2026-08-04_3275a7c0ac0bb028544ca2040dcb286c_amadey_elex_floxif_rhadamanthys_smoke-loader

General

Target
2026-08-04_3275a7c0ac0bb028544ca2040dcb286c_amadey_elex_floxif_rhadamanthys_smoke-loader
Size 164KB
Sample260804-tp87psvbjc
SHA256 96b896d937e5c00cd09c7808c090fb2cd2f5b4d412c7210eff54901e28db8f15
MD5 3275a7c0ac0bb028544ca2040dcb286c
SHA1 62f3405bc6e45bff45b37186221931e84a5b3b02
SHA512 5f896581c25970f3a1933685765fc525ac039a766a6b91e67dbec0fb99768af7f58f3700eb6113764bbac5add343b0cea8dcac44acdc3338c305c1cd58ff2b4b
SSDEEP 3072:J+wcGCTUfNKL8PHpsdy1O3dzqTl33p2lQBV+UdE+rECWp7hKPU1H+:MvTLCHpsdy1xfBV+UdvrEFp7hKL
TLSH
T142F3CF42718083FDE0850074349EAB159AF1A53C0BBF84D3F75525496FAEAC75BAA34F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_3275a7c0ac0bb028544ca2040dcb286c_amadey_elex_floxif_rhadamanthys_smoke-loader

File Explorer

2026-08-04_3275a7c0ac0bb028544ca2040dcb286c_amadey_elex_floxif_rhadamanthys_smoke-loader

.exe 164KB

2026-08-04_3275a7c0ac0bb028544ca2040dcb286c_amadey_elex_floxif_rhadamanthys_smoke-loader

IMPHASH a46d198cf1591eed8423a92a04678bbf
SHA256 96b896d937e5c00cd09c7808c090fb2cd2f5b4d412c7210eff54901e28db8f15
MD5 3275a7c0ac0bb028544ca2040dcb286c
SHA1 62f3405bc6e45bff45b37186221931e84a5b3b02
SHA512 5f896581c25970f3a1933685765fc525ac039a766a6b91e67dbec0fb99768af7f58f3700eb6113764bbac5add343b0cea8dcac44acdc3338c305c1cd58ff2b4b
SSDEEP 3072:J+wcGCTUfNKL8PHpsdy1O3dzqTl33p2lQBV+UdE+rECWp7hKPU1H+:MvTLCHpsdy1xfBV+UdvrEFp7hKL
TLSH
T142F3CF42718083FDE0850074349EAB159AF1A53C0BBF84D3F75525496FAEAC75BAA34F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d0:df:22:43:f4:8b:00:ca:0f:5b:c5:1a:d7:19:f3:09:8d:81:61:6b:9f:29:a1:fb:6c:9d:ca:15:75:0f:f0:df

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Chaos Software Ltd.,O=Chaos Software Ltd.,L=Sofia,ST=Sofia,C=BG

Chains

Jul 31, 2026

CN=Chaos Software Ltd.,O=Chaos Software Ltd.,L=Sofia,ST=Sofia,C=BG

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

CN=Chaos Software Ltd.,O=Chaos Software Ltd.,L=Sofia,ST=Sofia,C=BG

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Minor OS version

0

Major OS version

4

Entry point

30111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess SetWaitableTimer CreateWaitableTimerA WaitForMultipleObjects CreateEventA TerminateProcess CompareStringA ReadFile SetEndOfFile HeapSize GetExitCodeProcess WaitForSingleObject ExitProcess GetCurrentProcessId GetPrivateProfileIntA CreateProcessA GetComputerNameA SetConsoleCtrlHandler FreeLibrary Sleep lstrlenA GetLastError lstrlenW GetEnvironmentVariableA LoadLibraryA GetProcAddress FormatMessageA LocalFree GetPrivateProfileStringA GetModuleFileNameA CreateFileA CloseHandle GetFileAttributesA InitializeCriticalSection EnterCriticalSection SetEvent LeaveCriticalSection HeapAlloc HeapFree FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA GetSystemTimeAsFileTime GetTimeZoneInformation HeapReAlloc GetModuleHandleA GetCurrentProcess SetEnvironmentVariableA GetCurrentDirectoryA SetCurrentDirectoryA GetCommandLineA GetVersionExA DeleteCriticalSection HeapDestroy HeapCreate VirtualFree VirtualAlloc TlsAlloc SetLastError GetCurrentThreadId TlsFree TlsSetValue TlsGetValue WideCharToMultiByte WriteFile FlushFileBuffers SetHandleCount GetStdHandle GetFileType GetStartupInfoA VirtualProtect GetSystemInfo VirtualQuery LCMapStringA MultiByteToWideChar LCMapStringW UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW RtlUnwind InterlockedExchange QueryPerformanceCounter GetTickCount GetStringTypeA GetStringTypeW GetCPInfo GetLocaleInfoA GetACP GetOEMCP SetFilePointer SetStdHandle CompareStringW

user32

CharToOemA EnumDesktopWindows GetWindowThreadProcessId PostMessageA

advapi32

RegDeleteKeyA RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegSetValueExA RegCloseKey StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA OpenServiceA ControlService DeleteService OpenSCManagerA CreateServiceA StartServiceA QueryServiceStatus CloseServiceHandle SetServiceStatus LookupAccountNameA LsaOpenPolicy LsaNtStatusToWinError LsaAddAccountRights LsaClose RegisterEventSourceA ReportEventA DeregisterEventSource RegQueryValueExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_3275a7c0ac0bb028544ca2040dcb286c_amadey_elex_floxif_rhadamanthys_smoke-loader

PE Signature issue

kernel32

user32

advapi32

generic