2026-07-22_49868f36dace07ff225eecead47824ad_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_49868f36dace07ff225eecead47824ad_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 168KB
Sample260723-ca2ewazalc
SHA256 0b4aaba70d79cd6d93f21d8b7e346c8f69206c805838f4d7eb0e819d9c4212a3
MD5 49868f36dace07ff225eecead47824ad
SHA1 63fd8ecc64e64ff7f1e78ae918cf626da99da925
SHA512 bd5686d13efaf7340a4387628421004116ac7ec0cf6c664a44afbadb9a8a8efdf4150d09c4eced31c858508d87a0c68b8c332e508e36570df24b09d85f96949b
SSDEEP 3072:78wmUtpCoUOyAtfLkAkcl5tlxs+m+9ojYH4vq5KIFuobl:78wzpCooaLkAkcTm1+9ojvvlI3x
TLSH
T130F37D2031A0C037E897047585E9CBB5AE79FEB2171454D7B7D80B699F247F2AB3428B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-07-22_49868f36dace07ff225eecead47824ad_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-22_49868f36dace07ff225eecead47824ad_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 168KB

2026-07-22_49868f36dace07ff225eecead47824ad_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 2d3b7fa483636fb702436d2f287b45de
SHA256 0b4aaba70d79cd6d93f21d8b7e346c8f69206c805838f4d7eb0e819d9c4212a3
MD5 49868f36dace07ff225eecead47824ad
SHA1 63fd8ecc64e64ff7f1e78ae918cf626da99da925
SHA512 bd5686d13efaf7340a4387628421004116ac7ec0cf6c664a44afbadb9a8a8efdf4150d09c4eced31c858508d87a0c68b8c332e508e36570df24b09d85f96949b
SSDEEP 3072:78wmUtpCoUOyAtfLkAkcl5tlxs+m+9ojYH4vq5KIFuobl:78wzpCooaLkAkcTm1+9ojvvlI3x
TLSH
T130F37D2031A0C037E897047585E9CBB5AE79FEB2171454D7B7D80B699F247F2AB3428B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

a6:da:e0:3e:30:59:2e:84:ce:b4:c5:5d:dc:63:26:48:1e:a8:de:64

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Tendyron Corporation,O=Tendyron Corporation,ST=Beijing,C=CN

Chains

Nov 12, 2024

CN=Tendyron Corporation,O=Tendyron Corporation,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Tendyron Corporation,O=Tendyron Corporation,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=Tendyron Corporation,O=Tendyron Corporation,ST=Beijing,C=CN

Serial Number

01:8e:94:d0:80:24:64:a5:9b:2b:0d:e6:96:53:33:a1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 5, 2024 - Aug 28, 2025

Minor OS version

Major OS version

Entry point

50869

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\SVN\tdr\software\project\农业银行\branches\农行_交易中心\install\DB\Bin\Release\DBSvr_ABC.pdb

psapi

GetModuleFileNameExA

kernel32

VirtualProtect SetUnhandledExceptionFilter LocalAlloc GetModuleFileNameA GetModuleHandleExA ProcessIdToSessionId CreateMutexA ReleaseMutex LocalFree EnterCriticalSection LeaveCriticalSection GlobalAlloc GetOverlappedResult WaitForSingleObjectEx CreateEventA ReadFileEx WriteFileEx GlobalFree DisconnectNamedPipe CreateNamedPipeA SetEvent ConnectNamedPipe InterlockedCompareExchange InterlockedExchange InitializeCriticalSection DeleteCriticalSection GetACP GetCPInfo GetFileType GetStdHandle SetEnvironmentVariableA CompareStringW CompareStringA ReadFile GetProcessHeap SetEndOfFile CreateThread WriteConsoleW GetConsoleOutputCP WriteProcessMemory SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA IsValidCodePage SetStdHandle InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime GetTickCount GetModuleHandleA GetCurrentProcess GetSystemDefaultLangID GetPrivateProfileStringA lstrcpyA lstrcatA CreateProcessA GetCurrentThreadId GetCurrentProcessId FreeLibrary LoadLibraryA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapReAlloc SetHandleCount VirtualAlloc ExitProcess HeapSize InterlockedIncrement TlsFree CreateFileA GetVersionExA lstrlenA InterlockedDecrement OpenProcess TerminateProcess Sleep WaitForSingleObject WriteConsoleA CloseHandle VirtualFree HeapCreate GetConsoleMode GetProcAddress lstrlenW lstrcpyW MultiByteToWideChar lstrcmpW SetLastError GetLastError FileTimeToLocalFileTime GetLocalTime SystemTimeToFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetOEMCP FlushFileBuffers GetConsoleCP WriteFile RaiseException RtlUnwind ExitThread HeapFree HeapAlloc GetCommandLineA GetStartupInfoA UnhandledExceptionFilter IsDebuggerPresent WideCharToMultiByte GetTimeZoneInformation GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue

user32

SendMessageA CharLowerA KillTimer FindWindowA PostMessageA PostQuitMessage LoadIconA DestroyIcon GetSystemMetrics UnregisterDeviceNotification RegisterDeviceNotificationA BeginPaint EndPaint DestroyWindow GetWindowThreadProcessId DefWindowProcA RegisterClassExA CreateWindowExA ShowWindow UpdateWindow GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA GetActiveWindow MessageBoxA wsprintfA EnumWindows GetParent SetTimer

advapi32

RegCreateKeyExA RegCloseKey RegQueryValueExA RegSetValueExA SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyExA

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA

ole32

CoUninitialize OleRun CoCreateInstance CoInitialize

oleaut32

SysStringByteLen SysAllocStringByteLen SysFreeString VariantClear GetErrorInfo

dbtoken_abc

OnKeyT_SetDefLanguage OnKeyT_GetDeviceInfo OnKeyT_ManTokenParam OnKeyT_WaitForSlotEvent OnKeyT_AppendEventInfo OnKeyT_ContextFinal OnKeyT_ContextInit OnKeyT_GetSlotList OnKeyT_Name2SlotID

shlwapi

StrStrIW StrStrIA PathFileExistsA wvnsprintfA

crypt32

CertGetNameStringA CertGetNameStringW CertCreateCertificateContext CertCloseStore CertAddCertificateContextToStore CertOpenStore CertSetCertificateContextProperty CertCompareCertificateName CertDeleteCertificateFromStore CertDuplicateCertificateContext CertGetCertificateContextProperty CertEnumCertificatesInStore CertFreeCertificateContext CertOpenSystemStoreA

dbghelp

MiniDumpWriteDump

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_49868f36dace07ff225eecead47824ad_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee

psapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

dbtoken_abc

shlwapi

crypt32

dbghelp

generic