2026-07-15_802f4866f209d239d4d741a2c0d3b199_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

General

Target
2026-07-15_802f4866f209d239d4d741a2c0d3b199_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 5.7MB
Sample260715-fbqljsby2n
SHA256 37cb9c1d41bba5c384bb7e7c9a7d687ffba6ef68c77533929a509a9d882df91d
MD5 802f4866f209d239d4d741a2c0d3b199
SHA1 478afdd261a274f7f1a9da344ea7b08a393ac1a0
SHA512 9c4bdf8420dc758264b460343c7c8ea5fefb5d12e999d5685ea61a817093deb45672fc8bebc178b41b33d8b9a3782aa867382901b0b4f6f5e2280658814c5a4b
SSDEEP 98304:7zg7Hc3SezlkbFDVrQMyOr3Sqd6cLhHm1LE/Hl9uapOjLMek0pK7DjePIV0qVLr:7zg7Hc3S8eVUKS06c1Hm1LSF9LwjLMeW
TLSH
T1C85633232246D3B9D451057014568BB34E7A7D3D9372C0EBBBD37A6E8DB82F1873624A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-15_802f4866f209d239d4d741a2c0d3b199_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-15_802f4866f209d239d4d741a2c0d3b199_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 5.7MB

2026-07-15_802f4866f209d239d4d741a2c0d3b199_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 1ff847646487d56f85778df99ff3728a
SHA256 37cb9c1d41bba5c384bb7e7c9a7d687ffba6ef68c77533929a509a9d882df91d
MD5 802f4866f209d239d4d741a2c0d3b199
SHA1 478afdd261a274f7f1a9da344ea7b08a393ac1a0
SHA512 9c4bdf8420dc758264b460343c7c8ea5fefb5d12e999d5685ea61a817093deb45672fc8bebc178b41b33d8b9a3782aa867382901b0b4f6f5e2280658814c5a4b
SSDEEP 98304:7zg7Hc3SezlkbFDVrQMyOr3Sqd6cLhHm1LE/Hl9uapOjLMek0pK7DjePIV0qVLr:7zg7Hc3S8eVUKS06c1Hm1LSF9LwjLMeW
TLSH
T1C85633232246D3B9D451057014568BB34E7A7D3D9372C0EBBBD37A6E8DB82F1873624A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

31:12:f1:ec:19:d3:46:35:8e:17:e6:10:4a:13:7f:fb:47:01:b7:75

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=R2 Studios,O=R2 Studios,POSTALCODE=4068,STREET=82 Beatrice Street,L=Taringa,ST=Queensland,C=AU

Chains

Dec 18, 2015

CN=R2 Studios,O=R2 Studios,POSTALCODE=4068,STREET=82 Beatrice Street,L=Taringa,ST=Queensland,C=AU

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 5, 2015 - Dec 31, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=R2 Studios,O=R2 Studios,POSTALCODE=4068,STREET=82 Beatrice Street,L=Taringa,ST=Queensland,C=AU

Serial Number

51:24:e5:db:eb:ee:42:23:f3:ee:9a:c4:82:da:2d:15

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 9, 2014 - Jan 8, 2017

Minor OS version

1

Major OS version

5

Entry point

10721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

_lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA lstrcatA FreeLibrary GetProcAddress LoadLibraryA GetDiskFreeSpaceA GetFileAttributesA RemoveDirectoryA DeleteFileA lstrlenA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA Sleep GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize lstrcpyA GetTempPathA CompareStringA IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_802f4866f209d239d4d741a2c0d3b199_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

shell32

generic