2026-08-09_9bda97787c37a709f2ad43d2291521ac_amadey_elex_floxif_rhadamanthys_smoke-loader_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_9bda97787c37a709f2ad43d2291521ac_amadey_elex_floxif_rhadamanthys_smoke-loader_stop_tofsee
Size 449KB
Sample260809-ftr74a1clf
SHA256 98aa676bd72d8f559f5ce2f5fef7e03d2419f9ee187e6010c9173a10ea61132e
MD5 9bda97787c37a709f2ad43d2291521ac
SHA1 13db71a7dda41be835dcfd54e5bd42ab62507558
SHA512 03c981929c0315f12b135a4a2972591bba0af3abf1d4738d9e6b9a658c387354d25ddc401ecbfff9178d066f5f90d7d1aa88a036e5696f6c075993f30f161335
SSDEEP 12288:xkTHMmF8bPSHDogQsTJJJK+l8wBjvrEH7T:xUb4SjoYTJ/K+l8yrEH7T
TLSH
T11CA4AF2432C0C2F2D46725752269C3F25EBA787D076AA98FBBD54A780F287E1D72530D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_9bda97787c37a709f2ad43d2291521ac_amadey_elex_floxif_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-08-09_9bda97787c37a709f2ad43d2291521ac_amadey_elex_floxif_rhadamanthys_smoke-loader_stop_tofsee

.exe 449KB

2026-08-09_9bda97787c37a709f2ad43d2291521ac_amadey_elex_floxif_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH a04dd9f5ee88d7774203e0a0cfa1b941
SHA256 98aa676bd72d8f559f5ce2f5fef7e03d2419f9ee187e6010c9173a10ea61132e
MD5 9bda97787c37a709f2ad43d2291521ac
SHA1 13db71a7dda41be835dcfd54e5bd42ab62507558
SHA512 03c981929c0315f12b135a4a2972591bba0af3abf1d4738d9e6b9a658c387354d25ddc401ecbfff9178d066f5f90d7d1aa88a036e5696f6c075993f30f161335
SSDEEP 12288:xkTHMmF8bPSHDogQsTJJJK+l8wBjvrEH7T:xUb4SjoYTJ/K+l8yrEH7T
TLSH
T11CA4AF2432C0C2F2D46725752269C3F25EBA787D076AA98FBBD54A780F287E1D72530D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5b:7b:01:65:ba:df:8d:95:bf:0f:4e:1a:c7:3b:f6:c1:2f:7a:ec:0f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 27, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

Major OS version

Entry point

35413

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\src\Pstools\psexec\EXE\Release\psexec.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

netapi32

NetApiBufferFree NetServerEnum

ws2_32

WSAStartup gethostname inet_ntoa gethostbyname

mpr

WNetAddConnection2W WNetCancelConnection2W

kernel32

GetModuleFileNameW SetEvent ConnectNamedPipe GetFileAttributesW DisconnectNamedPipe ReadConsoleW ReadFile GetFileTime WaitNamedPipeW SetFileAttributesW CopyFileW WaitForMultipleObjects SetConsoleTitleW DuplicateHandle GetCurrentProcessId TransactNamedPipe SetNamedPipeHandleState GetVersion CreateEventW GetExitCodeProcess ResumeThread SetProcessAffinityMask GetEnvironmentVariableW GetFullPathNameW GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetStringTypeA SetFilePointer GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW LoadResource GetCurrentProcess MultiByteToWideChar WaitForSingleObject GetComputerNameW GetSystemDirectoryW DeleteFileW FindResourceW SizeofResource LockResource GetConsoleScreenBufferInfo LoadLibraryExW FormatMessageA GetStdHandle WriteFile FreeLibrary CreateFileW CloseHandle GetTickCount SetEnvironmentVariableA Sleep SetLastError GetLastError GetCommandLineW LocalAlloc GetModuleHandleW LocalFree SetPriorityClass LoadLibraryW GetProcAddress GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize GetLocaleInfoW GetTimeZoneInformation SetEndOfFile GetProcessHeap CompareStringA CompareStringW SetConsoleCtrlHandler HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection ExitThread GetCurrentThreadId CreateThread ReadConsoleInputA SetConsoleMode GetConsoleMode PeekConsoleInputA GetNumberOfConsoleInputEvents ExitProcess DeleteCriticalSection FatalAppExitA VirtualFree VirtualAlloc HeapReAlloc HeapCreate HeapDestroy GetModuleFileNameA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThread SetHandleCount GetFileType GetStartupInfoA WideCharToMultiByte GetConsoleCP RtlUnwind CreateFileA FlushFileBuffers InterlockedExchange LoadLibraryA InitializeCriticalSectionAndSpinCount GetStringTypeW LCMapStringA

user32

LoadCursorW SetCursor SetWindowTextW SendMessageW EndDialog GetSysColorBrush GetDlgItem DialogBoxIndirectParamW InflateRect

gdi32

GetDeviceCaps SetMapMode StartDocW StartPage EndPage EndDoc

comdlg32

PrintDlgW

advapi32

InitializeAcl CreateProcessAsUserW OpenProcessToken AdjustTokenPrivileges LogonUserW ImpersonateLoggedOnUser RegConnectRegistryW RevertToSelf DeleteService ControlService OpenSCManagerW OpenServiceW StartServiceW QueryServiceStatus CreateServiceW CloseServiceHandle RegCreateKeyW RegQueryValueExW RegSetValueExW RegCloseKey AllocateAndInitializeSid GetTokenInformation GetLengthSid SetTokenInformation GetSecurityInfo GetAce AddAce AddAccessAllowedAce SetSecurityInfo FreeSid LsaOpenPolicy LsaEnumerateAccountRights LookupPrivilegeValueW LsaFreeMemory LsaClose

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_9bda97787c37a709f2ad43d2291521ac_amadey_elex_floxif_rhadamanthys_smoke-loader_stop_tofsee

PE Signature issue

version

netapi32

ws2_32

mpr

kernel32

user32

gdi32

comdlg32

advapi32

generic