2026-09-21_b0f3334973ed7a02e4400b3b61bcf7aa_elex_floxif_rhadamanthys_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_b0f3334973ed7a02e4400b3b61bcf7aa_elex_floxif_rhadamanthys_stealc_stop
Size 489KB
Sample260922-mtckzacc92
SHA256 6494e034495235bdc279e9f74b36d52d4f74003ed293552eda42e8abef1f8274
MD5 b0f3334973ed7a02e4400b3b61bcf7aa
SHA1 570a77160743e62bf92149f770b79ca8ee27d1ec
SHA512 709591366cc3d157826f9b500dfee6780e60bb45008d86bda447ae00c91205c0c1076b5c2d91276f50fd149624564ff4c8414faa82b647bbc83cd288e32ab2e7
SSDEEP 6144:BgMYVxlNuqPZIVtXN9p7mlTeGrycLFO6Je9LPrpg8m8SeOgBV+UdvrEFp7hKDOK:gYVtXN9pql6GrychxJUrm8hBBjvrEH7s
TLSH
T1F7B4AF0132C0C7F6D126183175E4A2356AFA3C366E7656CEA33D377E9F382A14729E46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-21_b0f3334973ed7a02e4400b3b61bcf7aa_elex_floxif_rhadamanthys_stealc_stop

File Explorer

2026-09-21_b0f3334973ed7a02e4400b3b61bcf7aa_elex_floxif_rhadamanthys_stealc_stop

.exe 489KB

2026-09-21_b0f3334973ed7a02e4400b3b61bcf7aa_elex_floxif_rhadamanthys_stealc_stop

IMPHASH a8316304ac1c3781225c7edc7f160bd4
SHA256 6494e034495235bdc279e9f74b36d52d4f74003ed293552eda42e8abef1f8274
MD5 b0f3334973ed7a02e4400b3b61bcf7aa
SHA1 570a77160743e62bf92149f770b79ca8ee27d1ec
SHA512 709591366cc3d157826f9b500dfee6780e60bb45008d86bda447ae00c91205c0c1076b5c2d91276f50fd149624564ff4c8414faa82b647bbc83cd288e32ab2e7
SSDEEP 6144:BgMYVxlNuqPZIVtXN9p7mlTeGrycLFO6Je9LPrpg8m8SeOgBV+UdvrEFp7hKDOK:gYVtXN9pql6GrychxJUrm8hBBjvrEH7s
TLSH
T1F7B4AF0132C0C7F6D126183175E4A2356AFA3C366E7656CEA33D377E9F382A14729E46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

29:bd:a6:8a:7a:cc:73:0a:b6:6e:13:42:21:1a:56:48:66:1c:6e:bd:ce:af:47:81:24:2b:cc:51:ea:39:9c:b4

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=110111-3940221,CN=FORCS Co.\, Ltd.,O=FORCS Co.\, Ltd.,STREET=646 Nonhyeon-ro,L=Gangnam-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 2, 2023

Subject

Serial Number

21:01:64:87:11:25:75:16:27:ad:25:b4

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 10, 2023 - May 8, 2026

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

77805

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\OZSOURCE80\misc\OZWebLauncher\OZWLService\Release\OZWLService.pdb

kernel32

HeapFree HeapReAlloc RtlUnwind RaiseException ExitProcess HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeFormatA GetDateFormatA GetTimeZoneInformation GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapAlloc VirtualFree QueryPerformanceCounter VirtualAlloc InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetSystemTimeAsFileTime GetFileTime GetFileSizeEx GetFileAttributesW GlobalFindAtomW LoadLibraryA GetVersionExA GlobalAddAtomW GlobalFlags WritePrivateProfileStringW TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection GetCurrentProcessId CompareStringW InterlockedIncrement CreateFileW GetFullPathNameW GetVolumeInformationW GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile LoadLibraryW FindFirstFileW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FindClose SetErrorMode GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange lstrcmpW lstrlenA lstrcmpA FreeLibrary InterlockedDecrement SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW lstrlenW WideCharToMultiByte MultiByteToWideChar GetTempPathW GetTickCount GetModuleHandleW GetCommandLineW GetModuleFileNameW TerminateProcess OpenProcess GetExitCodeProcess ResumeThread CreateProcessW CloseHandle Process32NextW ProcessIdToSessionId Process32FirstW CreateToolhelp32Snapshot Sleep FindResourceW LoadResource LockResource SizeofResource LocalAlloc GetLastError GetModuleHandleA GetProcAddress LocalFree

user32

DestroyMenu ShowWindow RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect SetWindowTextW ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetCursor SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect GetWindowThreadProcessId SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowTextW CharUpperW GetSystemMetrics PostMessageW PostQuitMessage UnhookWindowsHookEx GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu RegisterClassW

gdi32

TextOutW RectVisible PtVisible GetStockObject DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape GetDeviceCaps DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegSetValueExW RegEnumKeyW RegDeleteKeyW RegQueryValueW RegCreateKeyExW RegOpenKeyW DeregisterEventSource ReportEventW RegisterEventSourceW StartServiceCtrlDispatcherW DeleteService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerExW CreateProcessAsUserW DuplicateTokenEx GetTokenInformation RegCloseKey RegQueryValueExW RegOpenKeyExW

shlwapi

PathStripToRootW PathIsUNCW PathFindFileNameW PathFindExtensionW

oleaut32

VariantInit VariantClear VariantChangeType

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken

ws2_32

WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_b0f3334973ed7a02e4400b3b61bcf7aa_elex_floxif_rhadamanthys_stealc_stop

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oleaut32

userenv

wtsapi32

ws2_32

generic