2026-11-11_3d506bfd0af23b112f8315d611a44408_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-11-11_3d506bfd0af23b112f8315d611a44408_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 2.3MB
Sample261113-q9lelacv21
SHA256 03767ab23ad18f65eab3de30225fb6141c72ec8bc87cfd0eb7495d0b88cd3337
MD5 3d506bfd0af23b112f8315d611a44408
SHA1 11963e2a82f406a60c521e5b212a02341d1b1362
SHA512 98342fe85df2faf9fe3aef0cda800ceb7819ab5338a94c0b7c3f3e135aeef4771ee1d1340981de0ed40fdb2c29712b701797e5a6218f8e2a35ef0cf3591f8f6d
SSDEEP 49152:entTXkbCnb73fb+19te3Fd4BVEKFNKzw+IOafdl7PF0BbW+ra:e9Bn33y1G2UKr+IOadl7PFQil
TLSH
T1AEB51217E48083AED46164F84CF9A9F32E123CD3429D89E6E6F9332D9A171C3857978D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_3d506bfd0af23b112f8315d611a44408_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-11-11_3d506bfd0af23b112f8315d611a44408_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 2.3MB

2026-11-11_3d506bfd0af23b112f8315d611a44408_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 9dd8c0ff4fc84287e5b766563240f983
SHA256 03767ab23ad18f65eab3de30225fb6141c72ec8bc87cfd0eb7495d0b88cd3337
MD5 3d506bfd0af23b112f8315d611a44408
SHA1 11963e2a82f406a60c521e5b212a02341d1b1362
SHA512 98342fe85df2faf9fe3aef0cda800ceb7819ab5338a94c0b7c3f3e135aeef4771ee1d1340981de0ed40fdb2c29712b701797e5a6218f8e2a35ef0cf3591f8f6d
SSDEEP 49152:entTXkbCnb73fb+19te3Fd4BVEKFNKzw+IOafdl7PF0BbW+ra:e9Bn33y1G2UKr+IOadl7PFQil
TLSH
T1AEB51217E48083AED46164F84CF9A9F32E123CD3429D89E6E6F9332D9A171C3857978D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

52463

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RaiseException GetLastError MultiByteToWideChar lstrlenA InterlockedDecrement GetProcAddress LoadLibraryA FreeResource SizeofResource LockResource LoadResource FindResourceA GetModuleHandleA Module32Next CloseHandle Module32First CreateToolhelp32Snapshot GetCurrentProcessId SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA CreateFileA HeapFree GetProcessHeap HeapAlloc GetCommandLineA HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA WideCharToMultiByte GetConsoleCP GetConsoleMode ReadFile TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId FlushFileBuffers SetFilePointer SetHandleCount GetFileType GetStartupInfoA RtlUnwind FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage CompareStringA CompareStringW SetEnvironmentVariableA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle

ole32

OleInitialize

oleaut32

VariantInit SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SafeArrayCreateVector VariantClear SysFreeString SysAllocString

mscoree

CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_3d506bfd0af23b112f8315d611a44408_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

ole32

oleaut32

mscoree

generic