2026-10-22_721e30544b36c0dbefba058d555c8240_amadey_elex_rhadamanthys_smoke-loader_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_721e30544b36c0dbefba058d555c8240_amadey_elex_rhadamanthys_smoke-loader_tofsee
Size 1.4MB
Sample261024-kt64gatsft
SHA256 8b0e9d67109f978e50e56ecb176c347b540c21e2809d7c24e8527edddfda83c2
MD5 721e30544b36c0dbefba058d555c8240
SHA1 61659d00adfcdffcc6aa8ad8a89a252a6ec4a75f
SHA512 ba0e62007bb189efe426cf062bbb482bc5ed0bc4fb72bbd73ffed31e02f2afb7910afed15ddef83cdd5a83748cf5581803cb405c8e84968dfc78f458aee9865a
SSDEEP 24576:ecM22/RZMDzfgEJkzzjqbQYFDP65Nska9geeJUGGRo:K22RZMDjgo+nENi5Nska9geeZGRo
TLSH
T1CC659CA02AA4E4D6F311D87490F1DFFF84FA7C350966840696EAB6BD9B3E7743C15202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_721e30544b36c0dbefba058d555c8240_amadey_elex_rhadamanthys_smoke-loader_tofsee

File Explorer

2026-10-22_721e30544b36c0dbefba058d555c8240_amadey_elex_rhadamanthys_smoke-loader_tofsee

.exe 1.4MB

2026-10-22_721e30544b36c0dbefba058d555c8240_amadey_elex_rhadamanthys_smoke-loader_tofsee

IMPHASH 18c97dc215631c5e06106d291c0263f8
SHA256 8b0e9d67109f978e50e56ecb176c347b540c21e2809d7c24e8527edddfda83c2
MD5 721e30544b36c0dbefba058d555c8240
SHA1 61659d00adfcdffcc6aa8ad8a89a252a6ec4a75f
SHA512 ba0e62007bb189efe426cf062bbb482bc5ed0bc4fb72bbd73ffed31e02f2afb7910afed15ddef83cdd5a83748cf5581803cb405c8e84968dfc78f458aee9865a
SSDEEP 24576:ecM22/RZMDzfgEJkzzjqbQYFDP65Nska9geeJUGGRo:K22RZMDjgo+nENi5Nska9geeZGRo
TLSH
T1CC659CA02AA4E4D6F311D87490F1DFFF84FA7C350966840696EAB6BD9B3E7743C15202
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69331

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildslave\unity\build\build\WindowsWebplugin\UnityBugReporter.pdb

kernel32

FindFirstFileW FindNextFileW FindClose lstrlenW SetFileAttributesW DeleteFileW GetLastError RemoveDirectoryW GetCurrentProcess GetVersion lstrcmpiW lstrlenA WriteFile FlushInstructionCache lstrcpyW ReadFile GetModuleFileNameW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection SetLastError WaitForSingleObject CreateEventW CreateThread SetEvent FileTimeToDosDateTime GetFileSize SetFilePointer SystemTimeToFileTime FileTimeToSystemTime GetLocalTime GetFileType GetFileInformationByHandle GetPrivateProfileStringW WritePrivateProfileStringW lstrcpynW lstrcpyA ExpandEnvironmentStringsW VerSetConditionMask GetModuleHandleW GetVersionExW VerifyVersionInfoW GetSystemInfo SetFilePointerEx GetFileTime SetFileTime GetTickCount InterlockedPopEntrySList VirtualAlloc VirtualFree InterlockedPushEntrySList InterlockedCompareExchange GetProcessHeap FlushFileBuffers SetEnvironmentVariableA CompareStringW WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP GetStringTypeW RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW Sleep GetStdHandle DeleteCriticalSection InitializeCriticalSectionAndSpinCount LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP lstrcmpW CloseHandle GetFileSizeEx CreateFileW GetLocaleInfoW GetUserDefaultLCID GlobalMemoryStatusEx MultiByteToWideChar FreeLibrary GetProcAddress LoadLibraryW FindResourceExW FindResourceW LoadResource LockResource SizeofResource RaiseException LocalFree FormatMessageW WideCharToMultiByte InterlockedDecrement InterlockedIncrement GetCPInfo HeapSize HeapReAlloc HeapDestroy HeapCreate TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW HeapSetInformation GetCommandLineW HeapAlloc GetTimeZoneInformation EncodePointer DecodePointer ExitProcess HeapFree

user32

DestroyWindow SetWindowLongW GetWindowLongW ReleaseDC CallWindowProcW GetSysColor GetDesktopWindow MonitorFromWindow GetDC CreateWindowExW DefWindowProcW MessageBoxW SendMessageW GetClientRect FillRect BeginPaint GetSystemMetrics DrawIcon GetWindowTextW GetWindowTextLengthW DrawTextW EndPaint GetDlgItem SetWindowTextW EndDialog wsprintfA PostMessageW EnableWindow UnregisterClassA SendDlgItemMessageW DialogBoxParamW GetActiveWindow DestroyIcon LoadIconW SetWindowPos LoadCursorW GetSysColorBrush SetCursor TrackMouseEvent

gdi32

DeleteObject SetPixelFormat GetTextExtentPoint32W SelectObject SetBkMode SetBkColor SetTextColor CreateFontIndirectW GetObjectW CreateSolidBrush ChoosePixelFormat

advapi32

RegQueryValueExW RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW SHCreateDirectoryExW

ole32

CoSetProxyBlanket CoCreateInstance CoCreateGuid CoTaskMemFree CoInitialize

oleaut32

SysFreeString SysAllocString

shlwapi

PathFindFileNameW PathCombineW PathAppendW UrlEscapeW PathCompactPathW

opengl32

wglCreateContext wglMakeCurrent wglDeleteContext glGetString

wininet

HttpQueryInfoW InternetQueryDataAvailable InternetReadFile InternetCrackUrlW HttpEndRequestW InternetConnectW InternetCloseHandle HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestExW InternetSetStatusCallbackW InternetSetOptionW InternetOpenW InternetWriteFile

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_721e30544b36c0dbefba058d555c8240_amadey_elex_rhadamanthys_smoke-loader_tofsee

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

opengl32

wininet

version

generic