2026-08-09_f204aec2a07a9cdf6b034c46bc548a89_elex_maze_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_f204aec2a07a9cdf6b034c46bc548a89_elex_maze_rhadamanthys_smoke-loader_stop
Size 157KB
Sample260809-x3d59sthqf
SHA256 4ce53a09657c49c92cd2e02e7d7f89c3544b83e5437cfeaa760560c23f7bdf61
MD5 f204aec2a07a9cdf6b034c46bc548a89
SHA1 d2dc92873f52268e48c5bef6e3d0180a6c92dacc
SHA512 90f6efe78a3a6a49b1a1c0ef43515c362c9ee901e59a7d3eaea62f8bf71621013cc5dc8ea7da45d74d3e4e5824d0ec97efde724be093104b908f63859ffc9bcf
SSDEEP 3072:FMccnLDclGXQgjoZkwUlKmgynLcxMfT3VJO4Dt1:FMccnLDc4kQ11nOqH
TLSH
T1F7F36B123AD080B2F9E3067259B8EA66193EFA314F7495CB7794064E1DB4BC0AF35763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-09_f204aec2a07a9cdf6b034c46bc548a89_elex_maze_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_f204aec2a07a9cdf6b034c46bc548a89_elex_maze_rhadamanthys_smoke-loader_stop

.exe 157KB

2026-08-09_f204aec2a07a9cdf6b034c46bc548a89_elex_maze_rhadamanthys_smoke-loader_stop

IMPHASH 64886f78670251e66c4f65312794a0ea
SHA256 4ce53a09657c49c92cd2e02e7d7f89c3544b83e5437cfeaa760560c23f7bdf61
MD5 f204aec2a07a9cdf6b034c46bc548a89
SHA1 d2dc92873f52268e48c5bef6e3d0180a6c92dacc
SHA512 90f6efe78a3a6a49b1a1c0ef43515c362c9ee901e59a7d3eaea62f8bf71621013cc5dc8ea7da45d74d3e4e5824d0ec97efde724be093104b908f63859ffc9bcf
SSDEEP 3072:FMccnLDclGXQgjoZkwUlKmgynLcxMfT3VJO4Dt1:FMccnLDc4kQ11nOqH
TLSH
T1F7F36B123AD080B2F9E3067259B8EA66193EFA314F7495CB7794064E1DB4BC0AF35763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

83:f1:d2:ef:20:17:b9:7c:04:93:45:bb:a5:07:bb:54:93:3e:cf:37

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=KROMTECH ALLIANCE CORP,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=KROMTECH ALLIANCE CORP,L=Road Town,ST=Tortola,C=VG

Chains

Mar 4, 2015

CN=KROMTECH ALLIANCE CORP,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=KROMTECH ALLIANCE CORP,L=Road Town,ST=Tortola,C=VG

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=KROMTECH ALLIANCE CORP,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=KROMTECH ALLIANCE CORP,L=Road Town,ST=Tortola,C=VG

Serial Number

58:48:91:ed:f8:31:a6:e0:b8:79:2e:90:74:45:ed:ee

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 30, 2014 - Jun 29, 2015

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

47389

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\f8d2b5196136d2ec\Release\Win32\PCKeeperService.pdb

kernel32

LoadLibraryW MultiByteToWideChar lstrcmpiW LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetCurrentThreadId FlushFileBuffers CreateThread Sleep CreateEventW WaitForSingleObject SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RaiseException CloseHandle DecodePointer GetCommandLineW FindResourceW SizeofResource LockResource LoadResource GetModuleHandleExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP GetCPInfo GetOEMCP FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetFileType GetStdHandle GetACP IsValidCodePage InitializeCriticalSectionAndSpinCount GetLocalTime InterlockedCompareExchange WriteFile OutputDebugStringW DeleteFileW MoveFileExW CreateDirectoryW GetFileAttributesW CreateFileW SetCriticalSectionSpinCount GetVersionExW LocalFree LocalAlloc EncodePointer RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent ExitThread ExitProcess WideCharToMultiByte SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW

user32

LoadStringW GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW CharUpperW CharNextW GetMessageA DispatchMessageA PeekMessageW MsgWaitForMultipleObjectsEx IsWindowUnicode

advapi32

StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptReleaseContext CryptDestroyKey CryptAcquireContextW CryptExportKey CryptGenKey CryptImportKey CryptEncrypt FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor AllocateAndInitializeSid SetEntriesInAclW

shell32

SHGetFolderPathW

ole32

CoTaskMemFree CoUninitialize CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoInitializeSecurity CoCreateInstance StringFromGUID2 CoTaskMemAlloc StringFromCLSID CoCreateGuid CoTaskMemRealloc

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysFreeString SysAllocString

shlwapi

PathAppendW PathRemoveFileSpecW PathStripPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_f204aec2a07a9cdf6b034c46bc548a89_elex_maze_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic