2026-07-27_2e353eb563346126fc85e6f2df8b2326_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_2e353eb563346126fc85e6f2df8b2326_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 276KB
Sample260728-ap998aeb65
SHA256 0c9c93cf377cd1675006c37c54fc481467fbcfe8fa98b1636e10b9825eab8f95
MD5 2e353eb563346126fc85e6f2df8b2326
SHA1 8f0839d2e4dba6cfc3970aa5cdaa473c647e3a9b
SHA512 737162d6cb8f532b192b53fc8b67c4bb35796362849550c47553c4b8f12f4a3f21ee159d6ffebf5ecc5b8a92e7e532322538c38dd9b33a3e1145aebefed5eb7c
SSDEEP 6144:pMIKnXNNuA9YWl2H9D/72kUBV+UdvrEFp7hKEfzi:pMIGXSA9YWMdDKBjvrEH7lLi
TLSH
T16954AE203580C3FAE4A70431B5ED8675A9F5B93D076A50CBB7D00B995F6DAE3AB31306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-27_2e353eb563346126fc85e6f2df8b2326_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-27_2e353eb563346126fc85e6f2df8b2326_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 276KB

2026-07-27_2e353eb563346126fc85e6f2df8b2326_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH a8af2d03ac68a2ab121939e3884c01cb
SHA256 0c9c93cf377cd1675006c37c54fc481467fbcfe8fa98b1636e10b9825eab8f95
MD5 2e353eb563346126fc85e6f2df8b2326
SHA1 8f0839d2e4dba6cfc3970aa5cdaa473c647e3a9b
SHA512 737162d6cb8f532b192b53fc8b67c4bb35796362849550c47553c4b8f12f4a3f21ee159d6ffebf5ecc5b8a92e7e532322538c38dd9b33a3e1145aebefed5eb7c
SSDEEP 6144:pMIKnXNNuA9YWl2H9D/72kUBV+UdvrEFp7hKEfzi:pMIGXSA9YWMdDKBjvrEH7lLi
TLSH
T16954AE203580C3FAE4A70431B5ED8675A9F5B93D076A50CBB7D00B995F6DAE3AB31306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4b:c7:d9:05:18:e8:63:0c:00:a8:a7:13:25:da:46:bd:a0:3a:37:6e:22:c1:90:2d:10:40:38:41:e2:8b:b7:b8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=NHN BUGS Corporation,O=NHN BUGS Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Chains

Dec 10, 2018

CN=NHN BUGS Corporation,O=NHN BUGS Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

e8:f1:4e:3d:ce:af:a6:48:e2:29:07:e9:09:a9:27:3c:8a:e3:11:59

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=NHN BUGS Corporation,O=NHN BUGS Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Chains

Dec 10, 2018

CN=NHN BUGS Corporation,O=NHN BUGS Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=NHN BUGS Corporation,O=NHN BUGS Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Serial Number

5f:6f:8a:40:c9:d8:91:3c:42:e4:b9:80:20:1f:00:c1

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2017 - Aug 2, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=NHN BUGS Corporation,O=NHN BUGS Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Serial Number

4a:b7:60:83:24:ea:3d:22:40:89:66:b5:f0:64:a4:bc

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 29, 2018 - Sep 27, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

62052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\0_work\6_git\clone\sayclub.saycastwin\NeoCast\Build\Release\RadioSetup.pdb

kernel32

CloseHandle WriteFile OutputDebugStringW EnterCriticalSection LeaveCriticalSection GetModuleFileNameW InitializeCriticalSection DeleteCriticalSection LoadLibraryW FreeLibrary SetLastError FindResourceW SizeofResource LockResource LoadResource SetFilePointer MultiByteToWideChar lstrlenA WideCharToMultiByte DeleteFileW Sleep GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress WaitForSingleObject OpenProcess TerminateProcess FindFirstFileW FindNextFileW FindClose RemoveDirectoryW lstrlenW GetModuleHandleW SetEvent MulDiv LocalFree FormatMessageW CreateMutexW GetCommandLineW GetCurrentThreadId RaiseException GetCurrentProcess FlushInstructionCache FindResourceExW HeapAlloc HeapFree HeapReAlloc ReadFile FlushFileBuffers CreateFileA SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLastError CreateFileW InterlockedDecrement CreateEventW InterlockedIncrement GetModuleHandleA RtlUnwind GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize GetProcessHeap InterlockedCompareExchange LoadLibraryA IsProcessorFeaturePresent VirtualFree VirtualAlloc GetSystemTimeAsFileTime ExitThread CreateThread GetCommandLineA GetModuleFileNameA GetStdHandle ExitProcess HeapCreate GetDateFormatA GetTimeFormatA GetStartupInfoA TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo GetTimeZoneInformation IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapDestroy

user32

SetWindowLongW EndDialog IsWindow SendMessageW RegisterWindowMessageW UnregisterClassA GetWindowTextW GetWindowTextLengthW GetWindowRect ScreenToClient PostMessageW SetWindowPos MapWindowPoints GetClientRect GetParent GetMonitorInfoW MonitorFromWindow GetWindowLongW GetWindow BeginPaint GetDlgItem EndPaint SetWindowTextW InvalidateRect GetActiveWindow PostThreadMessageW DialogBoxParamW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegDeleteValueW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW CommandLineToArgvW SHCreateDirectoryExW ShellExecuteExW

ole32

CoInitializeEx CoUninitialize CoInitialize CoCreateInstance

oleaut32

LoadTypeLi LoadRegTypeLi SysStringLen VariantClear VariantInit SysAllocString SysFreeString SystemTimeToVariantTime VarUdateFromDate VariantTimeToSystemTime

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

gdiplus

GdipDrawImageRectI GdiplusShutdown GdiplusStartup GdipCreateBitmapFromStream GdipFree GdipAlloc GdipDeleteBrush GdipCreateSolidFill GdipDisposeImage GdipCreateStringFormat GdipDeleteStringFormat GdipCreateFromHDC GdipDeleteGraphics GdipDrawString GdipCloneBrush GdipCreateFontFamilyFromName GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStreamICM

psapi

EnumProcesses GetModuleFileNameExW

wininet

HttpQueryInfoW InternetOpenW InternetCloseHandle HttpOpenRequestW HttpSendRequestW InternetReadFile InternetQueryDataAvailable InternetConnectW

setupapi

SetupIterateCabinetW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_2e353eb563346126fc85e6f2df8b2326_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

version

gdiplus

psapi

wininet

setupapi

generic