2026-09-22_f8416e40d8fe6300720f3bcdf7e3a9f1_elex_floxif_maze_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-22_f8416e40d8fe6300720f3bcdf7e3a9f1_elex_floxif_maze_rhadamanthys_smoke-loader_stealc_stop
Size 810KB
Sample260922-tp7c4sts7m
SHA256 59b339c2a30abf671c036240a04b797a8296989bcb2e653ffe23c6e98a4229d7
MD5 f8416e40d8fe6300720f3bcdf7e3a9f1
SHA1 a8a691b3b4ae0b8b69ea34894a75296632c0c971
SHA512 29f6a3c1598516255200d0fd4da07dcae73a6811c052ff15d394c97c24e7a3e4ae47fac28757ad82e2e390ff8c24b57e7d4c88a88f8c7dfb110c3722077c5707
SSDEEP 12288:9OQ5YI/ejn2SoSd3o5aUX7jzbBjvrEH7H:9OEYFbaRjzhrEH7H
TLSH
T13D053C5A7660EBD6CF10623EE4F6CA7054A2BDFBC93E0B962ACDFD1D1536281043B509
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-22_f8416e40d8fe6300720f3bcdf7e3a9f1_elex_floxif_maze_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-22_f8416e40d8fe6300720f3bcdf7e3a9f1_elex_floxif_maze_rhadamanthys_smoke-loader_stealc_stop

.exe 810KB

2026-09-22_f8416e40d8fe6300720f3bcdf7e3a9f1_elex_floxif_maze_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 011c882d8d6e71b19cf14a243c41eade
SHA256 59b339c2a30abf671c036240a04b797a8296989bcb2e653ffe23c6e98a4229d7
MD5 f8416e40d8fe6300720f3bcdf7e3a9f1
SHA1 a8a691b3b4ae0b8b69ea34894a75296632c0c971
SHA512 29f6a3c1598516255200d0fd4da07dcae73a6811c052ff15d394c97c24e7a3e4ae47fac28757ad82e2e390ff8c24b57e7d4c88a88f8c7dfb110c3722077c5707
SSDEEP 12288:9OQ5YI/ejn2SoSd3o5aUX7jzbBjvrEH7H:9OEYFbaRjzhrEH7H
TLSH
T13D053C5A7660EBD6CF10623EE4F6CA7054A2BDFBC93E0B962ACDFD1D1536281043B509
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b9:7f:c3:9c:43:85:93:0e:7e:3c:23:7c:0d:fa:6a:e0:27:41:92:97:23:1c:d2:67:3b:52:6d:88:39:b7:12:6e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=Floor 10\, 49\, Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 4, 2019

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=Floor 10\, 49\, Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

PE Signature issue

Digest

92:56:9a:50:11:cc:67:22:3c:89:a2:53:45:99:41:cf:92:3b:ef:16

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=Floor 10\, 49\, Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 4, 2019

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=Floor 10\, 49\, Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=Floor 10\, 49\, Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

1f:1e:4a:7a:b0:a7:f5:4a:1f:d6:08:07

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 30, 2018 - Aug 30, 2021

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

1

Major OS version

5

Entry point

33161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\GitRepository\install\HOffice110\Install_2020\Install\Release\Install.pdb

kernel32

GetModuleFileNameW SetEndOfFile CreateFileW OutputDebugStringW ReadConsoleW WriteConsoleW SetStdHandle LoadLibraryExW HeapReAlloc GetOEMCP GetACP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte MultiByteToWideChar GetStringTypeW IsDebuggerPresent IsProcessorFeaturePresent GetLastError HeapFree RaiseException RtlUnwind GetCommandLineW GetCPInfo HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW HeapSize GetProcessHeap CloseHandle FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode GetStdHandle GetFileType ReadFile SetFilePointerEx GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId

user32

LoadStringW LoadIconW LoadCursorW EndPaint BeginPaint SetActiveWindow EndDialog DialogBoxParamW DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW UpdateWindow

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_f8416e40d8fe6300720f3bcdf7e3a9f1_elex_floxif_maze_rhadamanthys_smoke-loader_stealc_stop

PE Signature issue

PE Signature issue

kernel32

user32

shell32

generic