2026-09-25_fd3fdd3a89f0757ac8679342eff7fbbc_amadey_elex_hijackloader_icedid_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_fd3fdd3a89f0757ac8679342eff7fbbc_amadey_elex_hijackloader_icedid_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 1.4MB
Sample260925-va77ja1eme
SHA256 0c5f95ec85a70b0170b7448d421ea81dce6a76f3656407c390526c0b21ef2e83
MD5 fd3fdd3a89f0757ac8679342eff7fbbc
SHA1 bfc8d9007ee8cba5ad13eb765df9415f02f47de8
SHA512 531b5a07a0b9b4e21c28e6b7760a302deb1e26a7ca71f75300d2f458736455be210eb4a77e1827b02082f269e729fce0791e5d1f7e4cab8da3129a88a8a83f37
SSDEEP 24576:VJygGtYtpHEVLzvzCcusVKsetvlz28X/i/YZsA49vD5XV/Hw2J:xtpHWvGcbVCtvlz28K/YZsAw5XRwk
TLSH
T1CF656C11B680C031D3AA1B715999E3A625B9AC305B6196CFF7D43A3E6F312D35A3720F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-25_fd3fdd3a89f0757ac8679342eff7fbbc_amadey_elex_hijackloader_icedid_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-25_fd3fdd3a89f0757ac8679342eff7fbbc_amadey_elex_hijackloader_icedid_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 1.4MB

2026-09-25_fd3fdd3a89f0757ac8679342eff7fbbc_amadey_elex_hijackloader_icedid_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH d3ec19d362c3438d5ed590d38396d6f7
SHA256 0c5f95ec85a70b0170b7448d421ea81dce6a76f3656407c390526c0b21ef2e83
MD5 fd3fdd3a89f0757ac8679342eff7fbbc
SHA1 bfc8d9007ee8cba5ad13eb765df9415f02f47de8
SHA512 531b5a07a0b9b4e21c28e6b7760a302deb1e26a7ca71f75300d2f458736455be210eb4a77e1827b02082f269e729fce0791e5d1f7e4cab8da3129a88a8a83f37
SSDEEP 24576:VJygGtYtpHEVLzvzCcusVKsetvlz28X/i/YZsA49vD5XV/Hw2J:xtpHWvGcbVCtvlz28K/YZsAw5XRwk
TLSH
T1CF656C11B680C031D3AA1B715999E3A625B9AC305B6196CFF7D43A3E6F312D35A3720F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

27:30:bd:54:31:18:f2:b1:94:a9:aa:98:c1:2b:af:7b:19:71:c3:60:0c:93:06:fa:b3:fb:35:61:03:cf:b6:08

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Hangzhou Shunwang Technology Co.\,Ltd,O=Hangzhou Shunwang Technology Co.\,Ltd,L=杭州市,ST=浙江省,C=CN

Chains

Feb 6, 2024

CN=Hangzhou Shunwang Technology Co.\,Ltd,O=Hangzhou Shunwang Technology Co.\,Ltd,L=杭州市,ST=浙江省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Hangzhou Shunwang Technology Co.\,Ltd,O=Hangzhou Shunwang Technology Co.\,Ltd,L=杭州市,ST=浙江省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

49:f7:45:02:16:98:41:b1:c6:20:76:ad:41:8b:3d:58:2a:2b:08:82

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Hangzhou Shunwang Technology Co.\,Ltd,O=Hangzhou Shunwang Technology Co.\,Ltd,L=杭州市,ST=浙江省,C=CN

Chains

Feb 6, 2024

CN=Hangzhou Shunwang Technology Co.\,Ltd,O=Hangzhou Shunwang Technology Co.\,Ltd,L=杭州市,ST=浙江省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Hangzhou Shunwang Technology Co.\,Ltd,O=Hangzhou Shunwang Technology Co.\,Ltd,L=杭州市,ST=浙江省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:6a:53:45:5c:c7:00:12:fa:23:ce:7a:80:f8:5e:47

Issuer

CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2013 - Oct 22, 2023

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Hangzhou Shunwang Technology Co.\,Ltd,O=Hangzhou Shunwang Technology Co.\,Ltd,L=杭州市,ST=浙江省,C=CN

Serial Number

08:41:c0:00:d2:2b:27:8c:d1:b7:2b:bd:f7:3a:42:2e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 11, 2023 - Apr 9, 2026

Minor OS version

Major OS version

Entry point

238982

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\slave\workspace\GameLaunch\bin\pdb\GameLaunch.pdb

