2026-10-27_e712872a1b3d71958d37ef0d8adf737a_amadey_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_e712872a1b3d71958d37ef0d8adf737a_amadey_elex_rhadamanthys_smoke-loader_stop
Size 375KB
Sample261027-3yffesxwcx
SHA256 b180933dc0e5b161d9f2bdef16d345fe0fea047e790d6c6644f9682e692a71bd
MD5 e712872a1b3d71958d37ef0d8adf737a
SHA1 711a3ab75661841a76e011629aafc8e7dd77bc0a
SHA512 14c40a8ce55fb08c01d4588d7fd6e7cc3e05d5aa916a5890a55d7618cb1b674c5a5f6048f771f699e0262d5892f5fe96eb6dfcaed3e87afdbb09951edd2d293b
SSDEEP 6144:WxdCj7P3vItYxFLEjUa+q3BpDziaIm1PLjm0lNCeH7n30ZxgDrCCQLK:WxdMhFLEXRpmaIm1Pvm0lNCmWdLK
TLSH
T18E847D2277D0C076C26235764A63E7B96ABEBC719D21474B37D13B7E9E30281992870F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-27_e712872a1b3d71958d37ef0d8adf737a_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 375KB

2026-10-27_e712872a1b3d71958d37ef0d8adf737a_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 3aeae43ba533a8b94f0241a63887d215
SHA256 b180933dc0e5b161d9f2bdef16d345fe0fea047e790d6c6644f9682e692a71bd
MD5 e712872a1b3d71958d37ef0d8adf737a
SHA1 711a3ab75661841a76e011629aafc8e7dd77bc0a
SHA512 14c40a8ce55fb08c01d4588d7fd6e7cc3e05d5aa916a5890a55d7618cb1b674c5a5f6048f771f699e0262d5892f5fe96eb6dfcaed3e87afdbb09951edd2d293b
SSDEEP 6144:WxdCj7P3vItYxFLEjUa+q3BpDziaIm1PLjm0lNCeH7n30ZxgDrCCQLK:WxdMhFLEXRpmaIm1Pvm0lNCmWdLK
TLSH
T18E847D2277D0C076C26235764A63E7B96ABEBC719D21474B37D13B7E9E30281992870F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

5b:4f:0b:5f:a3:bf:03:eb:26:1a:3d:fc:52:e4:ba:2f:d1:a8:1e:aa:43:7e:03:39:41:59:8b:fc:31:4e:ec:87

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91110108746729965F,CN=北京亿赛通科技发展有限责任公司,O=北京亿赛通科技发展有限责任公司,STREET=海淀区西二旗大街39号4层401,L=北京,ST=北京,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 28, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

6e:1c:f8:71:f7:79:90:dd:59:c0:cd:40

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 14, 2024 - May 1, 2027

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

134190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\working-820and900\CDG-820and900\PDB\CdgTwin32.pdb

dynamicdll

?StartHook@CDynamicDll@@QAEHXZ ??1CDynamicDll@@UAE@XZ ?StopHook@CDynamicDll@@QAEHXZ ??1CCdgExchg@@UAE@XZ ??0CDynamicDll@@QAE@XZ

kernel32

LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetVolumeInformationW GetFullPathNameW SetErrorMode GetTickCount GetFileAttributesW GetFileSizeEx GetFileTime GetStartupInfoW HeapAlloc HeapFree RtlUnwind ExitProcess RaiseException HeapReAlloc HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA FlushFileBuffers GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA CreateFileW WriteFile CloseHandle GetWindowsDirectoryW GetCurrentProcess GetLastError CreateToolhelp32Snapshot Sleep Module32FirstW SizeofResource LockResource LoadResource FindResourceW Module32NextW OpenProcess GetProcAddress GetModuleHandleW VirtualAllocEx WriteProcessMemory CreateRemoteThread WaitForSingleObject VirtualFreeEx GetPrivateProfileStringW Process32FirstW Process32NextW GetProcessTimes GetSystemTimeAsFileTime OpenEventW OutputDebugStringW CopyFileW CreateMutexW GetCommandLineW GetSystemDirectoryW GetPrivateProfileIntW CreateThread ReleaseMutex CreateEventW TerminateProcess WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetModuleFileNameW DeleteFileW SetFilePointer ReadFile MoveFileW GetThreadLocale lstrlenA InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags FindFirstFileW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FindClose GetModuleHandleA GlobalFindAtomW GetVersionExW LoadLibraryW CompareStringW LoadLibraryA GetVersionExA InterlockedDecrement GetCurrentProcessId GlobalAddAtomW WritePrivateProfileStringW FreeResource SetLastError GlobalUnlock FormatMessageW LocalFree lstrlenW MulDiv GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW MoveFileExW LoadLibraryExW CompareStringA InterlockedExchange GlobalLock lstrcmpW FreeLibrary GlobalFree GlobalAlloc

user32

PostThreadMessageW CharUpperW MessageBeep GetNextDlgGroupItem InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW CharNextW GetSysColorBrush ReleaseCapture LoadCursorW SetCapture ShowWindow MoveWindow SetWindowTextW IsDialogMessageW EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect GetDlgCtrlID DefWindowProcW CallWindowProcW PtInRect GetMenu SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect wsprintfW GetMessageW TranslateMessage DispatchMessageW GetSysColor DestroyMenu CopyRect UnhookWindowsHookEx GetDesktopWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem EndDialog GetWindowThreadProcessId GetWindowLongW GetLastActivePopup RegisterClipboardFormatW IsWindowEnabled MessageBoxW UnregisterClassW LoadIconW SendMessageW IsIconic GetSystemMetrics GetClientRect EnableWindow PostMessageW PostQuitMessage GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState SetWindowPos MapDialogRect GetParent SetWindowContextHelpId GetWindow CheckMenuItem EnableMenuItem ModifyMenuW GetFocus LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageW GetKeyState IsWindowVisible GetActiveWindow CallNextHookEx SetWindowsHookExW SetCursor GetWindowTextW

gdi32

SetMapMode DeleteObject GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC GetStockObject GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox ExtTextOutW GetObjectW CreateBitmap GetDeviceCaps

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegQueryValueExW RegSetValueExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW InitializeSecurityDescriptor RegCreateKeyExW SetSecurityDescriptorDacl RegCloseKey

shell32

SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW PathStripToRootW PathIsUNCW PathFindFileNameW

oledlg

OleUIBusyW

ole32

OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter CLSIDFromProgID

oleaut32

SysStringLen SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocString

ws2_32

WSCEnumProtocols WSCDeinstallProvider

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_e712872a1b3d71958d37ef0d8adf737a_amadey_elex_rhadamanthys_smoke-loader_stop

dynamicdll

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

generic