2026-07-29_557d327fc9d74a40fd3a0075fdd2e599_amadey_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_557d327fc9d74a40fd3a0075fdd2e599_amadey_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 179KB
Sample260730-afcmlaha86
SHA256 dca8cbef5e6fd28829549a59c2a2b91153069e91298df8468ef94ca237760ad4
MD5 557d327fc9d74a40fd3a0075fdd2e599
SHA1 71cfba0b20dfc8812ba4be4fd24985d9711037ef
SHA512 18b1ddc58c01b7c02f69f14dbd93801cc37a50b61a19afbe8ee6c5e6458a2fe292580159882a9909eeadac1f7cf895790ad4c3d1badbfc022831e7a7dc7e0135
SSDEEP 3072:sxLdKunc7N62Mpg/8Gr7c5Lf3DplF8R6VobHwVOQ5TFnK6I/A:s5d5yl8Gr7c5L/XFpViQVOSAA
TLSH
T180046C227662D039E46324B389F957B89A7D7B31031350E3F3940A6A8F517E9BD3325B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-29_557d327fc9d74a40fd3a0075fdd2e599_amadey_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 179KB

2026-07-29_557d327fc9d74a40fd3a0075fdd2e599_amadey_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 15c8c038feb59d28057c8b22e56813ff
SHA256 dca8cbef5e6fd28829549a59c2a2b91153069e91298df8468ef94ca237760ad4
MD5 557d327fc9d74a40fd3a0075fdd2e599
SHA1 71cfba0b20dfc8812ba4be4fd24985d9711037ef
SHA512 18b1ddc58c01b7c02f69f14dbd93801cc37a50b61a19afbe8ee6c5e6458a2fe292580159882a9909eeadac1f7cf895790ad4c3d1badbfc022831e7a7dc7e0135
SSDEEP 3072:sxLdKunc7N62Mpg/8Gr7c5Lf3DplF8R6VobHwVOQ5TFnK6I/A:s5d5yl8Gr7c5L/XFpViQVOSAA
TLSH
T180046C227662D039E46324B389F957B89A7D7B31031350E3F3940A6A8F517E9BD3325B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

5b:7f:22:7a:bb:b4:41:56:25:be:51:c7:04:de:bf:95:dd:82:c2:51:3e:61:78:fb:94:5a:47:d0:93:85:03:40

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Fasoo Co.\, Ltd.,O=Fasoo Co.\, Ltd.,L=Mapo-gu,ST=Seoul,C=KR

Chains

Jul 11, 2024

CN=Fasoo Co.\, Ltd.,O=Fasoo Co.\, Ltd.,L=Mapo-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Fasoo Co.\, Ltd.,O=Fasoo Co.\, Ltd.,L=Mapo-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Fasoo Co.\, Ltd.,O=Fasoo Co.\, Ltd.,L=Mapo-gu,ST=Seoul,C=KR

Serial Number

0c:1c:6e:a2:2c:cf:05:7a:92:7e:99:6d:c4:98:29:4b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2023 - May 13, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

57847

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\SVN\LiveUpdate\base\fs_drmmgr\Release\fs_drmmgr.pdb

kernel32

GlobalAlloc GlobalFree WideCharToMultiByte SetLastError InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW IsBadWritePtr GetCurrentThreadId ExitProcess GetTickCount MultiByteToWideChar SetFilePointer ReadFile VirtualFree VirtualProtect IsBadReadPtr GetSystemInfo OpenFileMappingW WriteConsoleW VerifyVersionInfoW VerSetConditionMask WaitForSingleObject CreateEventW FreeLibrary LoadLibraryW DeviceIoControl CreateDirectoryW ProcessIdToSessionId GetCurrentProcessId FindClose FindNextFileW CreateFileW lstrcmpW FindFirstFileW GetLastError Sleep CloseHandle CreateFileA GetWindowsDirectoryA GetModuleHandleA GetProcAddress GetCommandLineW lstrlenW GetModuleFileNameW VirtualAlloc GetConsoleOutputCP WriteConsoleA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread GetStartupInfoW HeapFree HeapAlloc RaiseException RtlUnwind GetSystemTimeAsFileTime TlsGetValue TlsAlloc TlsSetValue TlsFree HeapSize WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate QueryPerformanceCounter HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers SetStdHandle

user32

wsprintfW CharNextW

advapi32

QueryServiceStatusEx RegEnumKeyExW RegQueryInfoKeyW UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle RegNotifyChangeKeyValue RegOpenKeyExW StartServiceA CreateServiceA OpenServiceA RegQueryValueExW RegCreateKeyExW StartServiceCtrlDispatcherW RegCloseKey RegSetValueExW DeleteService ControlService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_557d327fc9d74a40fd3a0075fdd2e599_amadey_elex_hijackloader_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

advapi32

shell32

generic