2026-08-09_c7ffb7fee657fbb777d705b9f61a2e1a_elex_floxif_rhadamanthys_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_c7ffb7fee657fbb777d705b9f61a2e1a_elex_floxif_rhadamanthys_stealc_stop
Size 471KB
Sample260809-tfexhatyev
SHA256 54ecf5432c4ec2db1c672807946a20b501749ee6412f65927cd9d6a316aa89f0
MD5 c7ffb7fee657fbb777d705b9f61a2e1a
SHA1 771ba7bdd1c0fb5b97e6ef5b596e1494f04ffd3a
SHA512 2f4c53da1e9c57581b6d6f937b22414d16118f0a4a6d3f04426262bc07e8ef223db0eb01bb69de0357aba134b8de0480e417ce74af53bb28ebfab55e1d29072f
SSDEEP 12288:EL0foNB7tb7qJe5ZmvQtLo5zYx3MjBjvrEH7R9:KqymItssM5rEH7R9
TLSH
T1A9A4B01232D0C3F6D025143135D592315BEABC396E7246CB6B2A3B7DCF386A2972D74A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_c7ffb7fee657fbb777d705b9f61a2e1a_elex_floxif_rhadamanthys_stealc_stop

File Explorer

2026-08-09_c7ffb7fee657fbb777d705b9f61a2e1a_elex_floxif_rhadamanthys_stealc_stop

.exe 471KB

2026-08-09_c7ffb7fee657fbb777d705b9f61a2e1a_elex_floxif_rhadamanthys_stealc_stop

IMPHASH f4346d48ba4cd641b8c87550ab67d092
SHA256 54ecf5432c4ec2db1c672807946a20b501749ee6412f65927cd9d6a316aa89f0
MD5 c7ffb7fee657fbb777d705b9f61a2e1a
SHA1 771ba7bdd1c0fb5b97e6ef5b596e1494f04ffd3a
SHA512 2f4c53da1e9c57581b6d6f937b22414d16118f0a4a6d3f04426262bc07e8ef223db0eb01bb69de0357aba134b8de0480e417ce74af53bb28ebfab55e1d29072f
SSDEEP 12288:EL0foNB7tb7qJe5ZmvQtLo5zYx3MjBjvrEH7R9:KqymItssM5rEH7R9
TLSH
T1A9A4B01232D0C3F6D025143135D592315BEABC396E7246CB6B2A3B7DCF386A2972D74A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

59:5f:f1:30:ad:07:b7:51:6d:3f:fa:27:4f:3d:4a:6d:25:e0:50:9e:7b:a8:92:36:c6:d7:2d:ae:d9:dd:38:7a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-3940221,CN=FORCS Co.\,LTD.,O=FORCS Co.\,LTD.,L=Gangnam District,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Oct 28, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

05:58:91:e2:90:ec:3c:0b:9c:fa:65:5e:dc:e0:90:16

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 9, 2025 - Jul 11, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

79863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\ozsource\misc\OZWebLauncher\OZWLService\Release\OZWAService.pdb

kernel32

HeapFree HeapReAlloc RtlUnwind RaiseException ExitProcess HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeFormatA GetDateFormatA GetTimeZoneInformation GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapAlloc VirtualFree QueryPerformanceCounter VirtualAlloc InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetSystemTimeAsFileTime GetFileTime GetFileSizeEx GlobalFindAtomW LoadLibraryA GetVersionExA GlobalAddAtomW GlobalFlags WritePrivateProfileStringW TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection GetCurrentProcessId CompareStringW InterlockedIncrement CreateFileW GetFullPathNameW GetVolumeInformationW GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile FindFirstFileW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FindClose SetErrorMode GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW LoadLibraryW CompareStringA InterlockedExchange lstrcmpW lstrlenA lstrcmpA FreeLibrary InterlockedDecrement SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW lstrlenW WideCharToMultiByte MultiByteToWideChar CreateDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetTickCount GetModuleHandleW GetCommandLineW GetModuleFileNameW TerminateProcess OpenProcess GetExitCodeProcess ResumeThread CreateProcessW CloseHandle Process32NextW ProcessIdToSessionId Process32FirstW CreateToolhelp32Snapshot Sleep FindResourceW LoadResource LockResource SizeofResource LocalAlloc GetLastError GetModuleHandleA GetProcAddress LocalFree

user32

DestroyMenu ShowWindow RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect SetWindowTextW ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetCursor SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect GetWindowThreadProcessId SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowTextW CharUpperW GetSystemMetrics PostMessageW PostQuitMessage UnhookWindowsHookEx GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu RegisterClassW

gdi32

TextOutW RectVisible PtVisible GetStockObject DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape GetDeviceCaps DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegSetValueExW RegEnumKeyW RegDeleteKeyW RegQueryValueW RegCreateKeyExW RegOpenKeyW DeregisterEventSource ReportEventW RegisterEventSourceW StartServiceCtrlDispatcherW DeleteService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerExW CreateProcessAsUserW GetTokenInformation DuplicateTokenEx RegCloseKey RegQueryValueExW RegOpenKeyExW

shlwapi

PathStripToRootW PathIsUNCW PathFindExtensionW PathFindFileNameW

oleaut32

VariantInit VariantClear VariantChangeType

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken

ws2_32

WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_c7ffb7fee657fbb777d705b9f61a2e1a_elex_floxif_rhadamanthys_stealc_stop

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oleaut32

userenv

wtsapi32

ws2_32

generic