2026-08-09_309763789199bba77c34a6bd080325fb_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_309763789199bba77c34a6bd080325fb_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop
Size 39.7MB
Sample260809-gd1d7sgh93
SHA256 1080ac7369bc12177343c9bc04ab9f74e923eb9e9af03c1ea6aaba4339cbd571
MD5 309763789199bba77c34a6bd080325fb
SHA1 c97dd5aec1b0a068c5ddb37f3aaf3ed5768f31e0
SHA512 6ba7eccd620af8639be1be1bd1ef121b4dc5a30f98b49a5c1dc1beac2679b02ec2f8469077ae3fee3e7c70874bf5c7bcf5806466a4ceb371dc441bc047fa0cf4
SSDEEP 786432:ZCnoOq3xSZpPnJyxUHE0s/4s+rpVQr8Rez7SM4HoKyPByRTf/EWSW:cnojhSDfJ1ygTQr83MAoK5RTUWSW
TLSH
T12B97331291F007FCF821C579B196621E737A24AF06FD425BD79C4DF82F219E2A4BA153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_309763789199bba77c34a6bd080325fb_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_309763789199bba77c34a6bd080325fb_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 39.7MB

2026-08-09_309763789199bba77c34a6bd080325fb_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 60f2858f8c859062bd16000a4cb2a2ed
SHA256 1080ac7369bc12177343c9bc04ab9f74e923eb9e9af03c1ea6aaba4339cbd571
MD5 309763789199bba77c34a6bd080325fb
SHA1 c97dd5aec1b0a068c5ddb37f3aaf3ed5768f31e0
SHA512 6ba7eccd620af8639be1be1bd1ef121b4dc5a30f98b49a5c1dc1beac2679b02ec2f8469077ae3fee3e7c70874bf5c7bcf5806466a4ceb371dc441bc047fa0cf4
SSDEEP 786432:ZCnoOq3xSZpPnJyxUHE0s/4s+rpVQr8Rez7SM4HoKyPByRTf/EWSW:cnojhSDfJ1ygTQr83MAoK5RTUWSW
TLSH
T12B97331291F007FCF821C579B196621E737A24AF06FD425BD79C4DF82F219E2A4BA153
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

64:78:09:c4:90:a0:6f:d0:05:a9:85:bd:07:15:15:7d:57:f5:a9:91

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,OU=Information Service & Support Department,O=SEIKO EPSON CORPORATION,L=Suwa-shi,ST=Nagano,C=JP

Chains

Aug 3, 2016

CN=SEIKO EPSON CORPORATION,OU=Information Service & Support Department,O=SEIKO EPSON CORPORATION,L=Suwa-shi,ST=Nagano,C=JP

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=SEIKO EPSON CORPORATION,OU=Information Service & Support Department,O=SEIKO EPSON CORPORATION,L=Suwa-shi,ST=Nagano,C=JP

Serial Number

48:37:76:8f:dd:89:f0:bb:86:7e:06:eb:1a:5b:06:2b

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 31, 2015 - Sep 6, 2016

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

44830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteExA SHGetMalloc

user32

BeginPaint GetSysColor GetClientRect SetRect EndPaint LoadCursorA GetLastActivePopup ShowWindow PostMessageA SendMessageA EnableWindow GetTopWindow SetWindowLongA GetWindowLongA SetWindowTextA SetForegroundWindow SetActiveWindow SetDlgItemTextA CharUpperBuffA LoadIconA SetWindowWord SendDlgItemMessageA GetDlgItem InvalidateRect UpdateWindow LoadStringA MessageBoxA SetTimer GetMessageA KillTimer PostQuitMessage DialogBoxParamA GetDlgItemTextA EndDialog GetWindowRect GetSystemMetrics SetWindowPos PeekMessageA TranslateMessage DispatchMessageA SetCursor CharNextA GetWindowWord DefWindowProcA RegisterClassA GetParent

kernel32

GetConsoleCP GetLocaleInfoA GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetStdHandle HeapCreate HeapDestroy VirtualAlloc VirtualFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapSize Sleep GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetVersionExA FindClose FindFirstFileA SetCurrentDirectoryA CreateDirectoryA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime LocalAlloc GetDriveTypeA GetEnvironmentVariableA DeleteFileA SetFileAttributesA GetConsoleMode SetEndOfFile SetFilePointer CloseHandle UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileA GetWindowsDirectoryA MoveFileExA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime CreateProcessA LocalFree ExitProcess FormatMessageA GetLastError GetModuleHandleA GetVolumeInformationA FindNextFileA GetTickCount WideCharToMultiByte WaitForSingleObject SetErrorMode GetLocalTime lstrlenA CreateFileW ReadFile LoadLibraryA InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers RemoveDirectoryA MultiByteToWideChar RtlUnwind HeapAlloc HeapFree HeapReAlloc RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetProcAddress

gdi32

SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA CreateDCA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject SetBkColor

comctl32

ord17

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_309763789199bba77c34a6bd080325fb_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

PE Signature issue

shell32

user32

kernel32

gdi32

comctl32

generic