2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop
Size 1.2MB
Sample260712-wty9eahs2s
SHA256 c2f7a804dc562e53bc5fde1639542b1f2f2795cfc56fb8b2eeeb24e08eee7d42
MD5 015cabde72edbc75435ae508d050633d
SHA1 5671bf9beb6c36f04049a004904fa1bdc7c38c63
SHA512 e015afb040fcdb298bcdd9357de25bced8e0323a73f13e7fe9a2035e8b7af578ffedba112a40f9d941e564f0b554a876d0fc770df2f98328c6198b4a708a46c9
SSDEEP 24576:tEfCvka3NXbi3Xi6kgaINVRX/diX2n0e435qkLeI+t2r48WabGOjbvD/+XbdeXc0:CfCL923XiTcNjPdiGnT65qkYt2r48Wa7
TLSH
T19D45F1113DEFCC76E39300318A36F6A665A4F1AA3B1304D793D4077AEE397C4462B699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop

.exe 1.2MB

2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop

IMPHASH d633baf6baf7034355e511b95e9771cd
SHA256 c2f7a804dc562e53bc5fde1639542b1f2f2795cfc56fb8b2eeeb24e08eee7d42
MD5 015cabde72edbc75435ae508d050633d
SHA1 5671bf9beb6c36f04049a004904fa1bdc7c38c63
SHA512 e015afb040fcdb298bcdd9357de25bced8e0323a73f13e7fe9a2035e8b7af578ffedba112a40f9d941e564f0b554a876d0fc770df2f98328c6198b4a708a46c9
SSDEEP 24576:tEfCvka3NXbi3Xi6kgaINVRX/diX2n0e435qkLeI+t2r48WabGOjbvD/+XbdeXc0:CfCL923XiTcNjPdiGnT65qkYt2r48Wa7
TLSH
T19D45F1113DEFCC76E39300318A36F6A665A4F1AA3B1304D793D4077AEE397C4462B699
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

39:09:26:ce:12:0b:54:ec:78:3a:31:2a:53:49:ba:34:5a:0e:2a:a8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Twenty Nine Tech Software LLC,O=Twenty Nine Tech Software LLC,L=Beaverton,ST=Oregon,C=US

Chains

Sep 18, 2014

CN=Twenty Nine Tech Software LLC,O=Twenty Nine Tech Software LLC,L=Beaverton,ST=Oregon,C=US

Subject

CN=Twenty Nine Tech Software LLC,O=Twenty Nine Tech Software LLC,L=Beaverton,ST=Oregon,C=US

Serial Number

04:1e:a6:a5:82:98:67

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 18, 2013 - Dec 18, 2016

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

03:01

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 16, 2006 - Nov 16, 2026

Subject

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Serial Number

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Timespan

Jun 29, 2004 - Jun 29, 2034

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

Major OS version

Entry point

71155

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcessVersion GetCurrentProcessId WaitForSingleObject OpenMutexW OpenMutexA GetNativeSystemInfo GetVersion OpenEventA GetProcessHeap Sleep FlushInstructionCache GetCurrentProcess InterlockedExchange VirtualProtect RemoveDirectoryW DeleteFileW ReadFile CreateProcessW WriteFile CreateFileW CreateDirectoryW GetLastError IsProcessorFeaturePresent VirtualAlloc HeapAlloc VirtualFree HeapFree FreeLibrary GetCommandLineW WriteConsoleW SetFilePointer FlushFileBuffers GetConsoleMode GetConsoleCP InitializeCriticalSection IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetTickCount GetModuleFileNameW GetDriveTypeW CreateMutexA CloseHandle GetCurrentThreadId GetModuleFileNameA FindResourceExW GetProcAddress FindResourceW LoadResource LockResource SizeofResource GetModuleHandleW GetTempPathW MultiByteToWideChar WideCharToMultiByte RtlUnwind EncodePointer DecodePointer RaiseException HeapReAlloc HeapSetInformation GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW HeapCreate HeapDestroy GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryW GetLocaleInfoW SetStdHandle

user32

MessageBoxW GetFocus GetSysColor GetSystemMetrics GetForegroundWindow GetDC ReleaseDC GetDesktopWindow GetSysColorBrush

gdi32

CreateCompatibleDC CreateRectRgn CreateEllipticRgn CreateRoundRectRgn CombineRgn CreateCompatibleBitmap SelectObject GetStockObject CreatePen Rectangle Ellipse DeleteObject DeleteDC

shlwapi

PathStripToRootW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

gdi32

shlwapi

generic