2026-10-22_61a1f36e53eadfbd1d372b12bb6329d4_amadey_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_61a1f36e53eadfbd1d372b12bb6329d4_amadey_elex_rhadamanthys_smoke-loader_stop
Size 257KB
Sample261024-ncdx5stxfx
SHA256 beb1a234a5f1a7b5f2a4641f0a0c82b530258fdf72a0f58729a91ad255b5ee28
MD5 61a1f36e53eadfbd1d372b12bb6329d4
SHA1 f2f20465e92fbce31ea1edb93603064e51503fd1
SHA512 dd18c798f5216861b4a36dbdff186ba293872cb87ece656853dc286062189f2bb68a9d5a444ceff57fa0906b3bacf5e323111862dcb7cc8e50d89d62e17f8ce2
SSDEEP 6144:xFbLD40taNLaGyavas1UE2i5koywaDwtDexTxJxTxUyzLlWZWdb7jfq4+Z9FZUoH:xytiNfuwsb
TLSH
T18144D4117BF68174F1F31FB2AEBAC696697ABD218E31C60E6245460D0E72B41C931B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_61a1f36e53eadfbd1d372b12bb6329d4_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-22_61a1f36e53eadfbd1d372b12bb6329d4_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 257KB

2026-10-22_61a1f36e53eadfbd1d372b12bb6329d4_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 1076651cfc61d64091463ba2650cc991
SHA256 beb1a234a5f1a7b5f2a4641f0a0c82b530258fdf72a0f58729a91ad255b5ee28
MD5 61a1f36e53eadfbd1d372b12bb6329d4
SHA1 f2f20465e92fbce31ea1edb93603064e51503fd1
SHA512 dd18c798f5216861b4a36dbdff186ba293872cb87ece656853dc286062189f2bb68a9d5a444ceff57fa0906b3bacf5e323111862dcb7cc8e50d89d62e17f8ce2
SSDEEP 6144:xFbLD40taNLaGyavas1UE2i5koywaDwtDexTxJxTxUyzLlWZWdb7jfq4+Z9FZUoH:xytiNfuwsb
TLSH
T18144D4117BF68174F1F31FB2AEBAC696697ABD218E31C60E6245460D0E72B41C931B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109394

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

WFServicesReg.pdb

advapi32

CheckTokenMembership AllocateAndInitializeSid FreeSid

kernel32

SizeofResource LockResource LoadResource FindResourceW FindResourceExW VerifyVersionInfoW VerSetConditionMask lstrlenW GetConsoleWindow WideCharToMultiByte HeapSetInformation RaiseException GetLastError ExpandEnvironmentStringsW CloseHandle WaitForSingleObject CreateProcessW GetEnvironmentVariableW DeleteFileW Sleep CopyFileW GetFileAttributesW GetFullPathNameW GetTempFileNameW GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap RtlUnwind HeapReAlloc SetUnhandledExceptionFilter GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA MultiByteToWideChar LCMapStringW EnterCriticalSection LeaveCriticalSection VirtualAlloc HeapSize InterlockedExchange LoadLibraryA InitializeCriticalSection SetFilePointer GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers CreateFileA GetThreadLocale

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

VarBstrCmp GetErrorInfo SysFreeString VariantClear VariantCopy SysAllocString SysAllocStringByteLen SysStringByteLen SysStringLen VarBstrCat SysAllocStringLen VariantInit

user32

ShowWindow UnregisterClassA

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_61a1f36e53eadfbd1d372b12bb6329d4_amadey_elex_rhadamanthys_smoke-loader_stop

advapi32

kernel32

ole32

oleaut32

user32

shell32

shlwapi

generic