2026-11-07_5948da59628f34b6bc39d172c3f60e13_elex_rhadamanthys_sakula_smoke-loader_stealc_stop_tofsee

General

Target
2026-11-07_5948da59628f34b6bc39d172c3f60e13_elex_rhadamanthys_sakula_smoke-loader_stealc_stop_tofsee
Size 11.7MB
Sample261108-sb9qmsc19w
SHA256 80095c9a90640831b3eba32cbcb5f90f2b4d88c1e771800d42ff58ff62f85790
MD5 5948da59628f34b6bc39d172c3f60e13
SHA1 53f17402e9a738818e536dd519fca9e1ffb85835
SHA512 4914da794a502344ae093ea031aa89654d242c9e7f8a85d57271b1c617ec1b2d24b80e6af0ecf032579683c01ea50de05d9151a808322c54fcd7dbcbb2f49fbc
SSDEEP 24576:AV2jEivMuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuua:ASE
TLSH
T12DC65C10B7E3755EEEF75B74093266D86E3BBC43693192DFE150220B2C35A928AD1723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_5948da59628f34b6bc39d172c3f60e13_elex_rhadamanthys_sakula_smoke-loader_stealc_stop_tofsee

File Explorer

2026-11-07_5948da59628f34b6bc39d172c3f60e13_elex_rhadamanthys_sakula_smoke-loader_stealc_stop_tofsee

.exe 11.7MB

2026-11-07_5948da59628f34b6bc39d172c3f60e13_elex_rhadamanthys_sakula_smoke-loader_stealc_stop_tofsee

IMPHASH 737af8a42dc77816315d62ba976ca86f
SHA256 80095c9a90640831b3eba32cbcb5f90f2b4d88c1e771800d42ff58ff62f85790
MD5 5948da59628f34b6bc39d172c3f60e13
SHA1 53f17402e9a738818e536dd519fca9e1ffb85835
SHA512 4914da794a502344ae093ea031aa89654d242c9e7f8a85d57271b1c617ec1b2d24b80e6af0ecf032579683c01ea50de05d9151a808322c54fcd7dbcbb2f49fbc
SSDEEP 24576:AV2jEivMuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuua:ASE
TLSH
T12DC65C10B7E3755EEEF75B74093266D86E3BBC43693192DFE150220B2C35A928AD1723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xugo\larexufig29 gohokobu\jemejarokeyik\mid.pdb

kernel32

GetConsoleAliasesLengthW SetEndOfFile MapUserPhysicalPages GetEnvironmentStringsW WaitForSingleObject WriteConsoleInputA EnumCalendarInfoExW GetConsoleAliasesA GlobalAlloc GetConsoleMode GetLocaleInfoW HeapValidate GetFileAttributesW GetHandleInformation GetLongPathNameW SetLastError GetThreadLocale GetProcAddress VirtualAlloc GetFirmwareEnvironmentVariableW LoadLibraryA CreateHardLinkW SetSystemTime FindNextFileW GetConsoleTitleW ReleaseMutex EndUpdateResourceA CommConfigDialogW WriteConsoleW HeapReAlloc DecodePointer EncodePointer GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapAlloc GetLastError SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer EnterCriticalSection LeaveCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapFree CloseHandle LoadLibraryW WriteFile GetModuleFileNameW FreeEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep SetStdHandle RtlUnwind WideCharToMultiByte GetConsoleCP FlushFileBuffers HeapSize RaiseException IsProcessorFeaturePresent LCMapStringW MultiByteToWideChar GetStringTypeW CreateFileW

user32

SetCaretPos

ole32

CoRevokeMallocSpy

msimg32

GradientFill

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_5948da59628f34b6bc39d172c3f60e13_elex_rhadamanthys_sakula_smoke-loader_stealc_stop_tofsee

kernel32

user32

ole32

msimg32

generic