2026-05-03_446e5cce3b32a35ccbf1ded07506faef_elex_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-03_446e5cce3b32a35ccbf1ded07506faef_elex_rhadamanthys_smoke-loader_stealc_stop
Size 150KB
Sample260503-2b7eysc14k
SHA256 dbeec6f89c6088e6ed4059ada75f9f3d8bb43946a0610e7022b3da2451d60088
MD5 446e5cce3b32a35ccbf1ded07506faef
SHA1 7ab79359eba8604a55c98d211954a6a85618941f
SHA512 16b3361436a79c7c2b324291a0e7476d81cb0b16f76bc624bda6bf283f9ba84a8482079bf6c20af2b0d9456416516ca28532a0ca1a16193dec9cee8dc2bf60ed
SSDEEP 3072:Bu3ZJxjOe6EIGQTvbXTkXmtklVE5grQki+y4:Bup6u1QLbXE6Cb7i+y4
TLSH
T19CE37B0539C7C0B3F41605728985CBD64B7FFC632F7669EBBB86064D0A252D68E322A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-05-03_446e5cce3b32a35ccbf1ded07506faef_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-05-03_446e5cce3b32a35ccbf1ded07506faef_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 150KB

2026-05-03_446e5cce3b32a35ccbf1ded07506faef_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 2a5eda290f65f2d6f1eabc941c1abf91
SHA256 dbeec6f89c6088e6ed4059ada75f9f3d8bb43946a0610e7022b3da2451d60088
MD5 446e5cce3b32a35ccbf1ded07506faef
SHA1 7ab79359eba8604a55c98d211954a6a85618941f
SHA512 16b3361436a79c7c2b324291a0e7476d81cb0b16f76bc624bda6bf283f9ba84a8482079bf6c20af2b0d9456416516ca28532a0ca1a16193dec9cee8dc2bf60ed
SSDEEP 3072:Bu3ZJxjOe6EIGQTvbXTkXmtklVE5grQki+y4:Bup6u1QLbXE6Cb7i+y4
TLSH
T19CE37B0539C7C0B3F41605728985CBD64B7FFC632F7669EBBB86064D0A252D68E322A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e8:d5:73:fa:5b:e0:2c:e8:7f:5d:4d:86:86:83:bd:59:68:eb:7f:23

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Chains

Mar 11, 2012

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:ac:b3

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 28, 1999 - Jan 27, 2017

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Serial Number

04:00:00:00:00:01:20:19:c1:90:66

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 18, 2009 - Jan 28, 2028

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Serial Number

01:00:00:00:00:01:25:b0:b4:cc:01

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 21, 2009 - Dec 22, 2020

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:1e:44:a5:ec:be

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Revoked

Revocation Date

Aug 26, 2014

Timespan

Jan 22, 2004 - Jan 27, 2017

Subject

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Serial Number

01:00:00:00:00:01:2e:df:9f:72:ca

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2011 - Apr 21, 2012

Minor OS version

Major OS version

Entry point

37504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\qzwang\workspace\InputSafe\winsrc\browser\DriverInstaller\Release\DriverInstaller.pdb

kernel32

GetFileAttributesW GetSystemDirectoryW GetLastError FindClose FindNextFileW FindFirstFileW CreateDirectoryW CloseHandle CreateFileW DeleteFileW MoveFileExW InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetVersionExA HeapAlloc GetProcessHeap LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetCPInfo GetProcAddress GetModuleHandleA ExitProcess RtlUnwind RaiseException HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetACP GetOEMCP IsValidCodePage WriteFile GetConsoleCP GetConsoleMode SetFilePointer ReadFile FlushFileBuffers GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoA GetStringTypeA GetStringTypeW LoadLibraryA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale HeapSize SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoW CreateFileA SetEndOfFile

advapi32

RegQueryValueExW RegDeleteKeyW RegCreateKeyExW DeleteService RegCloseKey RegSetValueExW RegOpenKeyExW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-03_446e5cce3b32a35ccbf1ded07506faef_elex_rhadamanthys_smoke-loader_stealc_stop

PE Signature issue

kernel32

advapi32

shell32

generic