2026-08-09_457a9e967a318e4b8428afe8dc85b7c1_elex_floxif_hijackloader_manuscrypt_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_457a9e967a318e4b8428afe8dc85b7c1_elex_floxif_hijackloader_manuscrypt_rhadamanthys_stop
Size 208KB
Sample260809-hn4p2sbj91
SHA256 a3eeabbc5f9bdc2a137d1f9bedf285d186a552968a58aec5c6ae09895eaf4a1a
MD5 457a9e967a318e4b8428afe8dc85b7c1
SHA1 9c0cd7e9f0a4a008817b217752a8b70980aaa06f
SHA512 c432bef8102487414b18205ecb935ef46d6d696316f49bcf0f170955fe0263a3847864d170fb5b7cd36dcc900ebc31ce14749b19463e0233a916d9049e625ed5
SSDEEP 6144:7MQlUODkgL0ZvgvJV4BV+UdvrEFp7hKizcr:Nl3DkgAZ+JKBjvrEH7dI
TLSH
T19024A001BE43C3FAD4191834346866615AE5EC3D17BFD5D3B70172986E3E2C28AFA25B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_457a9e967a318e4b8428afe8dc85b7c1_elex_floxif_hijackloader_manuscrypt_rhadamanthys_stop

File Explorer

2026-08-09_457a9e967a318e4b8428afe8dc85b7c1_elex_floxif_hijackloader_manuscrypt_rhadamanthys_stop

.exe 208KB

2026-08-09_457a9e967a318e4b8428afe8dc85b7c1_elex_floxif_hijackloader_manuscrypt_rhadamanthys_stop

IMPHASH 3e608b2e66d52e6227b10c83e4154f29
SHA256 a3eeabbc5f9bdc2a137d1f9bedf285d186a552968a58aec5c6ae09895eaf4a1a
MD5 457a9e967a318e4b8428afe8dc85b7c1
SHA1 9c0cd7e9f0a4a008817b217752a8b70980aaa06f
SHA512 c432bef8102487414b18205ecb935ef46d6d696316f49bcf0f170955fe0263a3847864d170fb5b7cd36dcc900ebc31ce14749b19463e0233a916d9049e625ed5
SSDEEP 6144:7MQlUODkgL0ZvgvJV4BV+UdvrEFp7hKizcr:Nl3DkgAZ+JKBjvrEH7dI
TLSH
T19024A001BE43C3FAD4191834346866615AE5EC3D17BFD5D3B70172986E3E2C28AFA25B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1c:79:7e:38:3b:f2:28:2a:42:4d:de:10:c0:30:79:75:26:18:10:e4

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=1461834,CN=R-Tools Technology Inc.,OU=R-Tools Technology Inc.,O=R-Tools Technology Inc.,STREET=10520 Yonge St Suite 232,L=Richmond Hill,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c0f6f666669636540722d74742e636f6d,1.3.6.1.4.1.311.60.2.1.2=#13074f6e746172696f,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 21, 2023

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

Serial Number

3c:51:60:d1:6c:97:ef:8c:ed:f0:3c:bc

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 30, 2021 - Mar 30, 2024

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

30228

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetExitCodeProcess CreateProcessW GetTickCount QueryPerformanceCounter GetCurrentProcessId GetVersion EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError WriteFile FlushFileBuffers GetModuleFileNameA FindClose SetFilePointer FindNextFileA FindFirstFileA FindFirstFileW FindNextFileW CreateFileA MultiByteToWideChar WideCharToMultiByte GetSystemDirectoryW GetSystemDirectoryA GetSystemInfo GetVersionExA GetCurrentThreadId RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException HeapFree HeapAlloc HeapReAlloc InterlockedIncrement InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree GetSystemTimeAsFileTime VirtualAlloc HeapSize LCMapStringA LCMapStringW GetLocaleInfoA GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CopyFileW CreateFileW DeleteFileW GetLastError GetModuleHandleA GetCurrentProcess GetProcAddress DeviceIoControl ReleaseMutex WaitForSingleObject CloseHandle CreateMutexW FreeLibrary SetErrorMode LoadLibraryA GetModuleFileNameW Sleep

advapi32

SetServiceStatus DeleteService CloseServiceHandle OpenServiceW OpenSCManagerW RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW CreateServiceW DeregisterEventSource ReportEventW RegisterEventSourceW QueryServiceConfigW ChangeServiceConfigW OpenProcessToken AdjustTokenPrivileges RegCloseKey RegQueryValueExA RegOpenKeyExA LookupPrivilegeValueA

user32

GetSystemMetrics

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_457a9e967a318e4b8428afe8dc85b7c1_elex_floxif_hijackloader_manuscrypt_rhadamanthys_stop

PE Signature issue

kernel32

advapi32

user32

generic