2026-08-09_b1dcb8cd4966052f91e7c9af961fcd49_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_b1dcb8cd4966052f91e7c9af961fcd49_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop
Size 39.7MB
Sample260809-fp34ssgg64
SHA256 3b2fe549334f10a6764b47c64668e5059bf822cdb5445cbac80b330e42653ad6
MD5 b1dcb8cd4966052f91e7c9af961fcd49
SHA1 7649347bc9f066510661a0ac0b74f4a885e87f4a
SHA512 2b3ee65aaa68afefc6c003b00985000e29014f0e46b1b7072def0cb23adb9414719e505072ec7ddb9e5e442a76243d86a409535d3bab14917116eee954fb8221
SSDEEP 786432:kCnoOq3xSZpPnJyxUHE0s/4s+rpVQr8Rez7SM4HoKyPByRTf/EWSG:FnojhSDfJ1ygTQr83MAoK5RTUWSG
TLSH
T18B97331291F047FCF821C579B196621EB37A24AF06FD425BD79C4DF82F219E2A0BA153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_b1dcb8cd4966052f91e7c9af961fcd49_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_b1dcb8cd4966052f91e7c9af961fcd49_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 39.7MB

2026-08-09_b1dcb8cd4966052f91e7c9af961fcd49_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 60f2858f8c859062bd16000a4cb2a2ed
SHA256 3b2fe549334f10a6764b47c64668e5059bf822cdb5445cbac80b330e42653ad6
MD5 b1dcb8cd4966052f91e7c9af961fcd49
SHA1 7649347bc9f066510661a0ac0b74f4a885e87f4a
SHA512 2b3ee65aaa68afefc6c003b00985000e29014f0e46b1b7072def0cb23adb9414719e505072ec7ddb9e5e442a76243d86a409535d3bab14917116eee954fb8221
SSDEEP 786432:kCnoOq3xSZpPnJyxUHE0s/4s+rpVQr8Rez7SM4HoKyPByRTf/EWSG:FnojhSDfJ1ygTQr83MAoK5RTUWSG
TLSH
T18B97331291F047FCF821C579B196621EB37A24AF06FD425BD79C4DF82F219E2A0BA153
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

97:bc:81:53:53:89:a9:2f:f6:0b:bb:33:ed:34:b6:2d:29:a7:37:d8

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,OU=Information Service & Support Department,O=SEIKO EPSON CORPORATION,L=Suwa-shi,ST=Nagano,C=JP

Chains

Aug 3, 2016

CN=SEIKO EPSON CORPORATION,OU=Information Service & Support Department,O=SEIKO EPSON CORPORATION,L=Suwa-shi,ST=Nagano,C=JP

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=SEIKO EPSON CORPORATION,OU=Information Service & Support Department,O=SEIKO EPSON CORPORATION,L=Suwa-shi,ST=Nagano,C=JP

Serial Number

48:37:76:8f:dd:89:f0:bb:86:7e:06:eb:1a:5b:06:2b

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 31, 2015 - Sep 6, 2016

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

44830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteExA SHGetMalloc

user32

BeginPaint GetSysColor GetClientRect SetRect EndPaint LoadCursorA GetLastActivePopup ShowWindow PostMessageA SendMessageA EnableWindow GetTopWindow SetWindowLongA GetWindowLongA SetWindowTextA SetForegroundWindow SetActiveWindow SetDlgItemTextA CharUpperBuffA LoadIconA SetWindowWord SendDlgItemMessageA GetDlgItem InvalidateRect UpdateWindow LoadStringA MessageBoxA SetTimer GetMessageA KillTimer PostQuitMessage DialogBoxParamA GetDlgItemTextA EndDialog GetWindowRect GetSystemMetrics SetWindowPos PeekMessageA TranslateMessage DispatchMessageA SetCursor CharNextA GetWindowWord DefWindowProcA RegisterClassA GetParent

kernel32

GetConsoleCP GetLocaleInfoA GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetStdHandle HeapCreate HeapDestroy VirtualAlloc VirtualFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapSize Sleep GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetVersionExA FindClose FindFirstFileA SetCurrentDirectoryA CreateDirectoryA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime LocalAlloc GetDriveTypeA GetEnvironmentVariableA DeleteFileA SetFileAttributesA GetConsoleMode SetEndOfFile SetFilePointer CloseHandle UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileA GetWindowsDirectoryA MoveFileExA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime CreateProcessA LocalFree ExitProcess FormatMessageA GetLastError GetModuleHandleA GetVolumeInformationA FindNextFileA GetTickCount WideCharToMultiByte WaitForSingleObject SetErrorMode GetLocalTime lstrlenA CreateFileW ReadFile LoadLibraryA InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers RemoveDirectoryA MultiByteToWideChar RtlUnwind HeapAlloc HeapFree HeapReAlloc RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetProcAddress

gdi32

SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA CreateDCA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject SetBkColor

comctl32

ord17

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_b1dcb8cd4966052f91e7c9af961fcd49_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

PE Signature issue

shell32

user32

kernel32

gdi32

comctl32

generic