2026-08-19_b8c240dbdcce079f033f32f9f9ef6c6c_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_b8c240dbdcce079f033f32f9f9ef6c6c_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 758KB
Sample260819-e7v1gawgrc
SHA256 1da7054f9b98063bfd415e0cf46d4325201364ca29a1fe569c18e7127b406783
MD5 b8c240dbdcce079f033f32f9f9ef6c6c
SHA1 03e502c9dd6a46225f6a185c7d770ef820cce224
SHA512 52c4d740be85a514ec84cdca6ec9f2c9732eb41db08862f5277921e1242c0140eda3b11c25c5d5402c3f7eb8f580c30e4eebff0ea744c288ffa036c02f290f8c
SSDEEP 12288:6xp+/zDl3OYCSrQxOw8pRxt1GLK3V4GYuyZM/lqn6jKigFUOW9VBjvrEH7TvsD:Dw8pDt1E+WGY3MN+6jKiBOIrEH7T0
TLSH
T11FF45A12E298C1A5E42D077756BB8A2064BABC38D73091FF63C936782EF73916431F56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-19_b8c240dbdcce079f033f32f9f9ef6c6c_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-19_b8c240dbdcce079f033f32f9f9ef6c6c_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 758KB

2026-08-19_b8c240dbdcce079f033f32f9f9ef6c6c_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH c5d8b7291a8ac8e4ce8b693cc1cf3219
SHA256 1da7054f9b98063bfd415e0cf46d4325201364ca29a1fe569c18e7127b406783
MD5 b8c240dbdcce079f033f32f9f9ef6c6c
SHA1 03e502c9dd6a46225f6a185c7d770ef820cce224
SHA512 52c4d740be85a514ec84cdca6ec9f2c9732eb41db08862f5277921e1242c0140eda3b11c25c5d5402c3f7eb8f580c30e4eebff0ea744c288ffa036c02f290f8c
SSDEEP 12288:6xp+/zDl3OYCSrQxOw8pRxt1GLK3V4GYuyZM/lqn6jKigFUOW9VBjvrEH7TvsD:Dw8pDt1E+WGY3MN+6jKiBOIrEH7T0
TLSH
T11FF45A12E298C1A5E42D077756BB8A2064BABC38D73091FF63C936782EF73916431F56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

69:4a:3a:2c:a9:95:04:c3:e1:d0:dd:42:1b:35:b0:2f:68:aa:4c:6c:d6:91:4a:2e:84:49:2a:23:68:91:fd:d6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=214-81-83536,CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130b53656f6e676e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

May 14, 2019

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

de:22:c2:c5:cd:9f:64:39:df:64:6d:cf:2f:c8:73:ca:20:67:fa:c3

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Chains

May 14, 2019

CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Serial Number

73:f0:f2:75:70:c0:1f:2f:79:91:7b:37:ca:a0:65:22

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 18, 2019 - Jan 18, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

