2026-11-10_39e9d1e2902e7d1181b7de84cc00dc91_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-11-10_39e9d1e2902e7d1181b7de84cc00dc91_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_stop
Size 1.3MB
Sample261110-kfm4faea79
SHA256 014c73172be2ae4cc1a5ef99c85bfe6aea3017ae657bdbf6dc0698642546ec45
MD5 39e9d1e2902e7d1181b7de84cc00dc91
SHA1 fd9f73ce187a436851d186c118c960b211071be9
SHA512 03880c6cff5649309302b0d274040d6473d7d8f8d22d4507af63c60611fbfad0496b3441bc26bd01228b11111ee5be53dcc568da6fb7fc6f176a954b775353bd
SSDEEP 12288:9SxQMsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/MssqjnhMgeiCl7G0nehbGZpbD
TLSH
T17555016269947065E46308B07EA1ED376C1E3FE675F47CC33DB53B2ADA32190CA35226
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_39e9d1e2902e7d1181b7de84cc00dc91_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-11-10_39e9d1e2902e7d1181b7de84cc00dc91_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_stop

.exe 1.3MB

2026-11-10_39e9d1e2902e7d1181b7de84cc00dc91_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_stop

IMPHASH b0092ddbfe7213b1ed8e314a0ef72a4a
SHA256 014c73172be2ae4cc1a5ef99c85bfe6aea3017ae657bdbf6dc0698642546ec45
MD5 39e9d1e2902e7d1181b7de84cc00dc91
SHA1 fd9f73ce187a436851d186c118c960b211071be9
SHA512 03880c6cff5649309302b0d274040d6473d7d8f8d22d4507af63c60611fbfad0496b3441bc26bd01228b11111ee5be53dcc568da6fb7fc6f176a954b775353bd
SSDEEP 12288:9SxQMsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/MssqjnhMgeiCl7G0nehbGZpbD
TLSH
T17555016269947065E46308B07EA1ED376C1E3FE675F47CC33DB53B2ADA32190CA35226
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10202

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\rc_v11_personal_20201125_branch\Build\Release\WPSOffice\office6\addons\kscreensaverlauncher\kscreensaverlauncher.pdb

kernel32

CloseHandle OutputDebugStringW CreateProcessW CopyFileW GetModuleFileNameW DeleteFileW WaitForSingleObject SetDllDirectoryW LocalAlloc GetProcAddress FreeLibrary InterlockedExchange GetLastError LoadLibraryA RaiseException GetCommandLineW HeapSetInformation RtlUnwind SetUnhandledExceptionFilter GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapAlloc HeapFree LeaveCriticalSection EnterCriticalSection LoadLibraryW Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode MultiByteToWideChar HeapReAlloc LCMapStringW GetStringTypeW SetStdHandle WriteConsoleW CreateFileW FlushFileBuffers

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_39e9d1e2902e7d1181b7de84cc00dc91_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_stop

kernel32

generic