2026-08-09_fb4584baaef027fc182705235c551aba_amadey_elex_floxif_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_fb4584baaef027fc182705235c551aba_amadey_elex_floxif_rhadamanthys_smoke-loader
Size 209KB
Sample260809-g4aapsap4y
SHA256 9b4bc3d612fa50f60b76796e1d1721f6f96d2630651f4b57c9cdcb64725e7627
MD5 fb4584baaef027fc182705235c551aba
SHA1 01e0b2842d44383b93e6155e6d3606743786d1f3
SHA512 0875203226d88ddd63cb044e13212e03e702b3e548451fc50c7a1116d3ba0f9f57cf90607fb5fa1039149335cf7311fd7ce5092b2db78be254cfed799570f4b4
SSDEEP 3072:+GTiapwP/3ZWvQQ/ye6MqInJM1SVKfeZDY9JKwxls7v2lQBV+UdE+rECWp7hKA7h:+HW/yXRI4eZDY9JOvBV+UdvrEFp7hKAF
TLSH
T17D24BE0336D0C3F9D4E20430395CAB99A3F1ED3D0D664457B359364EAF7DA829A2AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_fb4584baaef027fc182705235c551aba_amadey_elex_floxif_rhadamanthys_smoke-loader

File Explorer

2026-08-09_fb4584baaef027fc182705235c551aba_amadey_elex_floxif_rhadamanthys_smoke-loader

.exe 209KB

2026-08-09_fb4584baaef027fc182705235c551aba_amadey_elex_floxif_rhadamanthys_smoke-loader

IMPHASH 85eeda1139037fe0ba54896b7ad8b977
SHA256 9b4bc3d612fa50f60b76796e1d1721f6f96d2630651f4b57c9cdcb64725e7627
MD5 fb4584baaef027fc182705235c551aba
SHA1 01e0b2842d44383b93e6155e6d3606743786d1f3
SHA512 0875203226d88ddd63cb044e13212e03e702b3e548451fc50c7a1116d3ba0f9f57cf90607fb5fa1039149335cf7311fd7ce5092b2db78be254cfed799570f4b4
SSDEEP 3072:+GTiapwP/3ZWvQQ/ye6MqInJM1SVKfeZDY9JKwxls7v2lQBV+UdE+rECWp7hKA7h:+HW/yXRI4eZDY9JOvBV+UdvrEFp7hKAF
TLSH
T17D24BE0336D0C3F9D4E20430395CAB99A3F1ED3D0D664457B359364EAF7DA829A2AB17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b1:21:99:6d:a2:cc:43:4e:12:21:24:39:3f:63:f3:47:4a:eb:a2:77

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Netscape Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Dec 14, 2006

CN=Google Inc,OU=Digital ID Class 3 - Netscape Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2009

Subject

CN=Google Inc,OU=Digital ID Class 3 - Netscape Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

0f:e7:c5:f7:c1:07:16:f0:a4:eb:0d:4b:4d:58:13:71

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 10, 2006 - Jul 10, 2007

Minor OS version

Major OS version

Entry point

60692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\build_server\Ci_v2_Branch\branches\ci_v2_branch\googleclient\ci\build\ship\obj\service\GoogleUpdaterService_not_signed.pdb

