2026-10-22_9458dd37e38424f9bae216e027f11deb_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-10-22_9458dd37e38424f9bae216e027f11deb_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee
Size 737KB
Sample261024-exhmdssvay
SHA256 6aaba6d220d7f6f1a84ed690fb5fef9fd517477d2a0c55c9aaec967fb010c9f7
MD5 9458dd37e38424f9bae216e027f11deb
SHA1 45d6a474f4d95925dfae80ba8c423bb28804c0a9
SHA512 9fb8aa962bf0831181703d205caf9adfc5ec7e556f664427106990c0a0137070c698be1c50debc75f83fa3d1b0b06e225d5189f3abec776976f5b6505489078e
SSDEEP 12288:nkNAbGuYVie+0TZxWTXOvXjfaz4WxXbIUv0CNeVXXDGQFl5//qc2/3AeM3wNynFM:nkpVL+MUVoVXXC8Ac2YV3swxhZPegenB
TLSH
T17EF4023036C1C072E16311348AE4C7F54EBDBDB16361989FBBD91A79AF385D4A23136A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_9458dd37e38424f9bae216e027f11deb_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-10-22_9458dd37e38424f9bae216e027f11deb_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

.exe 737KB

2026-10-22_9458dd37e38424f9bae216e027f11deb_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH ba6e7d1028cd73d291b266f23866459e
SHA256 6aaba6d220d7f6f1a84ed690fb5fef9fd517477d2a0c55c9aaec967fb010c9f7
MD5 9458dd37e38424f9bae216e027f11deb
SHA1 45d6a474f4d95925dfae80ba8c423bb28804c0a9
SHA512 9fb8aa962bf0831181703d205caf9adfc5ec7e556f664427106990c0a0137070c698be1c50debc75f83fa3d1b0b06e225d5189f3abec776976f5b6505489078e
SSDEEP 12288:nkNAbGuYVie+0TZxWTXOvXjfaz4WxXbIUv0CNeVXXDGQFl5//qc2/3AeM3wNynFM:nkpVL+MUVoVXXC8Ac2YV3swxhZPegenB
TLSH
T17EF4023036C1C072E16311348AE4C7F54EBDBDB16361989FBBD91A79AF385D4A23136A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

36058

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\b\HTE\QDART\QDART_MFG\BSP_Storage\QSaharaServer\Release\QSaharaServer.pdb

kernel32

CloseHandle SetCommTimeouts CreateFileA WriteFile ReadFile Sleep GetTickCount GetSystemInfo GetSystemTimeAsFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetLastError GetFileType FindClose GetDriveTypeA FindFirstFileExA GetFileAttributesA EnterCriticalSection LeaveCriticalSection GetProcAddress GetModuleHandleW ExitProcess DecodePointer SetFilePointer GetCommandLineA HeapSetInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer IsProcessorFeaturePresent WideCharToMultiByte GetTimeZoneInformation SetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetStartupInfoW DeleteCriticalSection GetFullPathNameA HeapFree GetCurrentDirectoryW SetCurrentDirectoryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread GetConsoleCP GetConsoleMode SetEndOfFile HeapAlloc GetProcessHeap MultiByteToWideChar InterlockedExchange FatalAppExitA SetConsoleCtrlHandler FreeLibrary LoadLibraryW GetLocaleInfoW GetModuleFileNameW HeapSize HeapQueryInformation HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetCurrentProcessId RtlUnwind GetDriveTypeW LCMapStringW WriteConsoleW FlushFileBuffers GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW CompareStringW SetEnvironmentVariableA CreateDirectoryA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_9458dd37e38424f9bae216e027f11deb_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

generic