soulclose | 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader

General

Target
2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader
Size 248KB
Sample261111-d7lalaeb66
SHA256 410e2ac034b55293523dc71e20329b194f2e2039d1f9a1b60bb539e7145003e2
MD5 0bffdc58a79f0e0915c2edf4a36aed04
SHA1 67c1520473144c6e73ca6588117788308fca8dc7
SHA512 7fb3450eb5b16f60bdedcb3a546cc021c65ed3a9a42aa2dd917e50b619de033ccf787e65d6e6bd06d69cc699b293af046b1d7e89d2ba966a85bcd89eff64e077
SSDEEP 3072:5kGHJWGq2cnAAOaOcnrxJWCCCh5LlowIiq2OndK/FFFVTl7JCUv5biMdpV:k2cAAOjcrhN0AF77JPbiMTV
TLSH
T143448C0275D08071E46542B02A29969D2E39FD31CA639E4B73E88ECE3BF05C2B675777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm soulclose

Malware Config

Signatures

Family: Soulclose
Soulclose is a Windows worm written in VisualBasic.
worm soulclose

Detects Soulclose 1 IoCs

resource	yara_rule
sample	family_soulclose

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader

File Explorer

2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader

.exe 248KB

2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader

IMPHASH c8d018cb37e373f39260e312242f20d0
SHA256 410e2ac034b55293523dc71e20329b194f2e2039d1f9a1b60bb539e7145003e2
MD5 0bffdc58a79f0e0915c2edf4a36aed04
SHA1 67c1520473144c6e73ca6588117788308fca8dc7
SHA512 7fb3450eb5b16f60bdedcb3a546cc021c65ed3a9a42aa2dd917e50b619de033ccf787e65d6e6bd06d69cc699b293af046b1d7e89d2ba966a85bcd89eff64e077
SSDEEP 3072:5kGHJWGq2cnAAOaOcnrxJWCCCh5LlowIiq2OndK/FFFVTl7JCUv5biMdpV:k2cAAOjcrhN0AF77JPbiMTV
TLSH
T143448C0275D08071E46542B02A29969D2E39FD31CA639E4B73E88ECE3BF05C2B675777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Soulclose
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaFreeVarList __vbaEnd __vbaPut3 _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 ord518 __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct __vbaOnError __vbaObjSet _adj_fdiv_m16i _adj_fdivr_m16i ord598 _CIsin ord709 ord632 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaVarTstEq __vbaAryConstruct2 __vbaGet4 __vbaPutOwner3 DllFunctionCall __vbaRedimPreserve _adj_fpatan __vbaFixstrConstruct __vbaRedim EVENT_SINK_Release ord600 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler __vbaStrToUnicode __vbaPrintFile _adj_fprem _adj_fdivr_m64 ord607 ord608 __vbaFPException ord717 __vbaGetOwner3 __vbaStrVarVal __vbaVarCat __vbaI2Var ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord578 ord100 ord579 __vbaVarTstNe __vbaStrToAnsi ord617 _CIatan __vbaStrMove ord619 _allmul _CItan _CIexp __vbaFreeStr __vbaFreeObj ord580

Sharing