firseria | 2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee
Size 500KB
Sample260509-emmtcsav7x
SHA256 6caf0368366df4deeeaa28dfec1f5c20725d89001f1048c02870bc9fee5ef2bf
MD5 f44fd051468509022b2f76698547bf42
SHA1 42c89c226645cc44fbdabdfa7611a5f832355731
SHA512 059151565a6d2a83312dee12b08b3f53e85c57815c33e1eca48cec6d8b930a4bb657250ad7ff92baa8c572c092ab70488bdcd1cc11f13fd70411bcc91ae4dd33
SSDEEP 12288:gbEqkIX9IoqwhJmWYUXBDcLP7jGKk1XKdsKFWY:gbRk++whzBIP7jCJY
TLSH
T1BFB4DF3A245C80F7D22616B489C2A2F3F7ACB8A1552C557727CB4E3B1E20395B717E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

revoked_codesign downloader adware firseria

Malware Config

Signatures

Family: Firseria
Firseria a downloader/adware written in C++.
downloader adware firseria

Detects Firseria 1 IoCs

downloader adware

resource	yara_rule
sample	family_firseria

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee

File Explorer

2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee

.exe 500KB

2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee

IMPHASH 14bf3342f75d172cf7b51fecf7fa2116
SHA256 6caf0368366df4deeeaa28dfec1f5c20725d89001f1048c02870bc9fee5ef2bf
MD5 f44fd051468509022b2f76698547bf42
SHA1 42c89c226645cc44fbdabdfa7611a5f832355731
SHA512 059151565a6d2a83312dee12b08b3f53e85c57815c33e1eca48cec6d8b930a4bb657250ad7ff92baa8c572c092ab70488bdcd1cc11f13fd70411bcc91ae4dd33
SSDEEP 12288:gbEqkIX9IoqwhJmWYUXBDcLP7jGKk1XKdsKFWY:gbRk++whzBIP7jCJY
TLSH
T1BFB4DF3A245C80F7D22616B489C2A2F3F7ACB8A1552C557727CB4E3B1E20395B717E1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Firseria

downloader adware
Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

90:70:85:d1:ef:eb:62:41:90:4a:87:83:f9:9c:93:ab:56:3c:ac:ac

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Firseria,O=Firseria,L=Badalona,ST=Barcelona,C=ES,1.2.840.113549.1.9.1=#0c13737570706f727440736f6c696d62612e636f6d

Chains

Jun 19, 2014

CN=Firseria,O=Firseria,L=Badalona,ST=Barcelona,C=ES,1.2.840.113549.1.9.1=#0c13737570706f727440736f6c696d62612e636f6d

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

02:00:00:00:00:00:d6:78:b7:94:05

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 1, 1998 - Jan 28, 2014

Subject

CN=Firseria,O=Firseria,L=Badalona,ST=Barcelona,C=ES,1.2.840.113549.1.9.1=#0c13737570706f727440736f6c696d62612e636f6d

Serial Number

11:21:30:c3:b2:8d:7c:9c:29:b8:b0:73:21:ef:3f:8a:14:62

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Nov 11, 2013

Timespan

Nov 11, 2013 - Nov 12, 2014

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 23, 2013 - Sep 23, 2024

Minor OS version

Major OS version

Entry point

61532

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize WaitForSingleObject WriteFile GetTempPathW GetLastError CloseHandle FindFirstFileW GetVersionExW GetFileAttributesW GetModuleFileNameW RemoveDirectoryW GetProcAddress SetFilePointer SystemTimeToFileTime WideCharToMultiByte ReadFile MultiByteToWideChar GetCurrentDirectoryW LocalFileTimeToFileTime SetEndOfFile CreateFileW LoadLibraryW FindNextFileW GetModuleHandleW InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetCPInfo ExitProcess GetSystemTimeAsFileTime HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind LCMapStringW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType HeapCreate GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetStdHandle WriteConsoleW CreateFileA GetProcessHeap

user32

wsprintfW

advapi32

RegOpenKeyExW RegQueryValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee

PE Signature issue

kernel32

user32

advapi32

generic