kernel32

GetFullPathNameW FileTimeToLocalFileTime GetFileTime InterlockedIncrement GetVersionExA lstrcmpW LoadLibraryA CompareStringW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW lstrlenA LocalAlloc TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree InterlockedExchange CompareStringA GetLocaleInfoW lstrcmpA EnumResourceLanguagesW ConvertDefaultLocale GetCurrentThread GetCurrentProcessId SetErrorMode GlobalFlags GetStartupInfoW RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException HeapAlloc HeapFree GetSystemTimeAsFileTime GetVolumeInformationW VirtualProtect GetSystemInfo VirtualQuery HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation LCMapStringW GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount LCMapStringA GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetCurrentDirectoryA GetDriveTypeA CreateFileA GetProcessHeap SetEnvironmentVariableA SetEndOfFile UnlockFile InterlockedCompareExchange LockFile GetThreadLocale GlobalFree FormatMessageW LocalFree MulDiv SetLastError FileTimeToSystemTime LocalFileTimeToFileTime SystemTimeToFileTime SetFilePointer OutputDebugStringA CreateFileMappingA ReleaseMutex FreeResource FindResourceA OpenEventA OpenMutexA GetModuleHandleA GetCurrentDirectoryW GetVersionExW GetCurrentThreadId GetPrivateProfileIntW GetFileSizeEx ExitProcess GlobalAlloc GlobalLock GlobalUnlock FlushFileBuffers FreeLibrary CreateThread GetLocalTime MultiByteToWideChar CreateEventW GetSystemDirectoryW SetFilePointerEx lstrlenW SetEvent Sleep OutputDebugStringW CreateFileMappingW MapViewOfFile UnmapViewOfFile DuplicateHandle CreateMutexW OpenProcess LoadLibraryW CreateRemoteThread WaitForSingleObject GetModuleHandleW GetProcAddress GetCurrentProcess WideCharToMultiByte WritePrivateProfileStringW GetPrivateProfileStringW InterlockedDecrement GetFileSize ReadFile GetModuleFileNameW GetTempPathW GetTickCount GetTempFileNameW VirtualAlloc MoveFileExW CreateFileW WriteFile VirtualFree RemoveDirectoryW FindFirstFileW SetFileAttributesW DeleteFileW FindNextFileW FindClose CreateDirectoryW GetFileAttributesW Process32FirstW Process32NextW CreateToolhelp32Snapshot Module32FirstW GetLastError CloseHandle LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FindResourceW LoadResource LockResource HeapReAlloc SizeofResource

user32

DestroyMenu RegisterClipboardFormatW UnregisterClassW GetSysColorBrush GetMessageW TranslateMessage ValidateRect PostQuitMessage MessageBeep GetNextDlgGroupItem EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW CharNextW ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW EnableMenuItem CheckMenuItem GetActiveWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageW GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor RegisterWindowMessageW GetParent SendMessageW AdjustWindowRectEx GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SystemParametersInfoA IsIconic GetWindowPlacement GetWindow SetWindowContextHelpId MapDialogRect ReleaseCapture SetFocus GetFocus SetCapture InvalidateRgn PostThreadMessageW InvalidateRect ReleaseDC GetWindowTextW EnableWindow PostMessageW CopyRect LoadCursorW LoadIconW GetWindowThreadProcessId GetShellWindow SetCursor PtInRect GetCursorPos MessageBoxW SetWindowLongW GetWindowLongW GetWindowRect GetClientRect SetWindowPos SystemParametersInfoW AdjustWindowRect GetDC LoadBitmapW GetDesktopWindow GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState GetSystemMetrics CharUpperW UnhookWindowsHookEx IsRectEmpty SetRect IsWindowEnabled IsWindowVisible EqualRect IntersectRect IsWindow OffsetRect CopyAcceleratorTableW TabbedTextOutW

gdi32

GetMapMode ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW TextOutW RectVisible PtVisible GetWindowExtEx CreateSolidBrush SetMapMode RestoreDC SaveDC GetTextColor GetBkColor GetStockObject CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox GetRgnBox CreateRectRgnIndirect GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject CreateDIBSection DeleteObject DeleteDC GetViewportExtEx

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegSetValueExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExW RegCreateKeyExW RegQueryValueExW RegSetValueExA RegOpenKeyExA RegCloseKey RegQueryValueExA OpenProcessToken LookupPrivilegeValueW

shell32

ShellExecuteW

shlwapi

PathFileExistsW PathStripToRootW PathIsUNCW PathFindExtensionW PathFindFileNameW

oledlg

OleUIBusyW

ole32

CoInitialize CoTaskMemFree CoTaskMemAlloc CoUninitialize CoRegisterMessageFilter CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoDisconnectObject CLSIDFromProgID CLSIDFromString OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard

oleaut32

SysStringLen SysFreeString VariantTimeToSystemTime SystemTimeToVariantTime VariantClear SafeArrayDestroy SysAllocString SysAllocStringLen VariantChangeType VariantInit VariantCopy OleCreateFontIndirect LoadTypeLi GetErrorInfo

gdiplus

GdipAlloc GdipLoadImageFromFile GdipLoadImageFromFileICM GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCloneImage GdipDeleteGraphics GdipCreateFromHDC GdipReleaseDC GdipSetSmoothingMode GdipDrawImageRectI GdipFree GdiplusShutdown GdiplusStartup

ws2_32

ntohl

wininet

InternetCrackUrlW InternetConnectW HttpSendRequestW HttpOpenRequestW InternetOpenW InternetReadFile InternetCloseHandle HttpAddRequestHeadersW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_fd3fdd3a89f0757ac8679342eff7fbbc_amadey_elex_hijackloader_icedid_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

gdiplus

ws2_32

wininet

generic