Serial Number

49:11:57:1b:4d:ef:f6:4c:ba:eb:41:49:ba:d6:67:75

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 2, 2018 - Jul 2, 2019

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

Major OS version

Entry point

271568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

u:\Project\Medicine\Framework\2.5\Trunk\Build\NT32Release\ASDUp.pdb

wtsapi32

WTSQueryUserToken

shlwapi

PathAppendW PathFileExistsW PathRemoveBackslashW StrCmpNIW

kernel32

OutputDebugStringW GetSystemWindowsDirectoryW ExpandEnvironmentStringsW VerifyVersionInfoW VerSetConditionMask CreateProcessW GetModuleHandleW CompareStringW GetLongPathNameW SystemTimeToFileTime FileTimeToSystemTime WideCharToMultiByte GetDriveTypeW FindClose FindFirstFileW CreateDirectoryW RemoveDirectoryW FindNextFileW DeleteFileW GetLogicalDriveStringsW GetFileSizeEx ReleaseMutex GetCurrentThreadId GetSystemTime GetTickCount QueryPerformanceCounter CreateMutexW lstrlenA lstrcmpA LocalAlloc GetModuleHandleA ProcessIdToSessionId GetWindowsDirectoryW GetFullPathNameW WriteFile SetFilePointer GetFullPathNameA CreateFileA GetLocalTime MoveFileExW MoveFileExA GetFileAttributesA DeleteFileA CreateMutexA GetStdHandle HeapAlloc GetProcessHeap GetSystemDirectoryA DuplicateHandle InitializeCriticalSectionAndSpinCount CreateSemaphoreW ReleaseSemaphore PulseEvent CompareFileTime GetVersionExW lstrcpynW LoadLibraryA GetStringTypeA GetLocaleInfoA GetConsoleMode GetConsoleCP SetStdHandle LCMapStringA LCMapStringW GetTimeZoneInformation GetStartupInfoA SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP GetACP GetCPInfo VirtualAlloc VirtualFree HeapCreate WriteConsoleW GetFileSize ReadFile GetCurrentProcess LoadLibraryExW SetFileAttributesW CopyFileW GetSystemDirectoryW GetSystemWow64DirectoryW GetPrivateProfileStringW GetUserDefaultUILanguage GetLogicalDrives QueryDosDeviceW lstrcmpW FindResourceExW LoadResource LockResource SizeofResource FindResourceW GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW OpenProcess GetFileAttributesW GetModuleFileNameW GetComputerNameW SetEvent Sleep CreateFileW WaitForMultipleObjects OpenEventW MultiByteToWideChar CreateFileMappingW SetLastError CreateEventW OpenMutexW ResetEvent OpenFileMappingW MapViewOfFile UnmapViewOfFile lstrlenW GetExitCodeProcess CloseHandle GetProcAddress DeleteCriticalSection InitializeCriticalSection GetModuleFileNameA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetConsoleOutputCP WriteConsoleA FlushFileBuffers EnterCriticalSection LeaveCriticalSection FreeLibrary LoadLibraryW WaitForSingleObject GetCommandLineW LocalFree GetLastError GetStringTypeW CompareStringA HeapFree SetEnvironmentVariableA HeapDestroy HeapReAlloc HeapSize RaiseException RtlUnwind ExitThread CreateThread GetSystemTimeAsFileTime GetStartupInfoW GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement ExitProcess TerminateProcess

user32

SetUserObjectSecurity GetProcessWindowStation OpenWindowStationW SetProcessWindowStation OpenDesktopW CloseDesktop IsCharAlphaW GetUserObjectSecurity GetDesktopWindow GetShellWindow GetForegroundWindow GetWindowRect MonitorFromWindow GetMonitorInfoW IsWindow PostMessageW SendMessageW GetSystemMetrics CharPrevA CharNextA MsgWaitForMultipleObjects CopyRect CloseWindowStation

advapi32

AddAce InitializeSecurityDescriptor GetSecurityDescriptorDacl MakeAbsoluteSD GetSecurityDescriptorControl GetSecurityDescriptorSacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner MakeSelfRelativeSD GetSecurityDescriptorLength RegCloseKey RegOpenKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW LookupAccountSidW LookupAccountNameA GetFileSecurityA SetFileSecurityA LookupAccountNameW GetFileSecurityW EqualSid SetFileSecurityW LookupPrivilegeValueW AdjustTokenPrivileges AddAccessAllowedAce GetAclInformation GetLengthSid InitializeAcl GetAce SetSecurityDescriptorDacl CopySid ImpersonateLoggedOnUser RevertToSelf DuplicateTokenEx SetTokenInformation LogonUserW GetUserNameW RegOpenKeyExA RegQueryValueExA AllocateAndInitializeSid CheckTokenMembership FreeSid CreateProcessAsUserW OpenProcessToken GetTokenInformation RegDeleteValueW

shell32

SHGetFileInfoW ShellExecuteExW CommandLineToArgvW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

crypt32

CertOpenStore CryptMsgUpdate CryptMsgOpenToDecode CertGetNameStringW CryptDecodeObject CryptMsgGetParam CertFindCertificateInStore CertFreeCertificateContext CertVerifySubjectCertificateContext CryptMsgClose CertCloseStore CryptMsgControl CertGetSubjectCertificateFromStore CertFreeCertificateChain CryptQueryObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_b8c240dbdcce079f033f32f9f9ef6c6c_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

PE Signature issue

wtsapi32

shlwapi

kernel32

user32

advapi32

shell32

userenv

crypt32

generic