2026-08-09_3ef5bf998f300d4cf232f2d42bded63c_elex_floxif_rhadamanthys_stop

General

Target
2026-08-09_3ef5bf998f300d4cf232f2d42bded63c_elex_floxif_rhadamanthys_stop
Size 248KB
Sample260809-gbnbvs1fpf
SHA256 769962bd6d748c922db804184f4ad69e70833eacd518355aece41b4fa9010a58
MD5 3ef5bf998f300d4cf232f2d42bded63c
SHA1 13e0bf8b35df2c663bea263793178b9eed6fd626
SHA512 77547f746bf379e9b42c093de00304dd5c2b75dd43faacd699c0ab0265a0d1ad3b529af365e3bce37dcbf8f78e2d2876737c2bcb300cf1370c09ad2f8d7c502c
SSDEEP 6144:rYHvIz3Vv0Bss/bzKI7wb9BV+UdvrEFp7hKSs:rAIz3Vv0BrPH0RBjvrEH7E
TLSH
T13844AE207690C3F9E4B302F475BDA768A9A97D7C0B7550CBA3860AE95A3C6D4DD3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_3ef5bf998f300d4cf232f2d42bded63c_elex_floxif_rhadamanthys_stop

File Explorer

2026-08-09_3ef5bf998f300d4cf232f2d42bded63c_elex_floxif_rhadamanthys_stop

.exe 248KB

2026-08-09_3ef5bf998f300d4cf232f2d42bded63c_elex_floxif_rhadamanthys_stop

IMPHASH 5c71dd188d3abc49c7086fdb09accc77
SHA256 769962bd6d748c922db804184f4ad69e70833eacd518355aece41b4fa9010a58
MD5 3ef5bf998f300d4cf232f2d42bded63c
SHA1 13e0bf8b35df2c663bea263793178b9eed6fd626
SHA512 77547f746bf379e9b42c093de00304dd5c2b75dd43faacd699c0ab0265a0d1ad3b529af365e3bce37dcbf8f78e2d2876737c2bcb300cf1370c09ad2f8d7c502c
SSDEEP 6144:rYHvIz3Vv0Bss/bzKI7wb9BV+UdvrEFp7hKSs:rAIz3Vv0BrPH0RBjvrEH7E
TLSH
T13844AE207690C3F9E4B302F475BDA768A9A97D7C0B7550CBA3860AE95A3C6D4DD3031B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f8:ef:31:a5:4a:1f:e3:84:00:45:0b:e3:17:80:a6:c9:99:f9:0e:93

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=R-Tools Technology Inc.,O=R-Tools Technology Inc.,L=Richmond Hill,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c0f6f666669636540722d74742e636f6d

Chains

Nov 7, 2012

CN=R-Tools Technology Inc.,O=R-Tools Technology Inc.,L=Richmond Hill,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c0f6f666669636540722d74742e636f6d

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=R-Tools Technology Inc.,O=R-Tools Technology Inc.,L=Richmond Hill,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c0f6f666669636540722d74742e636f6d

Serial Number

11:21:c9:ef:7b:07:23:00:b6:fb:5d:1d:9b:04:24:ea:61:f6

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 12, 2012 - Mar 13, 2015

Minor OS version

0

Major OS version

5

Entry point

14784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Main\SVN\DataRecovery\Binaries\exe\hhe\Win32\Release\hhe.pdb

kernel32

SetEvent UnmapViewOfFile OpenFileMappingW CloseHandle VirtualQuery CreateMutexW WaitForSingleObject ReleaseMutex LocalFree OpenEventW MapViewOfFile ExpandEnvironmentStringsA CreateFileA InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCommandLineA GetStartupInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleFileNameW RtlUnwind RaiseException HeapValidate IsBadReadPtr TerminateProcess GetCurrentProcess IsDebuggerPresent QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate HeapFree VirtualFree WriteFile FlushFileBuffers GetConsoleCP GetConsoleMode DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage InitializeCriticalSectionAndSpinCount LoadLibraryA SetStdHandle WriteConsoleA GetConsoleOutputCP MultiByteToWideChar SetFilePointer LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetCommandLineW

user32

MsgWaitForMultipleObjects PostQuitMessage PeekMessageW GetParent GetWindowRect IsWindowVisible IsWindow SetWindowPos

shell32

CommandLineToArgvW

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_3ef5bf998f300d4cf232f2d42bded63c_elex_floxif_rhadamanthys_stop

PE Signature issue

kernel32

user32

shell32

advapi32

generic