2026-10-22_54b92a0bb6d43d76c784300c187a92f6_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_54b92a0bb6d43d76c784300c187a92f6_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
Size 11.8MB
Sample261024-p83rtaby6j
SHA256 8d5559137f7627b72abecd75d6c41ce8be4473f9739fcc83d39a72925c308365
MD5 54b92a0bb6d43d76c784300c187a92f6
SHA1 d609702a1961fa1e7fbaaee89b2ec8808da9b753
SHA512 208f77a1eb857fe3c0ca5db905878e0547e38aef6c5cbce8c6319056a92b05c5b4b2ce528233c2d1b5e74be6a6c29519ba74e48d37d807b48171b66299281633
SSDEEP 98304:o3bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb7:o
TLSH
T17AC66BF5AA9DDD84E4472630841ACEE4237DEC55B854520331A43F8E3DB7E4C92E62AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_54b92a0bb6d43d76c784300c187a92f6_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-10-22_54b92a0bb6d43d76c784300c187a92f6_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

.exe 11.8MB

2026-10-22_54b92a0bb6d43d76c784300c187a92f6_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH f7f241e481e669a68bebf8f025c326ec
SHA256 8d5559137f7627b72abecd75d6c41ce8be4473f9739fcc83d39a72925c308365
MD5 54b92a0bb6d43d76c784300c187a92f6
SHA1 d609702a1961fa1e7fbaaee89b2ec8808da9b753
SHA512 208f77a1eb857fe3c0ca5db905878e0547e38aef6c5cbce8c6319056a92b05c5b4b2ce528233c2d1b5e74be6a6c29519ba74e48d37d807b48171b66299281633
SSDEEP 98304:o3bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb7:o
TLSH
T17AC66BF5AA9DDD84E4472630841ACEE4237DEC55B854520331A43F8E3DB7E4C92E62AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19835

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\guhupabase1\lis52\cutuzeje32\suc.pdb

kernel32

LocalFlags GlobalAlloc LoadLibraryW GetProcessHandleCount InterlockedPopEntrySList LeaveCriticalSection WriteConsoleW GetMailslotInfo GetVolumePathNameA lstrlenW GetShortPathNameA GetConsoleAliasesW GetCPInfoExW FillConsoleOutputCharacterW GetLongPathNameW SetLastError SetConsoleTextAttribute WriteProfileSectionA SetStdHandle LoadLibraryA MoveFileA GetModuleFileNameA GetConsoleTitleW VirtualProtect GetFileAttributesExW SetCalendarInfoA CreateFileW HeapSize GetConsoleAliasesLengthW WriteConsoleOutputCharacterA FreeResource UnregisterWait FlushFileBuffers GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TerminateProcess GetCurrentProcess HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent EnterCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection GetProcAddress GetModuleHandleW ExitProcess WriteFile GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep RaiseException RtlUnwind MultiByteToWideChar LCMapStringW GetStringTypeW HeapReAlloc CloseHandle

user32

ClientToScreen

gdi32

GetTextExtentExPointA

advapi32

ClearEventLogW

ole32

CoFileTimeNow

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

289KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vema

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tunage

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rehe

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.wotub

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11.6MB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_54b92a0bb6d43d76c784300c187a92f6_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

gdi32

advapi32

ole32

generic