2026-08-09_9ae20f187849e4e84e87719cf1ff2aad_elex_floxif_maze_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_9ae20f187849e4e84e87719cf1ff2aad_elex_floxif_maze_rhadamanthys_stop
Size 362KB
Sample260809-ft23asvsav
SHA256 d63b31539ff14a68fca68795e97e02094b8ccbbce92ece91278ac6790120b23d
MD5 9ae20f187849e4e84e87719cf1ff2aad
SHA1 6cce88e531c9e62dfeecd04e065efe99900df81d
SHA512 322c3af42df88d9dad94e4f4287083ea0431ce539348378823aae41999636f22011a5d148bc39fce7fc881698460d4e8413ed58abb11d047acf60f5c96645f3f
SSDEEP 3072:mGNLFBiL8dcypf4i+3rWz6eGl6btiKL2lQBV+UdE+rECWp7hKk5:mG9awdmiml6bbBV+UdvrEFp7hKk5
TLSH
T118846C427BC083E7E492073574DA6B212AF9F93C5B7756D7A384022E0E9A3C15F3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_9ae20f187849e4e84e87719cf1ff2aad_elex_floxif_maze_rhadamanthys_stop

File Explorer

2026-08-09_9ae20f187849e4e84e87719cf1ff2aad_elex_floxif_maze_rhadamanthys_stop

.exe 362KB

2026-08-09_9ae20f187849e4e84e87719cf1ff2aad_elex_floxif_maze_rhadamanthys_stop

IMPHASH 2277fe0ddb230ae2e455ae55f5ecd187
SHA256 d63b31539ff14a68fca68795e97e02094b8ccbbce92ece91278ac6790120b23d
MD5 9ae20f187849e4e84e87719cf1ff2aad
SHA1 6cce88e531c9e62dfeecd04e065efe99900df81d
SHA512 322c3af42df88d9dad94e4f4287083ea0431ce539348378823aae41999636f22011a5d148bc39fce7fc881698460d4e8413ed58abb11d047acf60f5c96645f3f
SSDEEP 3072:mGNLFBiL8dcypf4i+3rWz6eGl6btiKL2lQBV+UdE+rECWp7hKk5:mG9awdmiml6bbBV+UdvrEFp7hKk5
TLSH
T118846C427BC083E7E492073574DA6B212AF9F93C5B7756D7A384022E0E9A3C15F3A716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

85:89:e7:1d:31:dd:d8:6f:3e:9d:89:cd:ad:00:57:cf:62:89:4a:41:86:42:ee:3c:f1:65:7b:5e:ce:54:5d:87

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Chains

Jul 6, 2021

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

36:72:c3:97:1e:e8:61:7e:d9:fb:fc:fd:3f:e8:36:c8:73:6f:cb:2d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

Chains

Jul 6, 2021

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:1c:b2:8a:00:00:00:00:00:26

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

Serial Number

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3d

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2019 - Dec 7, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Serial Number

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3b

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2018 - Sep 11, 2021

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Minor OS version

Major OS version

Entry point

30801

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\build\ob\bora-18278582\vos3\thinstall\modules\AppPolicy.pdb

kernel32

WriteConsoleW SetEndOfFile ReadConsoleW ReadFile SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle CreateFileW OutputDebugStringW HeapReAlloc LCMapStringW VirtualQuery GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetFileType GetProcessHeap CloseHandle LoadLibraryExW WriteFile GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetCPInfo GetOEMCP GetACP IsValidCodePage GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter HeapSize HeapFree HeapAlloc GetCommandLineW RtlUnwind RaiseException WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW ExitProcess GetLastError IsProcessorFeaturePresent IsDebuggerPresent DecodePointer EncodePointer GetProcAddress GetCurrentThreadId GetModuleFileNameW SetLastError GetModuleHandleW GetFullPathNameW

ntdll

NtDelayExecution NtWaitForSingleObject NtClearEvent NtCreateEvent NtReadFile NtQueryInformationFile NtOpenFile NtClose RtlMultiByteToUnicodeN LdrGetDllHandle LdrGetProcedureAddress RtlCompareUnicodeString RtlInitAnsiString RtlInitUnicodeString NtAllocateVirtualMemory RtlNtStatusToDosError

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_9ae20f187849e4e84e87719cf1ff2aad_elex_floxif_maze_rhadamanthys_stop

PE Signature issue

PE Signature issue

kernel32

ntdll

generic