2026-08-08_4fc3d432967ce5a0fbd6098d5139ec0c_elex_floxif_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_4fc3d432967ce5a0fbd6098d5139ec0c_elex_floxif_rhadamanthys_smoke-loader_stealc_tofsee
Size 323KB
Sample260808-tlj4eazfqh
SHA256 cb88128ec5c0a0f3fd4eb6fb7d92339953aa7b6f7cf2f4e88ef9de7dd0eb2690
MD5 4fc3d432967ce5a0fbd6098d5139ec0c
SHA1 58ae60c18576b394e248fe838727fe7bdb815b8b
SHA512 c0a19aff3e4023aa2dca0c51805113a482af34cc8fd20893bb2b5b95d93369feb50dfbe177b13a63187f67d29e6e99c6a5965bd89d7f9898b132a1100fd3c548
SSDEEP 6144:AfY8bOuaxcxI4PFGCUDUIP5muBV+UdvrEFp7hKqn7:6DJCQI4PFGVDXPUuBjvrEH7r7
TLSH
T170648C11359092F1D0B20930A4FBD3318AAD643D0B6B55DBAB981B1EAE7CFD1663931F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_4fc3d432967ce5a0fbd6098d5139ec0c_elex_floxif_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-08-08_4fc3d432967ce5a0fbd6098d5139ec0c_elex_floxif_rhadamanthys_smoke-loader_stealc_tofsee

.exe 323KB

2026-08-08_4fc3d432967ce5a0fbd6098d5139ec0c_elex_floxif_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 34c93634e9e79ee43d34d89207266657
SHA256 cb88128ec5c0a0f3fd4eb6fb7d92339953aa7b6f7cf2f4e88ef9de7dd0eb2690
MD5 4fc3d432967ce5a0fbd6098d5139ec0c
SHA1 58ae60c18576b394e248fe838727fe7bdb815b8b
SHA512 c0a19aff3e4023aa2dca0c51805113a482af34cc8fd20893bb2b5b95d93369feb50dfbe177b13a63187f67d29e6e99c6a5965bd89d7f9898b132a1100fd3c548
SSDEEP 6144:AfY8bOuaxcxI4PFGCUDUIP5muBV+UdvrEFp7hKqn7:6DJCQI4PFGVDXPUuBjvrEH7r7
TLSH
T170648C11359092F1D0B20930A4FBD3318AAD643D0B6B55DBAB981B1EAE7CFD1663931F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7d:81:bd:bf:c9:71:82:d0:c8:91:b4:cb:e7:09:2a:6d:18:5c:2e:c9

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing Beijiashidai Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Beijiashidai Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 21, 2013

CN=Beijing Beijiashidai Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Beijiashidai Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Beijing Beijiashidai Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Beijiashidai Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

66:c3:13:66:a4:7f:f1:6d:4b:8e:91:35:40:ac:36:1b

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 30, 2011 - May 29, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

62021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\buildbot\209\chromeplus\src\build\static_library_Release\app_host.exe.pdb

ole32

CoCreateInstance CoUninitialize CoInitializeEx

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeGetTime

kernel32

CloseHandle WaitForSingleObject ReleaseMutex GetLastError SetLastError CreateProcessW GetModuleFileNameW CreateMutexW SetFilePointer CreateFileW WriteFile OutputDebugStringA RaiseException GetCurrentThreadId Sleep IsDebuggerPresent LocalFree GetCommandLineW GetCurrentProcess HeapSetInformation GetProcAddress GetModuleHandleW GetStdHandle TerminateProcess ResumeThread AssignProcessToJobObject GetSystemTimeAsFileTime GetUserDefaultLangID ExpandEnvironmentStringsW InitializeCriticalSectionAndSpinCount DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar WideCharToMultiByte GetTickCount SetUnhandledExceptionFilter QueryPerformanceCounter TlsSetValue TlsFree TlsAlloc TlsGetValue InterlockedIncrement InterlockedExchange InterlockedDecrement InitializeCriticalSection EncodePointer DecodePointer UnhandledExceptionFilter HeapFree GetStartupInfoW GetConsoleMode ExitProcess HeapReAlloc HeapAlloc GetCPInfo RtlUnwind LCMapStringW HeapCreate IsProcessorFeaturePresent FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetTimeZoneInformation WriteConsoleW SetStdHandle FlushFileBuffers GetACP GetOEMCP IsValidCodePage GetLocaleInfoW FreeLibrary LoadLibraryW GetStringTypeW HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CompareStringW SetEnvironmentVariableA GetCurrentProcessId InterlockedExchangeAdd GetConsoleCP GetFileAttributesW LoadLibraryA LocalAlloc

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW CreateProcessAsUserW

oleaut32

SysAllocString SysFreeString

user32

MessageBoxW

Name

.text

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_4fc3d432967ce5a0fbd6098d5139ec0c_elex_floxif_rhadamanthys_smoke-loader_stealc_tofsee

PE Signature issue

ole32

userenv

version

winmm

kernel32

advapi32

oleaut32

user32

generic