2026-07-13_3d9b85fb6f2af711148dfdfd1e8687a7_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-13_3d9b85fb6f2af711148dfdfd1e8687a7_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 144KB
Sample260713-e4b37ady7s
SHA256 bf6803a10e201d39a5cdf5ea59cda928fde350d2ee34c9807ce91ae573cad774
MD5 3d9b85fb6f2af711148dfdfd1e8687a7
SHA1 ba6ec59c11a9f6a3094092a2307fcc1bb8c9bd38
SHA512 fe7bd53ca61d7c79e3cb3a09725c82f8576fbcd11635173e965777d58af955535af5307f205c5f46d42da578bebd31b8b78f99ce9a2eba9f2036bf971b627abe
SSDEEP 3072:TRtJ/JncnpVjxM4HFiCLm3CVvpNz+F/8ZaYjHiqd5Jij:TbJ/dcni0A0hNCF/OXrHdfk
TLSH
T16CE38D2132D6C072DAA615344AB4CBB64E3AFC320B7555CB6BD8497A0FA47D18B3835B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-13_3d9b85fb6f2af711148dfdfd1e8687a7_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-13_3d9b85fb6f2af711148dfdfd1e8687a7_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 144KB

2026-07-13_3d9b85fb6f2af711148dfdfd1e8687a7_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH de770e33702ce61245cbc840019c3016
SHA256 bf6803a10e201d39a5cdf5ea59cda928fde350d2ee34c9807ce91ae573cad774
MD5 3d9b85fb6f2af711148dfdfd1e8687a7
SHA1 ba6ec59c11a9f6a3094092a2307fcc1bb8c9bd38
SHA512 fe7bd53ca61d7c79e3cb3a09725c82f8576fbcd11635173e965777d58af955535af5307f205c5f46d42da578bebd31b8b78f99ce9a2eba9f2036bf971b627abe
SSDEEP 3072:TRtJ/JncnpVjxM4HFiCLm3CVvpNz+F/8ZaYjHiqd5Jij:TbJ/dcni0A0hNCF/OXrHdfk
TLSH
T16CE38D2132D6C072DAA615344AB4CBB64E3AFC320B7555CB6BD8497A0FA47D18B3835B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

85:08:b4:8b:f8:99:06:98:8b:a6:01:20:23:75:e9:0b:0f:90:64:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Safe Download Limited,O=Safe Download Limited,L=Douglas,ST=Douglas,C=IM

Chains

Nov 4, 2013

CN=Safe Download Limited,O=Safe Download Limited,L=Douglas,ST=Douglas,C=IM

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

07:27:58:3d

Issuer

CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 13, 2010 - Sep 30, 2015

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Safe Download Limited,O=Safe Download Limited,L=Douglas,ST=Douglas,C=IM

Serial Number

0d:d2:fc:97:b3:c6:59:7c:ab:d9:7b:29:d9:38:34:40

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 2, 2012 - Aug 26, 2014

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

Major OS version

Entry point

36081

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Projects\PCSU-SL\PCSpeedUp\Release\PCSUQuickScan.pdb

kernel32

Process32NextW CreateToolhelp32Snapshot CloseHandle Process32FirstW FreeLibrary LoadLibraryW GetProcAddress GetModuleHandleW GetCurrentProcessId GetCurrentProcess WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetCommandLineW HeapSetInformation GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId IsProcessorFeaturePresent HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleW FlushFileBuffers CreateFileW

advapi32

RegCloseKey RegOpenKeyExW RegSetValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-13_3d9b85fb6f2af711148dfdfd1e8687a7_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee

PE Signature issue

kernel32

advapi32

generic