2026-08-08_cfd73b8237564d9e5d7defa4f3a1b138_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_cfd73b8237564d9e5d7defa4f3a1b138_elex_rhadamanthys_smoke-loader_stop
Size 1.3MB
Sample260808-c576xaydpg
SHA256 2435f5e6839100c9d75cdb64634d85df54f7abdf1e905c21a39e24c32b412105
MD5 cfd73b8237564d9e5d7defa4f3a1b138
SHA1 760711c0953f54f5e8b13853e7f2930f106b9d5b
SHA512 9f869420e9c7878bd82c2970fe89322a0d77d80be64ece79eb55fa2e362bb424179be9b53c29e659902747662d79b0281f20090dfb0b6e4db3341677273fa89f
SSDEEP 24576:dnmg51C7ebV+7z/lYaclgPVVF1UMRUi917ZpWf/jnAOrgNgd:BmiCKVchBIgRmKUilMznJge
TLSH
T16555BE166BDF5454E8625A3A12B2C5B2A533BC610A30876B21DCBE4BBF376CCD470B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_cfd73b8237564d9e5d7defa4f3a1b138_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-08_cfd73b8237564d9e5d7defa4f3a1b138_elex_rhadamanthys_smoke-loader_stop

.exe 1.3MB

2026-08-08_cfd73b8237564d9e5d7defa4f3a1b138_elex_rhadamanthys_smoke-loader_stop

IMPHASH 7e91bb256d8596bbb82512b4db2bd5b0
SHA256 2435f5e6839100c9d75cdb64634d85df54f7abdf1e905c21a39e24c32b412105
MD5 cfd73b8237564d9e5d7defa4f3a1b138
SHA1 760711c0953f54f5e8b13853e7f2930f106b9d5b
SHA512 9f869420e9c7878bd82c2970fe89322a0d77d80be64ece79eb55fa2e362bb424179be9b53c29e659902747662d79b0281f20090dfb0b6e4db3341677273fa89f
SSDEEP 24576:dnmg51C7ebV+7z/lYaclgPVVF1UMRUi917ZpWf/jnAOrgNgd:BmiCKVchBIgRmKUilMznJge
TLSH
T16555BE166BDF5454E8625A3A12B2C5B2A533BC610A30876B21DCBE4BBF376CCD470B47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7a:53:7c:d0:ed:65:8e:46:21:69:14:47:fc:38:52:a4:58:53:cd:fe

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Aspyr Media\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Aspyr Media\, Inc.,L=Austin,ST=Texas,C=US

Chains

Oct 16, 2009

CN=Aspyr Media\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Aspyr Media\, Inc.,L=Austin,ST=Texas,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Aspyr Media\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Aspyr Media\, Inc.,L=Austin,ST=Texas,C=US

Serial Number

37:eb:4d:ce:7a:63:fa:1c:5a:b2:81:3a:eb:cc:79:e8

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2008 - Oct 25, 2009

Minor OS version

Major OS version

Entry point

50381

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\build\trunk\installer\dk-launcher-shaped\Final\launcher.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx PropertySheetW

kernel32

CreateDirectoryW lstrlenW WriteFile WideCharToMultiByte GlobalAlloc LoadLibraryW FreeLibrary GetDiskFreeSpaceExW CreateMutexW GetCurrentThreadId GetModuleHandleW LoadLibraryA GetLocalTime GetTimeZoneInformation IsProcessorFeaturePresent GetVersionExW GetProcAddress GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo VerLanguageNameW GetSystemDirectoryW GetComputerNameW FindNextFileW GetWindowsDirectoryW GetTempPathW GetThreadLocale GetSystemDefaultLCID GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLangID GetUserDefaultLangID GetACP GetOEMCP CreateProcessW ResumeThread WaitForSingleObject GetExitCodeProcess CompareStringW lstrcpynW GetModuleFileNameW FindClose LocalAlloc GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP SetFilePointer VirtualAlloc HeapReAlloc GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapCreate HeapDestroy GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InitializeCriticalSection InterlockedExchange EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetModuleFileNameA GetStdHandle IsValidCodePage GetCPInfo HeapSize Sleep InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc FindFirstFileW MultiByteToWideChar DeleteFileW UnmapViewOfFile MapViewOfFile CreateFileMappingW CloseHandle GetFileInformationByHandle GetLastError CreateFileW SizeofResource LockResource FindResourceW LoadResource LocalReAlloc GlobalFree GetCommandLineW LocalFree GetLocaleInfoA GetUserDefaultLCID WriteConsoleW CreateFileA FlushFileBuffers FormatMessageW TlsGetValue RtlUnwind RaiseException GetStartupInfoA GetConsoleOutputCP WriteConsoleA SetStdHandle TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA ExitProcess GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap

user32

MessageBoxW LoadStringW AllowSetForegroundWindow GetDesktopWindow IsDlgButtonChecked CheckDlgButton EnumDisplayDevicesW EnumDisplaySettingsW SetCursor LoadCursorW DialogBoxParamW SetDlgItemTextW SendDlgItemMessageW SetWindowLongW GetParent CreateWindowExW UnregisterClassW RegisterClassExW DefWindowProcW wsprintfW DestroyWindow DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW PostMessageW ShowWindow LoadImageW CreateDialogParamW PostThreadMessageW PostQuitMessage EndPaint BeginPaint SetWindowPos GetSystemMetrics SetWindowTextW GetWindowRect SendMessageW InvalidateRect LoadBitmapW SetWindowPlacement GetWindowPlacement ClientToScreen ReleaseDC GetDC EndDialog

gdi32

GetDeviceCaps SetPixelFormat DescribePixelFormat ChoosePixelFormat DeleteObject CreateCompatibleBitmap DeleteDC CreateCompatibleDC BitBlt SelectObject GetObjectW SetDeviceGammaRamp GetDeviceGammaRamp

comdlg32

GetSaveFileNameW

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid RegQueryValueExW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegOpenKeyExW GetUserNameW

shell32

ShellExecuteExW SHGetFolderPathW CommandLineToArgvW

ole32

CoInitializeEx CoCreateInstance CoSetProxyBlanket

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_cfd73b8237564d9e5d7defa4f3a1b138_elex_rhadamanthys_smoke-loader_stop

PE Signature issue

version

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic