2026-10-25_aeda986c9860290ec785e01aab94bdc6_elex_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_aeda986c9860290ec785e01aab94bdc6_elex_rhadamanthys_smoke-loader_stealc_stop
Size 1.5MB
Sample261026-thg5msbd94
SHA256 ce11f60474d47b3027e407b9a950114710dc873b06186c0769dc3412b5e54537
MD5 aeda986c9860290ec785e01aab94bdc6
SHA1 1c3cf497c7fbc756f46dc391332c4ca8aa019aa7
SHA512 721c300e84ffeb0ec0621de506240c30264fda6d2c38f9e449eddd904925d64696d1bc1f1f16151df22a5b4507337367dcea9008c39f64f213877fb1886ece76
SSDEEP 24576:MELwG/8yjiZwzJ4g/xTr+sTUdNdxsTB906BiDVFI8S1uoRpqEMslu0J:MJG/8yjO6/xTSsaNjsN906w7G1fX
TLSH
T19675F2617BC2C172E9B61336C86A5B7A297BF6321B2706C7B38406791D307D26E3435E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_aeda986c9860290ec785e01aab94bdc6_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-25_aeda986c9860290ec785e01aab94bdc6_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 1.5MB

2026-10-25_aeda986c9860290ec785e01aab94bdc6_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 2d308066d6f1695ad2f3f042ed04d178
SHA256 ce11f60474d47b3027e407b9a950114710dc873b06186c0769dc3412b5e54537
MD5 aeda986c9860290ec785e01aab94bdc6
SHA1 1c3cf497c7fbc756f46dc391332c4ca8aa019aa7
SHA512 721c300e84ffeb0ec0621de506240c30264fda6d2c38f9e449eddd904925d64696d1bc1f1f16151df22a5b4507337367dcea9008c39f64f213877fb1886ece76
SSDEEP 24576:MELwG/8yjiZwzJ4g/xTr+sTUdNdxsTB906BiDVFI8S1uoRpqEMslu0J:MJG/8yjO6/xTSsaNjsN906w7G1fX
TLSH
T19675F2617BC2C172E9B61336C86A5B7A297BF6321B2706C7B38406791D307D26E3435E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

282721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\886563\out\Release\ScriptExecute.pdb

kernel32

SetLastError GetTickCount QueryPerformanceCounter GetExitCodeProcess CreateProcessW GetStartupInfoW ExpandEnvironmentStringsW lstrlenA GetDiskFreeSpaceExW CreateDirectoryW SystemTimeToFileTime ReadFile lstrcmpiW GetPrivateProfileStringW CopyFileW TerminateProcess InterlockedIncrement InterlockedDecrement GetWindowsDirectoryW GetCurrentThread VirtualAlloc VirtualQuery ResumeThread GetThreadContext SuspendThread OpenThread SetThreadPriority GetThreadPriority FlushInstructionCache VirtualProtect lstrcpyW GetTempPathW SetErrorMode WaitForMultipleObjects SetEvent OpenEventW CreateFileA FileTimeToLocalFileTime FileTimeToSystemTime GetProcessHeap HeapAlloc HeapFree UnmapViewOfFile CreateFileMappingW MapViewOfFile GetShortPathNameW GetTempFileNameW GetCurrentDirectoryW CreateEventW GetDriveTypeW SetFileTime GetFileAttributesW lstrcmpiA lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA GetModuleFileNameA GetFileAttributesExW SetFileAttributesW LocalAlloc GetCurrentThreadId GetLocalTime SetFilePointer GetFileSizeEx MoveFileW WriteFile DeleteCriticalSection WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW GetCurrentProcessId Process32NextW GetLastError OpenProcess DeviceIoControl InitializeCriticalSection GetCommandLineW GetPrivateProfileIntW InterlockedExchange LocalFree InterlockedCompareExchange Sleep lstrlenW GetVersionExW FreeResource GetSystemWindowsDirectoryW GetCurrentProcess GetModuleHandleA GetSystemInfo DeleteFileW EnterCriticalSection LeaveCriticalSection CloseHandle FreeLibrary LoadLibraryExW LoadLibraryW WaitForSingleObject FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetSystemDirectoryW GetModuleHandleW GetProcAddress GetModuleFileNameW FindFirstFileW FindNextFileW FindClose SetStdHandle GetConsoleOutputCP WriteConsoleA GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeA GetLocaleInfoA GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetStartupInfoA SetHandleCount GetTimeZoneInformation GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount LoadLibraryA HeapCreate VirtualFree IsValidCodePage GetOEMCP GetACP GetStringTypeW GetCPInfo LCMapStringW LCMapStringA GetStdHandle GetFileType WriteConsoleW GetDateFormatA GetTimeFormatA CreateThread ExitThread ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind TlsFree TlsAlloc ReleaseMutex HeapWalk HeapLock HeapUnlock TlsSetValue OutputDebugStringW TlsGetValue SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime HeapSize HeapReAlloc HeapDestroy CreateMutexW MultiByteToWideChar RaiseException CreateFileW SetVolumeLabelW

user32

ExitWindowsEx SetForegroundWindow BringWindowToTop GetActiveWindow MessageBoxW PostMessageW GetClassInfoExW RegisterClassExW CreateWindowExW DefWindowProcW FindWindowW IsIconic IsWindowVisible ShowWindow

advapi32

SetFileSecurityW RegEnumKeyExA StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW SetServiceStatus RegOpenKeyW RegCreateKeyW GetFileSecurityW InitializeSecurityDescriptor GetSecurityDescriptorDacl GetLengthSid InitializeAcl EqualSid AddAce AddAccessAllowedAce SetSecurityDescriptorDacl GetSecurityDescriptorControl StartServiceW DeleteService CreateServiceW ChangeServiceConfig2W LockServiceDatabase QueryServiceLockStatusW UnlockServiceDatabase ChangeServiceConfigW ControlService QueryServiceStatus QueryServiceConfigW OpenSCManagerW OpenServiceW CloseServiceHandle RegSetValueExW RegCreateKeyExW RegDeleteValueW GetAclInformation GetAce GetUserNameW GetNamedSecurityInfoW BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW GetExplicitEntriesFromAclW DeleteAce LookupAccountNameW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumKeyExW RegQueryValueExA RegOpenKeyExA

shell32

CommandLineToArgvW SHCreateDirectoryExW SHFileOperationW SHGetSpecialFolderPathW ord165 ShellExecuteW

shlwapi

SHGetValueA SHSetValueA StrStrIA StrFormatByteSizeW PathIsRelativeW PathFindFileNameW PathIsDirectoryW SHDeleteKeyW PathIsRootW SHSetValueW SHDeleteValueW PathStripPathW SHGetValueW PathFileExistsW PathAppendW PathRemoveFileSpecW PathCombineW StrStrIW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

psapi

GetModuleFileNameExW EnumProcessModules

setupapi

SetupIterateCabinetW

urlmon

URLDownloadToFileW

imm32

ImmDisableIME

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_aeda986c9860290ec785e01aab94bdc6_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

advapi32

shell32

shlwapi

wtsapi32

psapi

setupapi

urlmon

imm32

generic