2026-07-15_9e9496aa074ede9fe904ae905b5f7f11_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

General

Target
2026-07-15_9e9496aa074ede9fe904ae905b5f7f11_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 5.7MB
Sample260715-e5mlbabw9q
SHA256 582d56ba117a751f3b8060058b9bd9cb047f0416192dd07fd72b2a51ba2bad5f
MD5 9e9496aa074ede9fe904ae905b5f7f11
SHA1 3460c863dbc886ae1e20249da5eb8097af099b2c
SHA512 eceeb504b3a36718f0bd61f6575ec73d466992dd9ae7919bd3e309753fdfe40c1ae711d5b19a4b82d805fbd551e6b8ac703d01a61f5a769a52c56c39ae40b6ce
SSDEEP 98304:fzg7Hc3SezlkbFDVrQMyOr3Sqd6cLhHm1LE/Hl9uapOjLMek0pK7DjePIV0qVLk:fzg7Hc3S8eVUKS06c1Hm1LSF9LwjLMe5
TLSH
T1AA5633232246D3B9D451057014568BB34E7A7D3D9372C0EBBBD37A6E8DB82F1873624A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-15_9e9496aa074ede9fe904ae905b5f7f11_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-15_9e9496aa074ede9fe904ae905b5f7f11_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 5.7MB

2026-07-15_9e9496aa074ede9fe904ae905b5f7f11_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 1ff847646487d56f85778df99ff3728a
SHA256 582d56ba117a751f3b8060058b9bd9cb047f0416192dd07fd72b2a51ba2bad5f
MD5 9e9496aa074ede9fe904ae905b5f7f11
SHA1 3460c863dbc886ae1e20249da5eb8097af099b2c
SHA512 eceeb504b3a36718f0bd61f6575ec73d466992dd9ae7919bd3e309753fdfe40c1ae711d5b19a4b82d805fbd551e6b8ac703d01a61f5a769a52c56c39ae40b6ce
SSDEEP 98304:fzg7Hc3SezlkbFDVrQMyOr3Sqd6cLhHm1LE/Hl9uapOjLMek0pK7DjePIV0qVLk:fzg7Hc3S8eVUKS06c1Hm1LSF9LwjLMe5
TLSH
T1AA5633232246D3B9D451057014568BB34E7A7D3D9372C0EBBBD37A6E8DB82F1873624A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

14:5a:61:cb:e6:8d:e3:4f:d2:d6:91:59:77:fc:26:74:69:a0:cb:c5

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=R2 Studios,O=R2 Studios,POSTALCODE=4068,STREET=82 Beatrice Street,L=Taringa,ST=Queensland,C=AU

Chains

Dec 18, 2015

CN=R2 Studios,O=R2 Studios,POSTALCODE=4068,STREET=82 Beatrice Street,L=Taringa,ST=Queensland,C=AU

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 5, 2015 - Dec 31, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=R2 Studios,O=R2 Studios,POSTALCODE=4068,STREET=82 Beatrice Street,L=Taringa,ST=Queensland,C=AU

Serial Number

51:24:e5:db:eb:ee:42:23:f3:ee:9a:c4:82:da:2d:15

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 9, 2014 - Jan 8, 2017

Minor OS version

1

Major OS version

5

Entry point

10721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

_lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA lstrcatA FreeLibrary GetProcAddress LoadLibraryA GetDiskFreeSpaceA GetFileAttributesA RemoveDirectoryA DeleteFileA lstrlenA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA Sleep GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize lstrcpyA GetTempPathA CompareStringA IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_9e9496aa074ede9fe904ae905b5f7f11_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

shell32

generic