2026-08-01_0e1d70ea4f93ab2a0cee921af46be05a_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_0e1d70ea4f93ab2a0cee921af46be05a_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 943KB
Sample260802-ezxt4ach99
SHA256 2630b7644aaabd4bdd3b186c147ff38a41fa7d3851b1db1fb1911528720ea6d4
MD5 0e1d70ea4f93ab2a0cee921af46be05a
SHA1 35e6543a81ec3c7bb0a4452b44ac1147abe51ffb
SHA512 3251b3b9a97295555c4fc690c2c766596e4833ea4746aeaa97b07721c5661c447ffd01e30ba2ba9617e59181587807c93c1e8d1beaa2c2c8c3fc9f54afec30c7
SSDEEP 24576:HOo5yT/tMbHWc81C9TqOUk12+lm/HIpUqpT1kVlFo1U6rEH7R:HOowTKbHflcBInpZkDG4
TLSH
T12825BF41E7C2D2F1D54210BE11A7A73A1D32BA290315D5C7F2982E559F312F2BA3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-01_0e1d70ea4f93ab2a0cee921af46be05a_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-01_0e1d70ea4f93ab2a0cee921af46be05a_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 943KB

2026-08-01_0e1d70ea4f93ab2a0cee921af46be05a_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH fcba64ab59805c9dd7c85bcc7682c93b
SHA256 2630b7644aaabd4bdd3b186c147ff38a41fa7d3851b1db1fb1911528720ea6d4
MD5 0e1d70ea4f93ab2a0cee921af46be05a
SHA1 35e6543a81ec3c7bb0a4452b44ac1147abe51ffb
SHA512 3251b3b9a97295555c4fc690c2c766596e4833ea4746aeaa97b07721c5661c447ffd01e30ba2ba9617e59181587807c93c1e8d1beaa2c2c8c3fc9f54afec30c7
SSDEEP 24576:HOo5yT/tMbHWc81C9TqOUk12+lm/HIpUqpT1kVlFo1U6rEH7R:HOowTKbHflcBInpZkDG4
TLSH
T12825BF41E7C2D2F1D54210BE11A7A73A1D32BA290315D5C7F2982E559F312F2BA3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

68:df:38:53:ff:dc:d8:b8:d4:ca:b7:13:e9:9c:d6:42:52:27:c1:5a:0b:51:df:be:75:d6:16:33:88:03:b7:1f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91110108680456115E,CN=Glarysoft Ltd,O=Glarysoft Ltd,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 17, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

13:19:af:71:64:76:ba:89:e7:0d:5e:d6:40:42:96:e7:d9:8f:b9:04

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Jul 17, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

05:00:ec:1f:15:cf:66:07:33:22:2f:e6:80:c4:90:cb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 22, 2025 - Jul 21, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

606134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\gu6\Build\GUBootService\Release\GUBootService.pdb

kernel32

SetEvent GetVersionExW GetCommandLineW GetWindowsDirectoryW OutputDebugStringW DeviceIoControl CreateFileW WriteFile SetFilePointer SetEndOfFile GetFileSize FileTimeToSystemTime FileTimeToLocalFileTime WideCharToMultiByte QueryDosDeviceW lstrlenA LoadLibraryW GetEnvironmentVariableA SystemTimeToFileTime FindClose FindFirstFileW GetStdHandle FlushViewOfFile InterlockedCompareExchange GetProcessHeap OutputDebugStringA WaitForSingleObjectEx UnmapViewOfFile UnlockFileEx UnlockFile ReadFile QueryPerformanceCounter MapViewOfFile LockFileEx LockFile LoadLibraryA HeapCompact HeapValidate HeapSize HeapReAlloc HeapFree LocalFree HeapCreate HeapAlloc GetVersionExA GetTempPathW GetTempPathA GetSystemTimeAsFileTime GetSystemInfo GetFullPathNameW GetFullPathNameA GetFileAttributesExW GetFileAttributesW GetFileAttributesA GetDiskFreeSpaceW GetDiskFreeSpaceA GetCurrentProcessId FormatMessageW FormatMessageA FlushFileBuffers DeleteFileA CreateMutexW CreateFileMappingW CreateFileMappingA CreateFileA AreFileApisANSI TryEnterCriticalSection SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetLocaleInfoA GetCurrentDirectoryA InitializeCriticalSectionAndSpinCount DeleteFileW lstrcpyW GetPrivateProfileStringW lstrcmpW WritePrivateProfileStringW ExpandEnvironmentStringsW WTSGetActiveConsoleSessionId GetSystemTime CreateEventW CreateThread WaitForSingleObject lstrlenW GetCurrentThreadId Sleep GetCurrentProcess CloseHandle GetVersion FindResourceExW LockResource LeaveCriticalSection EnterCriticalSection GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary InterlockedDecrement InterlockedIncrement lstrcmpiW GetModuleHandleW GetProcAddress GetTickCount ProcessIdToSessionId GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException HeapDestroy SetStdHandle GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP GetACP GetTimeZoneInformation GetModuleHandleA VirtualAlloc VirtualFree SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetCPInfo LCMapStringW LCMapStringA GetDriveTypeA FindNextFileA FindFirstFileA ExitProcess ExitThread RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW

user32

TranslateMessage DispatchMessageW GetMessageW MessageBoxW CharNextW LoadStringW CharUpperW PostThreadMessageW

advapi32

OpenProcessToken StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW LookupAccountNameW ConvertSidToStringSidW RegEnumKeyW DuplicateTokenEx ImpersonateLoggedOnUser CreateProcessAsUserW RevertToSelf ChangeServiceConfigW ChangeServiceConfig2W OpenEventLogW GetOldestEventLogRecord GetNumberOfEventLogRecords ReadEventLogW CloseEventLog RegOpenKeyW ControlService DeleteService CreateServiceW SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource OpenSCManagerW OpenServiceW CloseServiceHandle LookupPrivilegeValueW AdjustTokenPrivileges RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoRevokeClassObject CoCreateInstance CoRegisterClassObject CoInitializeSecurity CoInitialize CoUninitialize StringFromGUID2

shell32

SHGetFolderPathW ord165

oleaut32

SysFreeString VarUI4FromStr SysStringLen LoadRegTypeLi LoadTypeLi VariantTimeToSystemTime SystemTimeToVariantTime VariantInit VariantClear SysAllocString UnRegisterTypeLi RegisterTypeLi SysAllocStringLen

shlwapi

PathMatchSpecW PathFileExistsW SHRegGetPathW

userenv

CreateEnvironmentBlock UnloadUserProfile GetUserProfileDirectoryW LoadUserProfileW DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSFreeMemory

pdh

PdhCollectQueryData PdhAddCounterW PdhEnumObjectItemsW PdhOpenQueryW PdhCloseQuery PdhRemoveCounter PdhGetFormattedCounterValue

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_0e1d70ea4f93ab2a0cee921af46be05a_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

userenv

wtsapi32

pdh

generic