2026-08-14_e4067096d1a095cfe13b9a1fb0e39603_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_e4067096d1a095cfe13b9a1fb0e39603_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 378KB
Sample260814-df8ltatbpg
SHA256 55a00822edab6bba4fd3bcb2e229463f7db509bde5e81b2754979e4776daf55a
MD5 e4067096d1a095cfe13b9a1fb0e39603
SHA1 6262da841d3d55b0be24db6667a74df8cc748cb8
SHA512 eae9710429f05e64fa074e846d1a1ef1654ac53a11408c8236873b03bf856e06ee8d5fdfb275bc821d4f8b34363c180914dab1d8f4c9b6b5cb718effb461849a
SSDEEP 6144:2C1ipawYmVGfLrZGuQTFnrwQVls9HaQBV+UdvrEFp7hKUhcp:2CrwYmVGfnZGuCK9HaQBjvrEH7dh6
TLSH
T18384CF183680C3F3C507123234C8E37155BABEBD6B6164CBB79437AA2E792D2977531A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-14_e4067096d1a095cfe13b9a1fb0e39603_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-14_e4067096d1a095cfe13b9a1fb0e39603_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 378KB

2026-08-14_e4067096d1a095cfe13b9a1fb0e39603_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH bf36acc26b87bd62162559774e73f8e3
SHA256 55a00822edab6bba4fd3bcb2e229463f7db509bde5e81b2754979e4776daf55a
MD5 e4067096d1a095cfe13b9a1fb0e39603
SHA1 6262da841d3d55b0be24db6667a74df8cc748cb8
SHA512 eae9710429f05e64fa074e846d1a1ef1654ac53a11408c8236873b03bf856e06ee8d5fdfb275bc821d4f8b34363c180914dab1d8f4c9b6b5cb718effb461849a
SSDEEP 6144:2C1ipawYmVGfLrZGuQTFnrwQVls9HaQBV+UdvrEFp7hKUhcp:2CrwYmVGfnZGuCK9HaQBjvrEH7dh6
TLSH
T18384CF183680C3F3C507123234C8E37155BABEBD6B6164CBB79437AA2E792D2977531A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c9:40:33:4a:f3:55:0d:8e:33:55:0a:d0:67:cd:0d:6d

Digest Algorithm

md5

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Dev Team,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

36:12:22:96:c5:e3:38:a5:20:a1:d2:5f:4c:d7:09:54

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Jan 1, 2021

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Bandisoft,OU=Dev Team,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Serial Number

23:3b:ba:fc:e9:94:ec:7f:e8:d2:ca:56:8f:2a:b6:4b

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Nov 23, 2011 - Feb 21, 2014

Subject

Serial Number

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Dec 30, 2020

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

51979

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\devel\Hobby\Shutdown8\bin\Shutdown8.pdb

kernel32

ReadFile GetSystemTimeAsFileTime GetFileAttributesW GetFileSize WideCharToMultiByte GetCurrentProcessId TerminateProcess CreateFileA SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers InitializeCriticalSection GetLocaleInfoA GetStringTypeW GetStringTypeA SetFilePointer LCMapStringA GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount GetTickCount QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA GetFileType SetHandleCount RtlUnwind IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameA GetStdHandle WriteFile HeapCreate ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetModuleHandleA CreateFileW GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar EnterCriticalSection RaiseException LeaveCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW FreeLibrary GetLastError CloseHandle SetLastError GetCurrentThreadId LoadLibraryW Sleep lstrcmpW FindResourceExW LockResource GetUserDefaultUILanguage InterlockedIncrement InterlockedDecrement LCMapStringW DeleteCriticalSection FlushInstructionCache SetStdHandle GetCurrentProcess

user32

GetMenuItemCount GetMenuStringW UnregisterClassA SetWindowLongW GetWindowLongW DefWindowProcW GetMenuItemID ModifyMenuW GetMenuItemInfoW RegisterWindowMessageW LoadCursorW CallWindowProcW GetWindowTextW GetWindowRect CharNextW EndDialog SetTimer GetDlgItem SetDlgItemTextW SetWindowTextW GetWindow MonitorFromWindow GetMonitorInfoW LoadIconW SetWindowPos DrawTextW EndPaint BeginPaint GetClientRect InvalidateRect SetCursor MapWindowPoints GetParent GetWindowTextLengthW SendMessageW GetSysColor DialogBoxParamW CreateWindowExW GetClassInfoExW RegisterClassExW GetActiveWindow ExitWindowsEx EnumDesktopWindows SendMessageTimeoutW IsRectEmpty GetClassNameW IsWindowVisible DestroyWindow DestroyMenu TrackPopupMenu EnableMenuItem GetCursorPos GetSubMenu LoadMenuW SetFocus

gdi32

ExtTextOutW SetBkColor SetTextColor CreateFontIndirectW GetObjectW DeleteObject CreateSolidBrush SelectObject

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

VarUI4FromStr

comctl32

_TrackMouseEvent

powrprof

GetPwrCapabilities SetSuspendState

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_e4067096d1a095cfe13b9a1fb0e39603_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

powrprof

generic