2026-08-11_1d6dcace27fb4ad754f929f83f6d8d64_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_1d6dcace27fb4ad754f929f83f6d8d64_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 265KB
Sample260811-d985fafm3t
SHA256 d952c86de75dc8701751fa9e407963464d2a6471916ab759366b086540375619
MD5 1d6dcace27fb4ad754f929f83f6d8d64
SHA1 366101ff03eca8f55faa4e2a27b36368ea8dc54f
SHA512 8af23d7c3c50ca37b310d98063059a45d58c8b2ef47bf4fc476b9fccac2efcaec10ad0c9732bbe756170fd13e2fa3a6b859a58535e9a67f6dd7efc7a02d75a03
SSDEEP 6144:jFNui6PtgZ3+eCJanV8c1BV+UdvrEFp7hKOAW:rIP6ZsaLBjvrEH7rAW
TLSH
T125445A11318083B5E7E6177025ADF66125A9AC7C0B6680CFE2243BBD9D386C39A7735F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-11_1d6dcace27fb4ad754f929f83f6d8d64_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-11_1d6dcace27fb4ad754f929f83f6d8d64_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 265KB

2026-08-11_1d6dcace27fb4ad754f929f83f6d8d64_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 40ce7591cbbe1c7439946deb93831f62
SHA256 d952c86de75dc8701751fa9e407963464d2a6471916ab759366b086540375619
MD5 1d6dcace27fb4ad754f929f83f6d8d64
SHA1 366101ff03eca8f55faa4e2a27b36368ea8dc54f
SHA512 8af23d7c3c50ca37b310d98063059a45d58c8b2ef47bf4fc476b9fccac2efcaec10ad0c9732bbe756170fd13e2fa3a6b859a58535e9a67f6dd7efc7a02d75a03
SSDEEP 6144:jFNui6PtgZ3+eCJanV8c1BV+UdvrEFp7hKOAW:rIP6ZsaLBjvrEH7rAW
TLSH
T125445A11318083B5E7E6177025ADF66125A9AC7C0B6680CFE2243BBD9D386C39A7735F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1a:2c:7c:ac:c0:5a:ad:5b:dd:04:d8:6e:26:11:14:d0:16:18:23:a3

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2012

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:1a:f5:ea:00:00:00:00:00:6a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 1, 2011 - Feb 1, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:15:08:27:00:00:00:00:00:0c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 25, 2006 - Jan 25, 2017

Minor OS version

Major OS version

Entry point

50603

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

BBSvc.pdb

advapi32

StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW SetServiceStatus RegisterServiceCtrlHandlerW RegisterEventSourceW DeregisterEventSource ReportEventW RegCloseKey RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegEnumKeyW ImpersonateSelf LookupPrivilegeValueW AdjustTokenPrivileges CryptGetHashParam CryptHashData CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptReleaseContext OpenServiceW ControlService QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenThreadToken

kernel32

GetProcessHeap GetVersionExW FileTimeToSystemTime DeleteFileW MoveFileW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateFileW GetFileTime GetSystemTime FindResourceExW FindResourceW LoadResource LockResource SizeofResource TerminateThread FileTimeToLocalFileTime lstrcmpA LocalAlloc InterlockedIncrement WaitForMultipleObjects ResetEvent CloseHandle WaitForSingleObject SetEvent EnterCriticalSection LeaveCriticalSection CreateEventW GetLastError FormatMessageW LocalFree RaiseException InterlockedExchange DeleteCriticalSection InitializeCriticalSectionAndSpinCount HeapSetInformation GetCommandLineW lstrlenW GetStartupInfoW RtlUnwind EncodePointer DecodePointer ExitThread GetCurrentThreadId CreateThread SetFileAttributesW GetFileAttributesW GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError InterlockedDecrement GetCurrentThread HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize IsProcessorFeaturePresent HeapAlloc LoadLibraryW GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringW GetStringTypeW SetStdHandle WriteConsoleW FlushFileBuffers GetWindowsDirectoryW RemoveDirectoryW ReadFile Process32NextW Process32FirstW CreateToolhelp32Snapshot OpenEventW OpenProcess SetEndOfFile

user32

CharLowerBuffW

ole32

CoUninitialize CoInitializeSecurity CoRevokeClassObject CoTaskMemFree CoRegisterClassObject CoInitializeEx CoCreateGuid CoCreateInstance

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

shell32

SHFileOperationW ShellExecuteW SHGetFolderPathW

shlwapi

StrStrW PathFileExistsW StrRChrW SHDeleteValueW StrCmpIW

msi

ord190 ord141

wininet

InternetReadFile InternetCloseHandle HttpQueryInfoW InternetCreateUrlW InternetOpenUrlW InternetCrackUrlW InternetOpenW InternetSetOptionW

iphlpapi

IcmpCloseHandle IcmpSendEcho IcmpCreateFile

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSAStartup inet_ntoa freeaddrinfo getaddrinfo WSACleanup

crypt32

CryptMsgGetAndVerifySigner CryptQueryObject CryptMsgClose CryptDecodeObject CryptMsgGetParam CertFreeCertificateChain CryptHashPublicKeyInfo CertVerifyCertificateChainPolicy CertGetCertificateChain CertCloseStore CertFreeCertificateContext

sensapi

IsNetworkAlive

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_1d6dcace27fb4ad754f929f83f6d8d64_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

advapi32

kernel32

user32

ole32

oleaut32

shell32

shlwapi

msi

wininet

iphlpapi

version

ws2_32

crypt32

sensapi

generic