2026-06-28_1c922f1ecdbaa7042ecf30281cd63914_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_1c922f1ecdbaa7042ecf30281cd63914_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 200KB
Sample260629-acdeqagz8x
SHA256 4296abd4da41cf7216e5e658fc3404007bab14eccfed18485a0e6f2f50f59313
MD5 1c922f1ecdbaa7042ecf30281cd63914
SHA1 6385e42e8a8b859d4dda26bc35a53dfa4c42b06a
SHA512 97af583f670fae767294a06eb81e1cfb06cd778ff069865e0baf808462915325240f0438b68f7d1dafdb389ce4f3b21522da8c7cc1a13bea14a375ae62a3f946
SSDEEP 6144:JdOjg0FLq5Mcw8aZkGMBV+UdvrEFp7hKtc8:JdOjgou5MiaWGMBjvrEH7et
TLSH
T1FD14BF113280C3FAD4921430756CABA55AF9E83D07AE80C7F3A506699F6CBC3567935F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-28_1c922f1ecdbaa7042ecf30281cd63914_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-06-28_1c922f1ecdbaa7042ecf30281cd63914_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 200KB

2026-06-28_1c922f1ecdbaa7042ecf30281cd63914_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 2817bb13896acd253922c0b39f2c6765
SHA256 4296abd4da41cf7216e5e658fc3404007bab14eccfed18485a0e6f2f50f59313
MD5 1c922f1ecdbaa7042ecf30281cd63914
SHA1 6385e42e8a8b859d4dda26bc35a53dfa4c42b06a
SHA512 97af583f670fae767294a06eb81e1cfb06cd778ff069865e0baf808462915325240f0438b68f7d1dafdb389ce4f3b21522da8c7cc1a13bea14a375ae62a3f946
SSDEEP 6144:JdOjg0FLq5Mcw8aZkGMBV+UdvrEFp7hKtc8:JdOjgou5MiaWGMBjvrEH7et
TLSH
T1FD14BF113280C3FAD4921430756CABA55AF9E83D07AE80C7F3A506699F6CBC3567935F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8b:bd:a6:69:46:32:9f:2a:5c:92:ad:15:27:02:8d:2f:69:74:52:a4:16:1b:03:28:ee:54:6e:32:df:2a:52:07

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Sophos BV,O=Sophos BV,L=Hengelo,C=NL

Chains

Feb 5, 2026

CN=Sophos BV,O=Sophos BV,L=Hengelo,C=NL

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Sophos BV,O=Sophos BV,L=Hengelo,C=NL

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Sophos BV,O=Sophos BV,L=Hengelo,C=NL

Serial Number

0e:86:0f:95:e6:ec:c9:51:97:4d:df:41:a1:d8:93:25

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 31, 2025 - Apr 16, 2027

Minor OS version

Major OS version

Entry point

20798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\SurfRight\Producten\HitmanPro35\bin\x86\Release MT\Scheduler.pdb

shlwapi

PathCombineW

kernel32

WTSGetActiveConsoleSessionId SetEvent WaitForMultipleObjects SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP GetModuleFileNameW GetCurrentProcess GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetTimeZoneInformation WriteConsoleA GetVersionExW LocalFree CreateEventW LocalAlloc GetModuleHandleW OpenMutexW GetLongPathNameW OpenProcess Sleep CreateWaitableTimerW CreateMutexW GetCurrentProcessId ProcessIdToSessionId SetWaitableTimer CreateProcessW OpenEventW GetLocalTime FileTimeToSystemTime CompareFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetLastError LeaveCriticalSection CloseHandle WriteFile SetFilePointer CreateFileW EnterCriticalSection GetModuleHandleA InitializeCriticalSection RaiseException SetStdHandle LoadLibraryA RtlUnwind InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP WideCharToMultiByte GetTickCount HeapAlloc HeapFree GetSystemTimeAsFileTime GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetProcAddress ExitProcess GetStdHandle GetModuleFileNameA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter

user32

MessageBoxA SetTimer PeekMessageW CreateWindowExW RegisterClassExW LoadIconW DefWindowProcW KillTimer PostQuitMessage GetWindowThreadProcessId GetWindowLongW GetSystemMetrics GetWindowRect GetWindowTextA GetDesktopWindow GetTopWindow GetForegroundWindow MsgWaitForMultipleObjectsEx DispatchMessageW TranslateMessage IsDialogMessageW

gdi32

GetStockObject

advapi32

ControlService StartServiceW DeleteService OpenServiceW CloseServiceHandle ChangeServiceConfig2W CreateServiceW OpenSCManagerW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus RevertToSelf ImpersonateLoggedOnUser GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW SetTokenInformation DuplicateTokenEx OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW RegOpenKeyW CreateProcessAsUserW FreeSid CheckTokenMembership AllocateAndInitializeSid RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

CommandLineToArgvW SHGetFolderPathW

wtsapi32

WTSQueryUserToken

psapi

GetModuleFileNameExW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_1c922f1ecdbaa7042ecf30281cd63914_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

shlwapi

kernel32

user32

gdi32

advapi32

shell32

wtsapi32

psapi

userenv

generic