2026-11-10_a6a0781d4edf57fa7349be0354d284e8_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-11-10_a6a0781d4edf57fa7349be0354d284e8_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee
Size 644KB
Sample261111-3vmekacy6z
SHA256 eb40ac57537a23f30440ef449be5f59cecce8972d8c2583008197c3a81991266
MD5 a6a0781d4edf57fa7349be0354d284e8
SHA1 ea4f657dc0ef642155844cbb35cfb5642b8ae312
SHA512 720cc3e92dbdd6a454a2ae58e41e45e1e485c82dd1f1d836641ce70f9d62796abf9ff80cedbb58b9172d2e12aa8d9d42442d45b3d3e103312ba325364c0877cf
SSDEEP 12288:ckB1caJRJwQQ/G4QGm7EsVg8EUl4sICIfDFw690zPzNhKPxR4FQ7:ckB1caJRJwZ/G4q7RVdD6fZwVaJY
TLSH
T1BCE412D1F1E1C47AC6B67A7C856186A44EFBF861E270C14B367817AE1FE1BD05E21322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_a6a0781d4edf57fa7349be0354d284e8_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-11-10_a6a0781d4edf57fa7349be0354d284e8_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

.exe 644KB

2026-11-10_a6a0781d4edf57fa7349be0354d284e8_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH af69c0299dddc24235527244e383548d
SHA256 eb40ac57537a23f30440ef449be5f59cecce8972d8c2583008197c3a81991266
MD5 a6a0781d4edf57fa7349be0354d284e8
SHA1 ea4f657dc0ef642155844cbb35cfb5642b8ae312
SHA512 720cc3e92dbdd6a454a2ae58e41e45e1e485c82dd1f1d836641ce70f9d62796abf9ff80cedbb58b9172d2e12aa8d9d42442d45b3d3e103312ba325364c0877cf
SSDEEP 12288:ckB1caJRJwQQ/G4QGm7EsVg8EUl4sICIfDFw690zPzNhKPxR4FQ7:ckB1caJRJwZ/G4q7RVdD6fZwVaJY
TLSH
T1BCE412D1F1E1C47AC6B67A7C856186A44EFBF861E270C14B367817AE1FE1BD05E21322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bog\tidadoz_pe.pdb

kernel32

ConvertThreadToFiber GlobalAddAtomA GetConsoleAliasA WaitForSingleObject WriteConsoleInputA SetEvent GetConsoleAliasesA GetEnvironmentStrings GetProcessHandleCount GetConsoleAliasW HeapValidate GetWriteWatch GetLocaleInfoA TerminateProcess FileTimeToSystemTime GetVolumePathNameA GetStringTypeExA GetHandleInformation GetProcAddress VirtualAlloc LoadLibraryA WriteConsoleA LocalAlloc CreateHardLinkW VirtualProtect EndUpdateResourceA GetVersionExA EnumCalendarInfoExA GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetModuleHandleA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

advapi32

MapGenericMask

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_a6a0781d4edf57fa7349be0354d284e8_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

kernel32

advapi32

generic