2026-08-09_5ee74b98ed2da776d0da596df6ab6697_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_5ee74b98ed2da776d0da596df6ab6697_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 370KB
Sample260809-hlj8masfkb
SHA256 18da71729f459581713c0569b5742c9a9828ec5395dd93668797139149767174
MD5 5ee74b98ed2da776d0da596df6ab6697
SHA1 d16d2be37701482a0d11cc3ea9cdb255bcfe1be5
SHA512 66dd5a8beffa63c51a5d20d034b97bebba423fcb79d0e2314f8cfb59cb20cc5de788a24fe8a3adc294396554d92eafd37c34492ffc9ee80c98bf720124d1c8b6
SSDEEP 6144:fjH+qlYw7pLa4zW7kmnrwQVllZSBV+UdvrEFp7hKiF:7H+OYw7pu4zWBnZSBjvrEH7x
TLSH
T10584BE103A90C3F3C507123270D5E77255B9BD7D6BA064CBB38837AA2E792D1AB7531A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_5ee74b98ed2da776d0da596df6ab6697_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-09_5ee74b98ed2da776d0da596df6ab6697_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 370KB

2026-08-09_5ee74b98ed2da776d0da596df6ab6697_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH e8022ec53fba3898eff54fa0e9898d69
SHA256 18da71729f459581713c0569b5742c9a9828ec5395dd93668797139149767174
MD5 5ee74b98ed2da776d0da596df6ab6697
SHA1 d16d2be37701482a0d11cc3ea9cdb255bcfe1be5
SHA512 66dd5a8beffa63c51a5d20d034b97bebba423fcb79d0e2314f8cfb59cb20cc5de788a24fe8a3adc294396554d92eafd37c34492ffc9ee80c98bf720124d1c8b6
SSDEEP 6144:fjH+qlYw7pLa4zW7kmnrwQVllZSBV+UdvrEFp7hKiF:7H+OYw7pu4zWBnZSBjvrEH7x
TLSH
T10584BE103A90C3F3C507123270D5E77255B9BD7D6BA064CBB38837AA2E792D1AB7531A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

67:94:93:a5:57:a3:5c:98:a9:4e:1b:a0:9e:73:53:39

Digest Algorithm

md5

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Dev Team,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

36:12:22:96:c5:e3:38:a5:20:a1:d2:5f:4c:d7:09:54

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Jan 1, 2021

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Bandisoft,OU=Dev Team,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Serial Number

23:3b:ba:fc:e9:94:ec:7f:e8:d2:ca:56:8f:2a:b6:4b

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Nov 23, 2011 - Feb 21, 2014

Subject

Serial Number

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Dec 30, 2020

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

47834

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\devel\Hobby\Shutdown8\bin\Shutdown8.pdb

kernel32

GetSystemTimeAsFileTime GetFileSize WideCharToMultiByte GetCurrentProcessId TerminateProcess CreateFileA SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle InitializeCriticalSection GetLocaleInfoA GetStringTypeW ReadFile LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount GetTickCount QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA GetFileType SetHandleCount RtlUnwind IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameA GetStdHandle WriteFile HeapCreate ExitProcess Sleep TlsFree TlsSetValue TlsAlloc TlsGetValue IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetProcessHeap HeapSize GetModuleHandleA HeapReAlloc HeapFree HeapAlloc HeapDestroy SetFilePointer CreateFileW GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar EnterCriticalSection RaiseException CloseHandle SetLastError GetCurrentThreadId LoadLibraryW FindResourceExW LockResource GetUserDefaultLangID InterlockedIncrement InterlockedDecrement GetStringTypeA DeleteCriticalSection LeaveCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW FreeLibrary GetLastError FlushInstructionCache GetCurrentProcess

user32

UnregisterClassA SetWindowLongW GetWindowLongW DefWindowProcW GetMenuStringW GetMenuItemID ModifyMenuW GetMenuItemCount GetMenuItemInfoW LoadCursorW CallWindowProcW CharNextW SetFocus LoadMenuW RegisterWindowMessageW EndDialog SetTimer GetDlgItem SetDlgItemTextW SetWindowTextW GetWindow MonitorFromWindow GetMonitorInfoW SetWindowPos LoadIconW DrawTextW EndPaint BeginPaint GetClientRect InvalidateRect SetCursor MapWindowPoints GetParent GetWindowRect GetWindowTextLengthW GetWindowTextW SendMessageW GetSysColor DialogBoxParamW CreateWindowExW GetClassInfoExW RegisterClassExW GetActiveWindow ExitWindowsEx DestroyWindow DestroyMenu TrackPopupMenu EnableMenuItem GetCursorPos GetSubMenu

gdi32

ExtTextOutW SetBkColor SelectObject CreateFontIndirectW GetObjectW DeleteObject CreateSolidBrush SetTextColor

advapi32

RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

ShellExecuteW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

VarUI4FromStr

comctl32

_TrackMouseEvent

powrprof

GetPwrCapabilities SetSuspendState

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_5ee74b98ed2da776d0da596df6ab6697_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

powrprof

generic