2026-08-09_ebe16a3cd4be0029d9f8620a31dbbf29_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_ebe16a3cd4be0029d9f8620a31dbbf29_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 488KB
Sample260809-fd23cs1ajh
SHA256 897339f617ca5ae489558aeb63cf59dffe93f9dd4ba2e8909eb94849a532103d
MD5 ebe16a3cd4be0029d9f8620a31dbbf29
SHA1 e9c4b4e13c71a6e4e4d40c14abccb58ff52f0e56
SHA512 564a0a8932bf7258d56040c230e5c66d57acf04b56516309440f52f37c0b8bd1bdee3f5149d2b7537a0e25a3a3a2b809f1451d2e1ddf4a64d044cb36278b400b
SSDEEP 12288:ZWyAXWTQYdi/zvhyKyVkKB0HaKGz1A3BjvrEH78ZPm:ZWyAX7Yacj4dqAVrEH78Z+
TLSH
T1F5B4AE10BBD9C3B6FAB32A3524F8866D15B6BD7C5B3595CBA3140A1E5C706C2EC34326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_ebe16a3cd4be0029d9f8620a31dbbf29_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_ebe16a3cd4be0029d9f8620a31dbbf29_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 488KB

2026-08-09_ebe16a3cd4be0029d9f8620a31dbbf29_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 1844b5e78819b102971e1bb089576cd8
SHA256 897339f617ca5ae489558aeb63cf59dffe93f9dd4ba2e8909eb94849a532103d
MD5 ebe16a3cd4be0029d9f8620a31dbbf29
SHA1 e9c4b4e13c71a6e4e4d40c14abccb58ff52f0e56
SHA512 564a0a8932bf7258d56040c230e5c66d57acf04b56516309440f52f37c0b8bd1bdee3f5149d2b7537a0e25a3a3a2b809f1451d2e1ddf4a64d044cb36278b400b
SSDEEP 12288:ZWyAXWTQYdi/zvhyKyVkKB0HaKGz1A3BjvrEH78ZPm:ZWyAX7Yacj4dqAVrEH78Z+
TLSH
T1F5B4AE10BBD9C3B6FAB32A3524F8866D15B6BD7C5B3595CBA3140A1E5C706C2EC34326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a4:9e:63:aa:66:ac:e4:1d:ce:87:83:07:4f:a8:75:f0:96:2f:44:32:f4:43:c7:3b:07:67:38:64:0f:d6:74:b8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Chains

Apr 20, 2017

CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

d6:61:15:20:d3:44:37:5c:b2:23:93:bc:15:80:d9:7f:61:c7:ef:4a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Chains

Apr 20, 2017

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Serial Number

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2015 - Jul 26, 2018

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Serial Number

7b:c1:5a:f2:13:67:d0:75:8b:ed:dc:ca:11:86:42:de

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 13, 2015 - Jul 13, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

32:58:e8:ee:54:af:5c:27

Issuer

CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 13, 2016 - Dec 13, 2021

Minor OS version

Major OS version

Entry point

109886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dvs\p4\build\sw\rel\gpu_drv\installer_core\Build\Core\Out\Win32\Release\setup.pdb

kernel32

FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW MultiByteToWideChar GetCurrentProcess CloseHandle GetCurrentDirectoryW GetTempPathW GetSystemDirectoryW SetErrorMode GetFileAttributesW CreateDirectoryW SetCurrentDirectoryW GetTickCount ExpandEnvironmentStringsW GetSystemInfo CreateFileA InterlockedIncrement InterlockedDecrement SetLastError DebugBreak Sleep IsDebuggerPresent EnterCriticalSection LeaveCriticalSection GetVersionExW LocalFree FormatMessageW GetLastError InitializeCriticalSection DeleteCriticalSection WideCharToMultiByte FindResourceExW FindResourceW LoadResource LockResource SizeofResource FlushFileBuffers GetConsoleCP SetFilePointer WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount GetModuleHandleA LCMapStringW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameA GetStdHandle WriteFile HeapCreate GetStringTypeW GetStringTypeA LCMapStringA GetLocaleInfoA RaiseException HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap FormatMessageA GetStartupInfoW RtlUnwind LoadLibraryA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId ExitProcess VirtualFree VirtualAlloc GetConsoleMode

user32

MessageBoxW

advapi32

RegSetValueExW LsaNtStatusToWinError RegOpenCurrentUser RegEnumValueW RegDeleteValueW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegCloseKey

ole32

CoInitializeSecurity CoUninitialize CoInitializeEx

oleaut32

VariantClear VariantInit SafeArrayDestroy SafeArrayCreate SafeArrayCopy SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetVartype SafeArrayUnlock SafeArrayLock SysFreeString SysAllocString SysAllocStringLen VariantChangeType SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_ebe16a3cd4be0029d9f8620a31dbbf29_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

generic