2026-07-20_9aa86592df324f6aee5b5f7fa70c231a_elex_floxif_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_9aa86592df324f6aee5b5f7fa70c231a_elex_floxif_rhadamanthys_stop
Size 203KB
Sample260720-rnva2scy3m
SHA256 f6771635e72820e57e3157d61934e10c0a8bce7e4c161beb2a4073c5443d367e
MD5 9aa86592df324f6aee5b5f7fa70c231a
SHA1 eba4d93ded153e24e48d7bb38cb9fd3d8c9d5cb4
SHA512 36bd95134fe543531b9b9796c7b8840aec6d64e515965e30a134d741f0847e63d24a254e74cd0caa509c190198ac740e2bf09e6e0135ff7ebcd7f436d9c00013
SSDEEP 3072:bjaebCdoJcBkmUWBMjM5ZXjn2lQBV+UdE+rECWp7hKup:vRbbcBaWBLzLBV+UdvrEFp7hKup
TLSH
T15314C00135C2C7FBD591003170599B845BFAEA3F1BAB50DBF376018A5EAC6C2077A6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_9aa86592df324f6aee5b5f7fa70c231a_elex_floxif_rhadamanthys_stop

File Explorer

2026-07-20_9aa86592df324f6aee5b5f7fa70c231a_elex_floxif_rhadamanthys_stop

.exe 203KB

2026-07-20_9aa86592df324f6aee5b5f7fa70c231a_elex_floxif_rhadamanthys_stop

IMPHASH e6ceb87f2354634ca87834f547084a94
SHA256 f6771635e72820e57e3157d61934e10c0a8bce7e4c161beb2a4073c5443d367e
MD5 9aa86592df324f6aee5b5f7fa70c231a
SHA1 eba4d93ded153e24e48d7bb38cb9fd3d8c9d5cb4
SHA512 36bd95134fe543531b9b9796c7b8840aec6d64e515965e30a134d741f0847e63d24a254e74cd0caa509c190198ac740e2bf09e6e0135ff7ebcd7f436d9c00013
SSDEEP 3072:bjaebCdoJcBkmUWBMjM5ZXjn2lQBV+UdE+rECWp7hKup:vRbbcBaWBLzLBV+UdvrEFp7hKup
TLSH
T15314C00135C2C7FBD591003170599B845BFAEA3F1BAB50DBF376018A5EAC6C2077A6A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ea:94:50:11:9d:6a:40:20:e7:b7:55:79:bd:c5:d7:fc:1f:98:12:e4

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Chains

Nov 3, 2010

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Serial Number

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 21, 2010 - Jun 11, 2013

Minor OS version

Major OS version

Entry point

34993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\HD_Audio\temp\HDMI_Service\Source\win32\release\RtkAudioService.pdb

setupapi

CM_Get_Parent SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW CM_Get_Res_Des_Data_Size CM_Get_Res_Des_Data SetupDiEnumDeviceInterfaces CM_Get_Device_IDW CM_Get_Next_Res_Des CM_Get_DevNode_Status SetupDiGetDeviceRegistryPropertyW CM_Get_First_Log_Conf CM_Free_Res_Des_Handle SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW

winmm

timeBeginPeriod timeEndPeriod

kernel32

FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LoadLibraryA DeviceIoControl SizeofResource GetLastError CreateFileW FindResourceExW FindResourceW CloseHandle LoadResource LockResource InterlockedDecrement RaiseException CreateEventW WaitForSingleObject SetEvent CreateThread WaitForMultipleObjects InitializeCriticalSection DeleteCriticalSection CreateWaitableTimerW LeaveCriticalSection Sleep LocalAlloc SetWaitableTimer EnterCriticalSection LocalFree lstrlenA GetCurrentProcessId GetSystemTimeAsFileTime GetExitCodeThread GetProcessHeap GetLocaleInfoA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP SetFilePointer GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetCommandLineA GetEnvironmentStringsW GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize FreeEnvironmentStringsW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage GetModuleHandleA GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId MultiByteToWideChar LCMapStringA WideCharToMultiByte LCMapStringW HeapCreate VirtualFree VirtualAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsA GetEnvironmentStrings RtlUnwind

user32

UnregisterDeviceNotification RegisterDeviceNotificationW UnregisterClassA

advapi32

RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegOpenKeyExW RegCloseKey RegQueryValueExW SetServiceStatus

ole32

CoCreateInstance CoInitializeSecurity CoSetProxyBlanket CoUninitialize StringFromGUID2 CoInitializeEx CoInitialize

oleaut32

SysFreeString SafeArrayAccessData VariantInit SafeArrayUnaccessData VariantClear SysAllocString VariantChangeType

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_9aa86592df324f6aee5b5f7fa70c231a_elex_floxif_rhadamanthys_stop

PE Signature issue

setupapi

winmm

kernel32

user32

advapi32

ole32

oleaut32

generic