2026-11-09_d321a6ecc1cde69dd31a7b7d4d098b51_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-11-09_d321a6ecc1cde69dd31a7b7d4d098b51_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 197KB
Sample261109-wxedeaes8m
SHA256 f36c5f9eb651818e7b63a53090e698165f3b7d59d8678a33f893087fc995b540
MD5 d321a6ecc1cde69dd31a7b7d4d098b51
SHA1 cebe1d547d906e927f250d622dd09d00f46b568a
SHA512 5b3243ffd07f02b00074ef0db3b903be4ce0d91f6926cce9129402db64170893e8654f2a7f283d9757cba50fec5b2fa20cef80df5e81a7d1afd231fd60e4a172
SSDEEP 3072:h/Lug/xKrMrjBVz4HLy2NNO7j7Ho9MwaNXBlPDJh+rWrxpzbgqru:h/LtKrMx1DCE79wIz/+ruzbgwu
TLSH
T1E314CF31749CECB2C5A3457044F4EAF85A7AF8621BA0414B3768271E2E30EDC6AF535E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_d321a6ecc1cde69dd31a7b7d4d098b51_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-11-09_d321a6ecc1cde69dd31a7b7d4d098b51_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 197KB

2026-11-09_d321a6ecc1cde69dd31a7b7d4d098b51_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 594aca90413b48c89195867843c2ace7
SHA256 f36c5f9eb651818e7b63a53090e698165f3b7d59d8678a33f893087fc995b540
MD5 d321a6ecc1cde69dd31a7b7d4d098b51
SHA1 cebe1d547d906e927f250d622dd09d00f46b568a
SHA512 5b3243ffd07f02b00074ef0db3b903be4ce0d91f6926cce9129402db64170893e8654f2a7f283d9757cba50fec5b2fa20cef80df5e81a7d1afd231fd60e4a172
SSDEEP 3072:h/Lug/xKrMrjBVz4HLy2NNO7j7Ho9MwaNXBlPDJh+rWrxpzbgqru:h/LtKrMx1DCE79wIz/+ruzbgwu
TLSH
T1E314CF31749CECB2C5A3457044F4EAF85A7AF8621BA0414B3768271E2E30EDC6AF535E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11263

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xulu.pdb

kernel32

GetLocaleInfoA GetStringTypeA ConvertThreadToFiber GlobalAddAtomA ZombifyActCtx SetDefaultCommConfigW GetEnvironmentStringsW WaitForSingleObject SetVolumeMountPointW GetConsoleAliasesA TerminateThread GetProcessHandleCount GetVersionExW WriteConsoleInputW WriteConsoleW TerminateProcess ReplaceFileW FileTimeToSystemTime SetComputerNameExW GetConsoleAliasesW GetLastError GetProcAddress VirtualAlloc HeapSize LocalAlloc GetModuleHandleA ResetWriteWatch EnumCalendarInfoExA GetConsoleAliasW HeapReAlloc HeapAlloc GetStartupInfoW RaiseException RtlUnwind GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapCreate VirtualFree Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount LoadLibraryA LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetStringTypeW

advapi32

AreAllAccessesGranted

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_d321a6ecc1cde69dd31a7b7d4d098b51_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

advapi32

generic