2026-08-14_c03d934c891cd14b35fe24266f7ac971_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_c03d934c891cd14b35fe24266f7ac971_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop
Size 420KB
Sample260814-dvbwdstvbx
SHA256 59c37478baf7a43ac3c1de7813055d9f92fe19854ce6c0db1e55a5c7887618dc
MD5 c03d934c891cd14b35fe24266f7ac971
SHA1 880e222846e933bd91842b22ee274502f63c7e69
SHA512 422f20e50d4cac08a68420fb7e1d47ebc04ba31b724cff82f8975ff9e121b03cf7c866f87928721e91173613de3a437bfbb1871215e145711483cc71beb0914a
SSDEEP 6144:BNZtWjlb+99HAOgAOr+Z2K/lTDaBV+UdvrEFp7hKiWP:Blk+99HuZJQlKBjvrEH7VWP
TLSH
T18794288122E286EAD4E1013238A75671F7E65DFF366987AF93C5330D4A3B3C1D6205B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-14_c03d934c891cd14b35fe24266f7ac971_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-14_c03d934c891cd14b35fe24266f7ac971_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop

.exe 420KB

2026-08-14_c03d934c891cd14b35fe24266f7ac971_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop

IMPHASH 9fa53d4199590ac4cbaaa1467c247a0b
SHA256 59c37478baf7a43ac3c1de7813055d9f92fe19854ce6c0db1e55a5c7887618dc
MD5 c03d934c891cd14b35fe24266f7ac971
SHA1 880e222846e933bd91842b22ee274502f63c7e69
SHA512 422f20e50d4cac08a68420fb7e1d47ebc04ba31b724cff82f8975ff9e121b03cf7c866f87928721e91173613de3a437bfbb1871215e145711483cc71beb0914a
SSDEEP 6144:BNZtWjlb+99HAOgAOr+Z2K/lTDaBV+UdvrEFp7hKiWP:Blk+99HuZJQlKBjvrEH7VWP
TLSH
T18794288122E286EAD4E1013238A75671F7E65DFF366987AF93C5330D4A3B3C1D6205B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

25:ea:aa:e9:14:61:d8:4b:b9:94:a5:32:a4:23:2a:bc:0a:3d:e7:d1:10:4a:54:c4:be:5f:c8:83:36:15:11:6f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Acer Incorporated,O=Acer Incorporated,L=Taipei,ST=Taipei,C=TW

Chains

Sep 27, 2019

CN=Acer Incorporated,O=Acer Incorporated,L=Taipei,ST=Taipei,C=TW

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=Acer Incorporated,O=Acer Incorporated,L=Taipei,ST=Taipei,C=TW

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Acer Incorporated,O=Acer Incorporated,L=Taipei,ST=Taipei,C=TW

Serial Number

4e:5f:9e:b5:cf:61:50:a7:58:6f:dd:a0

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 16, 2018 - Oct 3, 2020

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Minor OS version

Major OS version

Entry point

40948

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\localadmin\Desktop\QuickAccessV2\Bin\Release\Plugins\LumiFlex\SunlightReading.pdb

kernel32

CloseHandle ReleaseMutex CreateMutexW Sleep CreateThread SuspendThread ResumeThread OpenProcess GetModuleFileNameA GetSystemPowerStatus CreateFileW QueryDosDeviceW FreeLibrary GetProcAddress LoadLibraryA LocalFree ReadConsoleW ReadFile WriteConsoleW FlushFileBuffers SetStdHandle GetConsoleMode DeleteCriticalSection LCMapStringW LoadLibraryExW HeapReAlloc GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionEx GetLastError RaiseException GetConsoleCP DecodePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter SetFilePointerEx GetStartupInfoW GetFileType GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetModuleFileNameW WriteFile GetStdHandle GetCurrentThreadId SetEndOfFile SetLastError IsProcessorFeaturePresent GetProcessHeap HeapSize WideCharToMultiByte MultiByteToWideChar AreFileApisANSI GetModuleHandleExW ExitProcess GetCommandLineA IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection EncodePointer HeapFree RtlUnwind HeapAlloc

user32

PostMessageW GetMessageW SetTimer DispatchMessageW RegisterPowerSettingNotification UnregisterPowerSettingNotification DefWindowProcW TranslateMessage QueryDisplayConfig PostQuitMessage UnhookWinEvent SetWinEventHook EnumDisplayMonitors DestroyCursor LoadCursorW GetWindowThreadProcessId GetClassNameW FindWindowW AdjustWindowRect GetWindowRect GetWindowTextW GetDC GetForegroundWindow UpdateWindow GetSystemMetrics KillTimer ShowWindow CreateWindowExW RegisterClassExW GetDisplayConfigBufferSizes

advapi32

RegOpenKeyExW RegEnumKeyExW RegCloseKey RegQueryValueExW

shell32

SHAppBarMessage

ole32

CoCreateInstance CoInitialize CoSetProxyBlanket CLSIDFromProgID CoUninitialize CoInitializeEx PropVariantClear

oleaut32

VariantInit VariantClear SysAllocString SysFreeString

shlwapi

PathRemoveFileSpecA StrStrW

wtsapi32

WTSUnRegisterSessionNotification

powrprof

PowerReadACValueIndex PowerReadDCValueIndex PowerGetActiveScheme

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_c03d934c891cd14b35fe24266f7ac971_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

powrprof

generic