2026-04-22_bbdb9bd82f0a8ad5d93683803a341c05_elex_karagany_mafia_rhadamanthys_smoke-loader_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-22_bbdb9bd82f0a8ad5d93683803a341c05_elex_karagany_mafia_rhadamanthys_smoke-loader_virut
Size 201KB
Sample260422-npjddsat2w
SHA256 dd44f47fff1f397b5cb9d99569c5241d5eeaf5a74a4845c404981e88d55e3b50
MD5 bbdb9bd82f0a8ad5d93683803a341c05
SHA1 75f25cd20fbe5035663db4a59c7b355107275ed3
SHA512 8a9eb6a1df5cb32e8c276b3e1b7aedf49d132c2468504634c1c1fd7ed6aea5998661fba68138a020f7be0455da3e6eee08538e4370e55f2dcbed5c8cb7c34111
SSDEEP 3072:MPxxmK+aRUGdFAZ5GzRN5c87xicP8SvTtIdpa/1EdXtdVRA06LW/2UJKC:MPxxmVa77scP9tIdpaNWXxRA4JKC
TLSH
T10E1438C0A3C4453EE0A2123518339B7D8B3BBDE80E35A9D7E39779654A7E2C2547C366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-04-22_bbdb9bd82f0a8ad5d93683803a341c05_elex_karagany_mafia_rhadamanthys_smoke-loader_virut

File Explorer

2026-04-22_bbdb9bd82f0a8ad5d93683803a341c05_elex_karagany_mafia_rhadamanthys_smoke-loader_virut

.exe 201KB

2026-04-22_bbdb9bd82f0a8ad5d93683803a341c05_elex_karagany_mafia_rhadamanthys_smoke-loader_virut

IMPHASH 4256a100fbbc4c2d9a3b16244e10a718
SHA256 dd44f47fff1f397b5cb9d99569c5241d5eeaf5a74a4845c404981e88d55e3b50
MD5 bbdb9bd82f0a8ad5d93683803a341c05
SHA1 75f25cd20fbe5035663db4a59c7b355107275ed3
SHA512 8a9eb6a1df5cb32e8c276b3e1b7aedf49d132c2468504634c1c1fd7ed6aea5998661fba68138a020f7be0455da3e6eee08538e4370e55f2dcbed5c8cb7c34111
SSDEEP 3072:MPxxmK+aRUGdFAZ5GzRN5c87xicP8SvTtIdpa/1EdXtdVRA06LW/2UJKC:MPxxmVa77scP9tIdpaNWXxRA4JKC
TLSH
T10E1438C0A3C4453EE0A2123518339B7D8B3BBDE80E35A9D7E39779654A7E2C2547C366
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a4:65:9a:e4:a3:06:9b:6d:fd:06:44:5a:6c:f4:2e:ae:3a:10:f8:12:c5:f9:f4:62:fb:5c:3d:55:20:fc:81:aa

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 2, 2016

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

d0:51:05:a2:aa:5d:8d:00:1d:c5:f6:17:1f:fd:b8:0f:85:98:bc:10

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=3409950,CN=Micro Focus (US)\, Inc.,O=Micro Focus (US)\, Inc.,POSTALCODE=84606,STREET=1800 South Novell Place,L=Provo,ST=Utah,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 2, 2016

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

0c:18:79:3e:08:95:c3:ee:3c:91:58:72:6e:66:8f:bb

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 11, 2016 - Aug 1, 2018

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:12:b0:54:93:ea:dd:ce:eb:4b:00:00:00:00:00:12

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 12, 2016 - May 12, 2017

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9f:67:f2:b5:a8:23:06:5b:7b:00:00:00:00:00:9f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

Major OS version

Entry point

39904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Source_Code\20SP4IR2\winclient\free\i386\acu.pdb

kernel32

MapViewOfFile OpenFileMappingA GetExitCodeProcess GetComputerNameExW CreateProcessA OutputDebugStringA lstrcmpiA UnmapViewOfFile FormatMessageA LocalFree FreeLibrary GetWindowsDirectoryA Sleep lstrcatA GetPrivateProfileStringA lstrlenA lstrcpyA GetModuleFileNameA GetVersionExA GetVersion VerSetConditionMask VerifyVersionInfoA GetCurrentProcess GlobalAlloc GlobalFree CreateEventA GetLastError WaitForSingleObject CloseHandle GetProcessHeap SetEndOfFile CreateFileW CreateFileA WriteConsoleW FlushFileBuffers SetStdHandle HeapReAlloc HeapAlloc SetFilePointer GetStringTypeW LCMapStringW GetSystemTimeAsFileTime GetProcAddress GetModuleHandleW ExitProcess DecodePointer GetFileAttributesA MultiByteToWideChar EncodePointer GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize HeapFree WideCharToMultiByte GetConsoleCP GetConsoleMode RtlUnwind FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId ReadFile

advapi32

OpenSCManagerA OpenServiceA CloseServiceHandle ControlService LookupPrivilegeValueA AdjustTokenPrivileges InitiateSystemShutdownA RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA RegDeleteValueA RegDeleteKeyExA CheckTokenMembership OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid CreateProcessWithLogonW

user32

wvsprintfA GetFocus MessageBoxA wsprintfA GetSystemMetrics GetWindowRect MoveWindow LoadStringA GetForegroundWindow MessageBoxExA FindWindowA SendMessageA

shell32

SHGetFolderPathA

nclangid

_NCLoadResourceFile@4

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-22_bbdb9bd82f0a8ad5d93683803a341c05_elex_karagany_mafia_rhadamanthys_smoke-loader_virut

PE Signature issue

PE Signature issue

kernel32

advapi32

user32

shell32

nclangid

generic