2026-10-11_3af764f0807b3cb75c0b2f2b100f97f7_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_3af764f0807b3cb75c0b2f2b100f97f7_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop
Size 420KB
Sample261012-317mpazv2m
SHA256 8a31edb5841f04a62886178720d5b4ecddcb83306f3b7d4d17f8e9d5fa1be56e
MD5 3af764f0807b3cb75c0b2f2b100f97f7
SHA1 0d8083cdbf26c34d9e7dda605d3ddbb63258acda
SHA512 51135b8508b3ddc7751710cfd4f9419ea2785ed2c404c0f5485d3afe7118961088121390ee08eb3d127aaa47f311ad82709486ca8558958c3acdd08f3357e52a
SSDEEP 6144:BNZtWylbnTCAOgAOr+Z2K/lTDaBV+UdvrEFp7hKZlr:BlvnTCuZJQlKBjvrEH7Er
TLSH
T1C294398122E286EAD4E2013238A75671F7D66DEF3B69875F93C1330D4A3B3C1D6245B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-11_3af764f0807b3cb75c0b2f2b100f97f7_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-11_3af764f0807b3cb75c0b2f2b100f97f7_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop

.exe 420KB

2026-10-11_3af764f0807b3cb75c0b2f2b100f97f7_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop

IMPHASH 9fa53d4199590ac4cbaaa1467c247a0b
SHA256 8a31edb5841f04a62886178720d5b4ecddcb83306f3b7d4d17f8e9d5fa1be56e
MD5 3af764f0807b3cb75c0b2f2b100f97f7
SHA1 0d8083cdbf26c34d9e7dda605d3ddbb63258acda
SHA512 51135b8508b3ddc7751710cfd4f9419ea2785ed2c404c0f5485d3afe7118961088121390ee08eb3d127aaa47f311ad82709486ca8558958c3acdd08f3357e52a
SSDEEP 6144:BNZtWylbnTCAOgAOr+Z2K/lTDaBV+UdvrEFp7hKZlr:BlvnTCuZJQlKBjvrEH7Er
TLSH
T1C294398122E286EAD4E2013238A75671F7D66DEF3B69875F93C1330D4A3B3C1D6245B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

11:29:7c:2c:91:78:79:7f:a3:95:b5:93:e2:97:d4:9b:17:7f:72:bb:67:fe:42:ca:63:51:7f:04:a0:c9:f1:73

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Acer Incorporated,O=Acer Incorporated,L=Taipei,ST=Taipei,C=TW

Chains

Sep 27, 2019

CN=Acer Incorporated,O=Acer Incorporated,L=Taipei,ST=Taipei,C=TW

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=Acer Incorporated,O=Acer Incorporated,L=Taipei,ST=Taipei,C=TW

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Acer Incorporated,O=Acer Incorporated,L=Taipei,ST=Taipei,C=TW

Serial Number

4e:5f:9e:b5:cf:61:50:a7:58:6f:dd:a0

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 16, 2018 - Oct 3, 2020

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Minor OS version

Major OS version

Entry point

40948

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\localadmin\Desktop\QuickAccessV2\Bin\Release\Plugins\LumiFlex\SunlightReading.pdb

kernel32

CloseHandle ReleaseMutex CreateMutexW Sleep CreateThread SuspendThread ResumeThread OpenProcess GetModuleFileNameA GetSystemPowerStatus CreateFileW QueryDosDeviceW FreeLibrary GetProcAddress LoadLibraryA LocalFree ReadConsoleW ReadFile WriteConsoleW FlushFileBuffers SetStdHandle GetConsoleMode DeleteCriticalSection LCMapStringW LoadLibraryExW HeapReAlloc GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionEx GetLastError RaiseException GetConsoleCP DecodePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter SetFilePointerEx GetStartupInfoW GetFileType GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetModuleFileNameW WriteFile GetStdHandle GetCurrentThreadId SetEndOfFile SetLastError IsProcessorFeaturePresent GetProcessHeap HeapSize WideCharToMultiByte MultiByteToWideChar AreFileApisANSI GetModuleHandleExW ExitProcess GetCommandLineA IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection EncodePointer HeapFree RtlUnwind HeapAlloc

user32

PostMessageW GetMessageW SetTimer DispatchMessageW RegisterPowerSettingNotification UnregisterPowerSettingNotification DefWindowProcW TranslateMessage QueryDisplayConfig PostQuitMessage UnhookWinEvent SetWinEventHook EnumDisplayMonitors DestroyCursor LoadCursorW GetWindowThreadProcessId GetClassNameW FindWindowW AdjustWindowRect GetWindowRect GetWindowTextW GetDC GetForegroundWindow UpdateWindow GetSystemMetrics KillTimer ShowWindow CreateWindowExW RegisterClassExW GetDisplayConfigBufferSizes

advapi32

RegOpenKeyExW RegEnumKeyExW RegCloseKey RegQueryValueExW

shell32

SHAppBarMessage

ole32

CoCreateInstance CoInitialize CoSetProxyBlanket CLSIDFromProgID CoUninitialize CoInitializeEx PropVariantClear

oleaut32

VariantInit VariantClear SysAllocString SysFreeString

shlwapi

PathRemoveFileSpecA StrStrW

wtsapi32

WTSUnRegisterSessionNotification

powrprof

PowerReadACValueIndex PowerReadDCValueIndex PowerGetActiveScheme

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_3af764f0807b3cb75c0b2f2b100f97f7_elex_floxif_karagany_maze_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

powrprof

generic