2026-08-25_d32088c4ee34544593491872bb180bb6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_d32088c4ee34544593491872bb180bb6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 265KB
Sample260826-jp94wscc44
SHA256 77dbcc2a34145e741763b8cdda3b36ffd5bb2498f61b9ab04cbbf90691ea42a8
MD5 d32088c4ee34544593491872bb180bb6
SHA1 8fc3b711885fd6aec7fdd1905ef74c09c5efaf93
SHA512 4d529d5111e31471786a28b8dffb04394dcfd6ebb0a4cf1f0b28c3fe4bbafefe0fb0cea2aacb3adcbd8f260951448c354f020619d6ac9575140271bcd7a4eede
SSDEEP 6144:jFNKi6PtgZYb+ensanV8c1BV+UdvrEFp7hKw1d:rEP6ydsaLBjvrEH77j
TLSH
T104445B11318083F5E7A2177425ADE6A125A9AC7D0B7680CFE2243BBD5D386C39A7335F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-25_d32088c4ee34544593491872bb180bb6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-25_d32088c4ee34544593491872bb180bb6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 265KB

2026-08-25_d32088c4ee34544593491872bb180bb6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 40ce7591cbbe1c7439946deb93831f62
SHA256 77dbcc2a34145e741763b8cdda3b36ffd5bb2498f61b9ab04cbbf90691ea42a8
MD5 d32088c4ee34544593491872bb180bb6
SHA1 8fc3b711885fd6aec7fdd1905ef74c09c5efaf93
SHA512 4d529d5111e31471786a28b8dffb04394dcfd6ebb0a4cf1f0b28c3fe4bbafefe0fb0cea2aacb3adcbd8f260951448c354f020619d6ac9575140271bcd7a4eede
SSDEEP 6144:jFNKi6PtgZYb+ensanV8c1BV+UdvrEFp7hKw1d:rEP6ydsaLBjvrEH77j
TLSH
T104445B11318083F5E7A2177425ADE6A125A9AC7D0B7680CFE2243BBD5D386C39A7335F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

85:27:4f:4b:eb:22:72:7b:c4:39:98:37:72:1e:19:64:63:c4:0e:5c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2012

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:1a:f5:ea:00:00:00:00:00:6a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 1, 2011 - Feb 1, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:15:08:27:00:00:00:00:00:0c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 25, 2006 - Jan 25, 2017

Minor OS version

Major OS version

Entry point

50603

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

BBSvc.pdb

advapi32

StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW SetServiceStatus RegisterServiceCtrlHandlerW RegisterEventSourceW DeregisterEventSource ReportEventW RegCloseKey RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegEnumKeyW ImpersonateSelf LookupPrivilegeValueW AdjustTokenPrivileges CryptGetHashParam CryptHashData CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptReleaseContext OpenServiceW ControlService QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenThreadToken

kernel32

GetProcessHeap GetVersionExW FileTimeToSystemTime DeleteFileW MoveFileW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateFileW GetFileTime GetSystemTime FindResourceExW FindResourceW LoadResource LockResource SizeofResource TerminateThread FileTimeToLocalFileTime lstrcmpA LocalAlloc InterlockedIncrement WaitForMultipleObjects ResetEvent CloseHandle WaitForSingleObject SetEvent EnterCriticalSection LeaveCriticalSection CreateEventW GetLastError FormatMessageW LocalFree RaiseException InterlockedExchange DeleteCriticalSection InitializeCriticalSectionAndSpinCount HeapSetInformation GetCommandLineW lstrlenW GetStartupInfoW RtlUnwind EncodePointer DecodePointer ExitThread GetCurrentThreadId CreateThread SetFileAttributesW GetFileAttributesW GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError InterlockedDecrement GetCurrentThread HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize IsProcessorFeaturePresent HeapAlloc LoadLibraryW GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringW GetStringTypeW SetStdHandle WriteConsoleW FlushFileBuffers GetWindowsDirectoryW RemoveDirectoryW ReadFile Process32NextW Process32FirstW CreateToolhelp32Snapshot OpenEventW OpenProcess SetEndOfFile

user32

CharLowerBuffW

ole32

CoUninitialize CoInitializeSecurity CoRevokeClassObject CoTaskMemFree CoRegisterClassObject CoInitializeEx CoCreateGuid CoCreateInstance

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

shell32

SHFileOperationW ShellExecuteW SHGetFolderPathW

shlwapi

StrStrW PathFileExistsW StrRChrW SHDeleteValueW StrCmpIW

msi

ord190 ord141

wininet

InternetReadFile InternetCloseHandle HttpQueryInfoW InternetCreateUrlW InternetOpenUrlW InternetCrackUrlW InternetOpenW InternetSetOptionW

iphlpapi

IcmpCloseHandle IcmpSendEcho IcmpCreateFile

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSAStartup inet_ntoa freeaddrinfo getaddrinfo WSACleanup

crypt32

CryptMsgGetAndVerifySigner CryptQueryObject CryptMsgClose CryptDecodeObject CryptMsgGetParam CertFreeCertificateChain CryptHashPublicKeyInfo CertVerifyCertificateChainPolicy CertGetCertificateChain CertCloseStore CertFreeCertificateContext

sensapi

IsNetworkAlive

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_d32088c4ee34544593491872bb180bb6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

advapi32

kernel32

user32

ole32

oleaut32

shell32

shlwapi

msi

wininet

iphlpapi

version

ws2_32

crypt32

sensapi

generic