2026-11-04_bde095f4f06a2f5ae12636539a20a9f7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-11-04_bde095f4f06a2f5ae12636539a20a9f7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
Size 376KB
Sample261105-rtgbda1tby
SHA256 536d276ae6f809b7f2b781566a8395934d075db1607dca124c9c1bb9d2e70f91
MD5 bde095f4f06a2f5ae12636539a20a9f7
SHA1 199d6d6855c91245339c536fa0d277c31e9fdbee
SHA512 a8d271ece04ea1c32d43e898b2d3eba9c308c26c5a5c13eeb7b7ba0299926a5bfda274046fc03981d68ea8780307cdfc1af56e543b380b7d337bd84b3b1217fa
SSDEEP 6144:dX8oi6ExtkebxfqdDPWDXuJYpCZwExeZZhTD:Zu6ExVbxSdzoXnEWF
TLSH
T10584C002D3F3BC98E5294A315D6AC6E4A62EB9515E1426AF331C3A2F1B701A1C573FF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-04_bde095f4f06a2f5ae12636539a20a9f7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-11-04_bde095f4f06a2f5ae12636539a20a9f7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 376KB

2026-11-04_bde095f4f06a2f5ae12636539a20a9f7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 5c51ec4a6f442a6a3636ad4616307822
SHA256 536d276ae6f809b7f2b781566a8395934d075db1607dca124c9c1bb9d2e70f91
MD5 bde095f4f06a2f5ae12636539a20a9f7
SHA1 199d6d6855c91245339c536fa0d277c31e9fdbee
SHA512 a8d271ece04ea1c32d43e898b2d3eba9c308c26c5a5c13eeb7b7ba0299926a5bfda274046fc03981d68ea8780307cdfc1af56e543b380b7d337bd84b3b1217fa
SSDEEP 6144:dX8oi6ExtkebxfqdDPWDXuJYpCZwExeZZhTD:Zu6ExVbxSdzoXnEWF
TLSH
T10584C002D3F3BC98E5294A315D6AC6E4A62EB9515E1426AF331C3A2F1B701A1C573FF1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasExesA InterlockedIncrement CreateJobObjectW InterlockedCompareExchange SetVolumeMountPointW GetTimeFormatA CreateHardLinkA _lcreat LocalFlags SetFileTime ClearCommBreak SetFileShortNameW LoadLibraryW CopyFileW _hread GetCalendarInfoA SetVolumeMountPointA GetVersionExW GetFileAttributesW VerifyVersionInfoA GetModuleFileNameW CreateActCtxA GetEnvironmentVariableA RaiseException LCMapStringA InterlockedExchange GetStdHandle GetLogicalDriveStringsA GetLastError GetLocaleInfoA CreateNamedPipeA EnumSystemCodePagesW SetComputerNameA GlobalFree LoadLibraryA InterlockedExchangeAdd LocalAlloc SetCalendarInfoW GetNumberFormatW CreateEventW OpenEventA QueryDosDeviceW FoldStringA SetEnvironmentVariableA GlobalWire GetCurrentDirectoryA EnumDateFormatsW GetShortPathNameW SetProcessShutdownParameters GetDiskFreeSpaceExW ReadConsoleInputW DebugBreak GetTempPathA SetFileAttributesW CommConfigDialogW TlsGetValue SetFilePointer EnumCalendarInfoA GetProcAddress GetComputerNameA InterlockedDecrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapReAlloc GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate HeapSize InitializeCriticalSectionAndSpinCount TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage GetStringTypeW

gdi32

GetBkMode CreateDCW GetCharWidth32A GetCharWidthI

winhttp

WinHttpOpen

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-04_bde095f4f06a2f5ae12636539a20a9f7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

gdi32

winhttp

generic