2026-11-03_348b34ea99b0ca0d900df45a34da0dcc_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-11-03_348b34ea99b0ca0d900df45a34da0dcc_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 12.1MB
Sample261105-abldyaet5w
SHA256 a15e6a2ebb8c7cac6f5e9ab47e11542530a227b33df99ee2f2b0b6baa26438e0
MD5 348b34ea99b0ca0d900df45a34da0dcc
SHA1 b4afec99514cb7a48adaa5203d7db09f4a5d81a9
SHA512 f8b8e88f2c2df7306d7753010ebf61463dca4662aed568c181c9def76b700aa1c6a98a0b0ab2bf779ded62498a9dfadc04716192f623baffb990a7dab9ec22fb
SSDEEP 196608:FEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEk:
TLSH
T136D63910BAF5BA59FAF34E3C59717B8D563BBC42AA35811E104C311F1DBE6830992B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_348b34ea99b0ca0d900df45a34da0dcc_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-11-03_348b34ea99b0ca0d900df45a34da0dcc_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 12.1MB

2026-11-03_348b34ea99b0ca0d900df45a34da0dcc_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 4266e36aeae4bf1789c82b3b7f7f3122
SHA256 a15e6a2ebb8c7cac6f5e9ab47e11542530a227b33df99ee2f2b0b6baa26438e0
MD5 348b34ea99b0ca0d900df45a34da0dcc
SHA1 b4afec99514cb7a48adaa5203d7db09f4a5d81a9
SHA512 f8b8e88f2c2df7306d7753010ebf61463dca4662aed568c181c9def76b700aa1c6a98a0b0ab2bf779ded62498a9dfadc04716192f623baffb990a7dab9ec22fb
SSDEEP 196608:FEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEk:
TLSH
T136D63910BAF5BA59FAF34E3C59717B8D563BBC42AA35811E104C311F1DBE6830992B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15057

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\pubosovit\78-laha\xecotowab-hiputojoseko\26\v.pdb

kernel32

GetSystemDefaultLangID HeapCompact LoadResource GlobalAddAtomA GetEnvironmentStringsW SetHandleInformation WaitForSingleObject GetConsoleAliasesLengthA GetSystemTimeAsFileTime GetConsoleTitleA GlobalAlloc GetFirmwareEnvironmentVariableA GetLocaleInfoW CopyFileW DeleteVolumeMountPointW LeaveCriticalSection GetFileAttributesA GetFileAttributesW GetDevicePowerState LCMapStringA GetConsoleAliasesW GetLastError GetProcAddress VirtualAlloc LoadLibraryA IsWow64Process WaitForMultipleObjects EnumResourceTypesW EnumDateFormatsA SetConsoleCursorInfo FillConsoleOutputAttribute GlobalAddAtomW CheckRemoteDebuggerPresent EnumCalendarInfoExA LocalFree DecodePointer EncodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetModuleHandleW ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapAlloc HeapFree SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer EnterCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement CloseHandle WriteFile GetModuleFileNameW FreeEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId LoadLibraryW Sleep WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage ReadFile SetStdHandle RtlUnwind FlushFileBuffers HeapSize IsProcessorFeaturePresent HeapReAlloc RaiseException WriteConsoleW MultiByteToWideChar LCMapStringW GetStringTypeW CreateFileW

user32

SetCaretPos

ole32

CoGetMalloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_348b34ea99b0ca0d900df45a34da0dcc_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

ole32

generic