01f538d3c92eb5
SHA512 e65d04e7ae3b83cd28eefbae6c6aaa0c922cdff51bf11da87cdaa0412a26357fcec15c483a91624c3ec40dfbf77dda1dfdbdaed32e1cf9979cf5ecbc997f4a15
SSDEEP 3072:IiWsazuWS2X9Xp2bCkKD1uje7zC+DNxKNk+7GN0J3ghFxT:9azuWS2hM3J2C0zf+6hFt
TLSH
T104049C32B9C080B1D8A3023455F8AB3556BEBE75477898D7B3944B4D1E206D2B73B7A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

c0:22:d0:e2:32:81:dc:7e:9a:1d:62:c3:6c:5a:82:f7:79:6c:c0:4c:38:9e:dd:53:be:16:74:f7:96:62:ef:c5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=7857161,CN=SABER INTERACTIVE INC.,O=SABER INTERACTIVE INC.,L=Fort Lauderdale,ST=Florida,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 16, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

03:09:a4:9d:a9:80:08:c0:84:38:ba:4a:7e:4a:c6:f7

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 16, 2024 - Aug 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

48959

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Build\Staging\insurgency-staging\main\csgo\rel_pc\src\crash_handler\Release\crash_handler.pdb

libcurl

curl_easy_getinfo curl_easy_cleanup curl_easy_perform curl_easy_setopt curl_easy_init curl_easy_strerror curl_global_cleanup curl_global_init curl_formfree curl_formadd

steam_api

SteamAPI_Init SteamAPI_GetHSteamUser SteamInternal_CreateInterface SteamAPI_GetHSteamPipe

tier0

?Start@CThread@@UAE_NIW4ThreadPriorityEnum_t@@@Z ?OnExit@CThread@@MAEXXZ ?IsThreadRunning@CThread@@MAE_NXZ ?Init@CThread@@MAE_NXZ ?GetThreadProc@CThread@@MAEP6GKPAX@ZXZ ??0CWorkerThread@@QAE@XZ ?SetName@CThread@@QAEXPBD@Z ??1CThread@@UAE@XZ ??1CThreadSyncObject@@QAE@XZ ?Sleep@CThread@@SAXI@Z ?IsAlive@CThread@@QAE_NXZ Warning ?WaitForCreateComplete@CThread@@MAE_NPAVCThreadEvent@@@Z CommandLine Plat_GetTimeString GetThreadedLoadLibraryFunc Plat_FloatTime Plat_ExitProcess LoggingSystem_IsChannelEnabled LoggingSystem_Log LOG_GENERAL g_pMemAlloc ?DevMsg@@YAXPBDZZ ?Lock@CThreadFastMutex@@ACEXII@Z Error ReleaseThreadHandle Msg Plat_GetLocalTime Plat_IsInDebugSession ?DevWarning@@YAXPBDZZ StackToolsNotify_LoadedLibrary CreateSimpleThread

vstdlib

KeyValuesSystem

kernel32

FileTimeToSystemTime GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameA SystemTimeToTzSpecificLocalTime FindFirstFileExW FindClose SetStdHandle GetProcessHeap GetCPInfo LoadLibraryExA CreateFileMappingA WaitForSingleObject ReadConsoleW SetEndOfFile WriteConsoleW SetFilePointerEx GetFullPathNameW GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers OutputDebugStringW LCMapStringW CompareStringW GetStringTypeW GetCurrentDirectoryW UnregisterWait CreateMutexW GetCurrentProcess SetEvent ConnectNamedPipe CreateNamedPipeW WriteFile InitializeCriticalSection Sleep LeaveCriticalSection ReadFile GetOverlappedResult DisconnectNamedPipe GetLastError EnterCriticalSection ResetEvent RegisterWaitForSingleObject CreateEventW DeleteCriticalSection GetCurrentThreadId DuplicateHandle ReleaseMutex CloseHandle GetCurrentProcessId UnregisterWaitEx GetSystemTimeAsFileTime GetProcessTimes OpenProcess ReadProcessMemory FreeLibrary LoadLibraryW CreateFileW GetProcAddress MultiByteToWideChar WideCharToMultiByte EncodePointer DecodePointer ExitProcess GetModuleHandleExW AreFileApisANSI HeapFree HeapAlloc HeapReAlloc FileTimeToLocalFileTime GetFileInformationByHandle GetFileType PeekNamedPipe GetOEMCP RaiseException RtlUnwind GetCommandLineA IsDebuggerPresent IsProcessorFeaturePresent GetDriveTypeW GetFullPathNameA SetEnvironmentVariableA HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetStdHandle GetModuleFileNameW LoadLibraryExW IsValidCodePage GetACP FreeEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_b076581f695986117f7ff266923c226d_elex_karagany_maze_rhadamanthys_smoke-loader_stealc

libcurl

steam_api

tier0

vstdlib

kernel32

generic