2026-05-03_530baf678d0729ae75a7250b3d2cfce5_elex_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-03_530baf678d0729ae75a7250b3d2cfce5_elex_rhadamanthys_smoke-loader_stealc_stop
Size 150KB
Sample260503-2cb1fac14l
SHA256 eecfde77bd6a3b7b18e6ed05adb99600f885c057d5b1a8b5f0f0d7e652c93e70
MD5 530baf678d0729ae75a7250b3d2cfce5
SHA1 9a7c4cd9930cece01f83205845660b1d91e3b570
SHA512 c3cc3845c285a7e6179883473ee769ed284cbab58e82ac1f0f51ebc45908dd8b9218f0ffd194fd7bae2b1b5a40b95b223f1a6b3e283adb3257e51a77382b0891
SSDEEP 3072:qu3ZJxjOe6EIGQTvbXTkXmtklVE5grQki+yP:qup6u1QLbXE6Cb7i+yP
TLSH
T1E9E37B0539C7C0B3F41605728985CBD64B7FFC632F7669EBBBC6064D0A252D68E322A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-05-03_530baf678d0729ae75a7250b3d2cfce5_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-05-03_530baf678d0729ae75a7250b3d2cfce5_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 150KB

2026-05-03_530baf678d0729ae75a7250b3d2cfce5_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 2a5eda290f65f2d6f1eabc941c1abf91
SHA256 eecfde77bd6a3b7b18e6ed05adb99600f885c057d5b1a8b5f0f0d7e652c93e70
MD5 530baf678d0729ae75a7250b3d2cfce5
SHA1 9a7c4cd9930cece01f83205845660b1d91e3b570
SHA512 c3cc3845c285a7e6179883473ee769ed284cbab58e82ac1f0f51ebc45908dd8b9218f0ffd194fd7bae2b1b5a40b95b223f1a6b3e283adb3257e51a77382b0891
SSDEEP 3072:qu3ZJxjOe6EIGQTvbXTkXmtklVE5grQki+yP:qup6u1QLbXE6Cb7i+yP
TLSH
T1E9E37B0539C7C0B3F41605728985CBD64B7FFC632F7669EBBBC6064D0A252D68E322A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e8:d5:73:fa:5b:e0:2c:e8:7f:5d:4d:86:86:83:bd:59:68:eb:7f:23

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Chains

Dec 13, 2011

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:ac:b3

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 28, 1999 - Jan 27, 2017

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Serial Number

04:00:00:00:00:01:20:19:c1:90:66

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 18, 2009 - Jan 28, 2028

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Serial Number

01:00:00:00:00:01:25:b0:b4:cc:01

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 21, 2009 - Dec 22, 2020

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:1e:44:a5:ec:be

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Revoked

Revocation Date

Aug 26, 2014

Timespan

Jan 22, 2004 - Jan 27, 2017

Subject

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Serial Number

01:00:00:00:00:01:2e:df:9f:72:ca

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2011 - Apr 21, 2012

Minor OS version

Major OS version

Entry point

37504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\qzwang\workspace\InputSafe\winsrc\browser\DriverInstaller\Release\DriverInstaller.pdb

kernel32

GetFileAttributesW GetSystemDirectoryW GetLastError FindClose FindNextFileW FindFirstFileW CreateDirectoryW CloseHandle CreateFileW DeleteFileW MoveFileExW InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetVersionExA HeapAlloc GetProcessHeap LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetCPInfo GetProcAddress GetModuleHandleA ExitProcess RtlUnwind RaiseException HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetACP GetOEMCP IsValidCodePage WriteFile GetConsoleCP GetConsoleMode SetFilePointer ReadFile FlushFileBuffers GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoA GetStringTypeA GetStringTypeW LoadLibraryA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale HeapSize SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoW CreateFileA SetEndOfFile

advapi32

RegQueryValueExW RegDeleteKeyW RegCreateKeyExW DeleteService RegCloseKey RegSetValueExW RegOpenKeyExW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-03_530baf678d0729ae75a7250b3d2cfce5_elex_rhadamanthys_smoke-loader_stealc_stop

PE Signature issue

kernel32

advapi32

shell32

generic