2026-11-02_e9e6a9f1b06c013acfe7c72bd11425e2_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_e9e6a9f1b06c013acfe7c72bd11425e2_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
Size 11.8MB
Sample261102-x3a4lscy2s
SHA256 f52497e7ed115801ff54d7b35a691d0222b4d587f2d6c6467726d3fdb339ea8f
MD5 e9e6a9f1b06c013acfe7c72bd11425e2
SHA1 0673ed8b8ea4fc6e54d9821cb5d19acb2b777216
SHA512 e4ebb3bd7a94415855f9d7f6c05526e6f2fd0ff0e5191215b70b5c9e85ee61c863f5e2e71864568457e5a70840de4a0a8ef587c55aafae9d8ae996ca11b06be2
SSDEEP 98304:EddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddD:
TLSH
T1A1C66B74E69CDD88E4472E30849A8EE4E77CFD85A850561331A43B4E39B7F0C52E52AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_e9e6a9f1b06c013acfe7c72bd11425e2_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-11-02_e9e6a9f1b06c013acfe7c72bd11425e2_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

.exe 11.8MB

2026-11-02_e9e6a9f1b06c013acfe7c72bd11425e2_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 6e95b72b10d0f281b4ddebe8de5e9772
SHA256 f52497e7ed115801ff54d7b35a691d0222b4d587f2d6c6467726d3fdb339ea8f
MD5 e9e6a9f1b06c013acfe7c72bd11425e2
SHA1 0673ed8b8ea4fc6e54d9821cb5d19acb2b777216
SHA512 e4ebb3bd7a94415855f9d7f6c05526e6f2fd0ff0e5191215b70b5c9e85ee61c863f5e2e71864568457e5a70840de4a0a8ef587c55aafae9d8ae996ca11b06be2
SSDEEP 98304:EddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddD:
TLSH
T1A1C66B74E69CDD88E4472E30849A8EE4E77CFD85A850561331A43B4E39B7F0C52E52AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\lulaboc_yirinugiyuna-50\tatumaxi_c.pdb

kernel32

LocalFlags GlobalAlloc LoadLibraryW GetProcessHandleCount InterlockedPopEntrySList LeaveCriticalSection WriteConsoleW GetMailslotInfo lstrlenW GetShortPathNameA GetConsoleAliasesW GetCPInfoExW FillConsoleOutputCharacterW GetLongPathNameW SetLastError CreateDirectoryW WriteProfileSectionA SetStdHandle LoadLibraryA MoveFileA GetModuleFileNameA FindFirstChangeNotificationA GetConsoleTitleW VirtualProtect GetFileAttributesExW SetCalendarInfoA CloseHandle HeapSize WriteConsoleOutputCharacterA SetConsoleTextAttribute GetConsoleAliasesLengthW UnregisterWait SetFilePointer FlushFileBuffers GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TerminateProcess GetCurrentProcess HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent EnterCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection GetProcAddress GetModuleHandleW ExitProcess WriteFile GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep WideCharToMultiByte RtlUnwind LCMapStringW MultiByteToWideChar GetStringTypeW HeapReAlloc GetConsoleCP GetConsoleMode CreateFileW

user32

ClientToScreen

gdi32

GetTextExtentExPointA

advapi32

ClearEventLogW

ole32

CoFileTimeNow

Name

.text

Size

166KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

289KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.toget

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cax

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.lawucem

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.sujawi

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11.4MB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_e9e6a9f1b06c013acfe7c72bd11425e2_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

gdi32

advapi32

ole32

generic