2026-08-09_028a56b6a315acd4ea0c308c473894ec_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_028a56b6a315acd4ea0c308c473894ec_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 271KB
Sample260809-hxbevsshkc
SHA256 67268dda955e687fe7dd2b85ce40c0374674a5bf63e5605375d5867e13a00fc4
MD5 028a56b6a315acd4ea0c308c473894ec
SHA1 4930b1bfe9ff921d96572119cf2dd4f09f6337cf
SHA512 cd409883191b5280866f9633b374fad055af1fd64d4b3e1e4c1e5afdd0269d65ee25414b51a765d68202f3f6a770e9cd687708134d344eaece441a35ccfd960b
SSDEEP 6144:Ir2QvrayL6G9ykUdKBpolQlBV+UdvrEFp7hKr:InaU+k7DzlBjvrEH7M
TLSH
T1BD44BE627280C3FAD05B007474A9DBB5A9B5BD3D0B2640C7B3D01A592F7D6E29B3970B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_028a56b6a315acd4ea0c308c473894ec_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-09_028a56b6a315acd4ea0c308c473894ec_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 271KB

2026-08-09_028a56b6a315acd4ea0c308c473894ec_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH c510dea76f6096f5cfe2c672a3e799c1
SHA256 67268dda955e687fe7dd2b85ce40c0374674a5bf63e5605375d5867e13a00fc4
MD5 028a56b6a315acd4ea0c308c473894ec
SHA1 4930b1bfe9ff921d96572119cf2dd4f09f6337cf
SHA512 cd409883191b5280866f9633b374fad055af1fd64d4b3e1e4c1e5afdd0269d65ee25414b51a765d68202f3f6a770e9cd687708134d344eaece441a35ccfd960b
SSDEEP 6144:Ir2QvrayL6G9ykUdKBpolQlBV+UdvrEFp7hKr:InaU+k7DzlBjvrEH7M
TLSH
T1BD44BE627280C3FAD05B007474A9DBB5A9B5BD3D0B2640C7B3D01A592F7D6E29B3970B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8f:4c:99:54:dc:d3:09:0d:e6:34:d7:8b:b9:22:1c:a7:07:d6:07:93

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 28, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:94:2d:00:00:00:00:00:09

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

Major OS version

Entry point

36820

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\src\Tcpview\Release\Tcpvcon.pdb

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

ws2_32

socket closesocket gethostbyname send gethostname recv ntohl htonl htons ntohs getservbyport gethostbyaddr WSAGetLastError connect WSAStartup

iphlpapi

GetTcpTable GetUdpTable SetTcpEntry

comctl32

CreateToolbarEx ord17 ImageList_ReplaceIcon ImageList_Create ord6

psapi

GetModuleFileNameExA

kernel32

CreateEventA GetSystemDirectoryA DeviceIoControl GetModuleFileNameA DuplicateHandle GetVersion GetCurrentProcessId DeleteFileA GetLocaleInfoA InterlockedIncrement InterlockedDecrement HeapFree GlobalLock WaitForSingleObject SetEvent GetTickCount GetProcessHeap GetNumberFormatA FormatMessageA GetUserDefaultLangID InitializeCriticalSection GlobalAlloc LeaveCriticalSection TerminateProcess GlobalUnlock EnterCriticalSection GlobalReAlloc ExpandEnvironmentStringsA GetStringTypeW GetStringTypeA SetStdHandle WriteConsoleW WriteConsoleA InitializeCriticalSectionAndSpinCount SetFilePointer GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA RaiseException ReadProcessMemory FlushFileBuffers GetStartupInfoA GetFileType SetHandleCount GetStdHandle ExitProcess Sleep VirtualAlloc DeleteCriticalSection VirtualFree HeapCreate LCMapStringW MultiByteToWideChar LCMapStringA GetCurrentThreadId TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleW IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP WideCharToMultiByte WriteFile RtlUnwind GetCommandLineA HeapReAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateThread ResumeThread ExitThread HeapAlloc SetEndOfFile ReadFile OpenProcess LocalFree LocalAlloc LoadLibraryA GetCommandLineW CloseHandle GetModuleHandleA LockResource GetProcAddress SetLastError GetLastError SizeofResource GetCurrentProcess LoadResource FindResourceA CreateFileA HeapSize lstrlenA GetConsoleOutputCP

user32

ScreenToClient SetTimer CloseClipboard DestroyWindow GetWindowRect PostQuitMessage TrackPopupMenu IsIconic FillRect SetCapture KillTimer IsZoomed DrawTextA GetSubMenu DrawIconEx LoadStringA GetFocus LoadMenuA LoadIconA InvalidateRgn GetClientRect CreateMenu SetFocus GetDC ChildWindowFromPoint GetMenu SetWindowLongA InvalidateRect GetWindowLongA ClientToScreen ReleaseDC EnableMenuItem EmptyClipboard DefWindowProcA GetSysColor SetWindowPos GetCursorPos ShowWindow DrawMenuBar PostMessageA OpenClipboard ReleaseCapture GetSystemMetrics InsertMenuA SetClipboardData CallWindowProcA SetMenuItemInfoA DialogBoxParamA DestroyIcon SetDlgItemTextA CheckMenuItem MoveWindow MessageBoxA SetCursor SendMessageA InflateRect GetDlgItem EndDialog GetSysColorBrush SetWindowTextA DialogBoxIndirectParamA LoadCursorA CreateWindowExA GetParent

gdi32

StartDocA SetMapMode GetDeviceCaps SetTextColor CreateFontIndirectA SetBkColor SetBkMode DeleteObject SelectObject CreateCompatibleDC GetBkColor GetTextMetricsA GetObjectA GetStockObject CreateSolidBrush EndPage StartPage EndDoc

comdlg32

ChooseFontA PrintDlgA GetSaveFileNameA

advapi32

GetTokenInformation RegQueryValueExA RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueA RegCreateKeyA RegDeleteKeyA RegSetValueExA OpenProcessToken EqualSid AllocateAndInitializeSid FreeSid RegOpenKeyA RegOpenKeyExA

shell32

ShellExecuteExA SHGetFileInfoA ShellExecuteA

oleaut32

VariantClear SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_028a56b6a315acd4ea0c308c473894ec_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

PE Signature issue

version

ws2_32

iphlpapi

comctl32

psapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

oleaut32

generic