kernel32

GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA SetUnhandledExceptionFilter GetCPInfo GetOEMCP LoadLibraryA LCMapStringA LCMapStringW IsBadReadPtr IsBadCodePtr SetStdHandle DeleteTimerQueueTimer CreateTimerQueueTimer lstrcmpW DuplicateHandle GetProcAddress LoadLibraryW GetCurrentThread CreateThread lstrcpyW GetCurrentProcessId CloseHandle GetCurrentThreadId GetVersionExA lstrcatW lstrcmpiW SetProcessWorkingSetSize CreateEventW LockResource GetThreadLocale GetLastError InterlockedExchange RaiseException GetTempPathW lstrlenW MultiByteToWideChar GetACP GetModuleFileNameW lstrcpynW GetVersionExW SizeofResource Sleep OpenProcess InitializeCriticalSection GetModuleHandleW SetEvent WaitForSingleObject GetCommandLineW GetCurrentProcess InterlockedDecrement InterlockedIncrement LoadLibraryExW LoadResource FreeLibrary FindResourceW FindResourceExW GetLocaleInfoA DeleteTimerQueueEx CreateTimerQueue GetTempFileNameW GetStdHandle GetStringTypeW GetStringTypeA IsBadWritePtr VirtualFree HeapDestroy GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings DeleteCriticalSection FreeEnvironmentStringsW HeapCreate TlsGetValue TlsSetValue TlsFree TlsAlloc RtlUnwind GetStartupInfoW GetModuleHandleA GetSystemInfo VirtualAlloc VirtualProtect GetProcessHeap HeapSize HeapReAlloc HeapFree SetLastError FindFirstFileW DeleteFileW FindNextFileW GetFileAttributesW RemoveDirectoryW GetTickCount GetExitCodeProcess FindClose ResetEvent CreateFileW CreateProcessW CreateMutexW ReleaseMutex EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange QueryPerformanceFrequency QueryPerformanceCounter VirtualQuery GetFileAttributesExW CopyFileW MoveFileExW FlushFileBuffers SetFilePointer WriteFile GetSystemTimeAsFileTime CompareFileTime FileTimeToSystemTime WideCharToMultiByte GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime GetDateFormatW GetTimeFormatW ExitProcess TerminateProcess HeapAlloc

user32

SetTimer CharLowerW GetMessageW CharNextW wvsprintfW KillTimer TranslateMessage LoadStringW PostThreadMessageW DispatchMessageW

ole32

CoRegisterClassObject CoRevertToSelf CoImpersonateClient CoInitialize CoRevokeClassObject CoInitializeSecurity StringFromGUID2 CoTaskMemRealloc CoUninitialize CoTaskMemAlloc CoTaskMemFree CoCreateGuid CoCreateInstance

oleaut32

RegisterTypeLi SysAllocString LoadTypeLi UnRegisterTypeLi SysFreeString VarUI4FromStr

advapi32

AllocateAndInitializeSid FreeSid CheckTokenMembership OpenThreadToken GetSecurityDescriptorDacl GetSecurityDescriptorGroup RegSetValueExW RegCloseKey RegEnumKeyExW ControlService GetLengthSid ReportEventW RegisterServiceCtrlHandlerW MakeSelfRelativeSD GetSecurityDescriptorSacl AddAce InitializeSid GetSidLengthRequired RegOpenKeyExW IsValidSid GetSecurityDescriptorOwner SetSecurityDescriptorOwner SetServiceStatus InitializeAcl ChangeServiceConfigW MakeAbsoluteSD RegDeleteValueW QueryServiceStatus StartServiceW ChangeServiceConfig2W GetSecurityDescriptorLength SetSecurityDescriptorDacl RegDeleteKeyW InitializeSecurityDescriptor DeregisterEventSource RegQueryInfoKeyW RegQueryValueExW GetSecurityDescriptorControl RegCreateKeyExW CopySid GetAclInformation OpenServiceW SetSecurityDescriptorGroup SetSecurityDescriptorControl StartServiceCtrlDispatcherW OpenSCManagerW DeleteService GetSidSubAuthority CloseServiceHandle RegisterEventSourceW CreateServiceW

shlwapi

StrRetToStrW SHQueryValueExW PathFindExtensionW

crypt32

CertEnumCertificatesInStore CryptQueryObject CertNameToStrW CertFreeCertificateContext CertDuplicateCertificateContext CertCloseStore

shell32

SHFileOperationW SHGetFolderLocation SHCreateDirectoryExW SHGetDesktopFolder

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_fb4584baaef027fc182705235c551aba_amadey_elex_floxif_rhadamanthys_smoke-loader

PE Signature issue

kernel32

user32

ole32

oleaut32

advapi32

shlwapi

crypt32

shell32

version

wintrust

generic