2026-10-19_c5a34814c9ec56362db834038905a10a_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_c5a34814c9ec56362db834038905a10a_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 242KB
Sample261020-l1qkqsysft
SHA256 ea909a6e4b5df7166092f4fa62de8056aa8e7a5ac6b71e563aa872c8e296c7de
MD5 c5a34814c9ec56362db834038905a10a
SHA1 df0d58982a48aa72ca15338177db7d6db7d019b8
SHA512 6b849efa7913c904d1dfda3789de5f38b4cc23bde6b19c42d10270f4003f2e3c21494f26f4eb7e5ad9f7617b6b5fb9118fdb8d11a64454f0be9df3d3238b4447
SSDEEP 3072:sRBcpBIqJzXeNUkOULLN4FcK25E5we4522lQBV+UdE+rECWp7hKsaK:sROPXGUkvLLsHSCBV+UdvrEFp7hKw
TLSH
T151349D413381C3FAC84615313829D7A559FAF53C0FAA81C3B3961B2D8E6D7D25B7A24B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-19_c5a34814c9ec56362db834038905a10a_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-10-19_c5a34814c9ec56362db834038905a10a_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 242KB

2026-10-19_c5a34814c9ec56362db834038905a10a_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 4294cc673730f229c2f6560f772b8114
SHA256 ea909a6e4b5df7166092f4fa62de8056aa8e7a5ac6b71e563aa872c8e296c7de
MD5 c5a34814c9ec56362db834038905a10a
SHA1 df0d58982a48aa72ca15338177db7d6db7d019b8
SHA512 6b849efa7913c904d1dfda3789de5f38b4cc23bde6b19c42d10270f4003f2e3c21494f26f4eb7e5ad9f7617b6b5fb9118fdb8d11a64454f0be9df3d3238b4447
SSDEEP 3072:sRBcpBIqJzXeNUkOULLN4FcK25E5we4522lQBV+UdE+rECWp7hKsaK:sROPXGUkvLLsHSCBV+UdvrEFp7hKw
TLSH
T151349D413381C3FAC84615313829D7A559FAF53C0FAA81C3B3961B2D8E6D7D25B7A24B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

9e:d6:5a:6d:6c:28:63:d9:57:08:33:22:e9:d0:66:15:98:dc:57:d7

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Chains

Apr 24, 2012

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Serial Number

10:02:1a:27:d2:83:12:88:5c:61:3a:a4:98:58:0f:6f

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 8, 2011 - Apr 22, 2014

Minor OS version

Major OS version

Entry point

61223

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\ccViews\autobuild1_BR-1204-0K49_9.0_Snapshot\AMT_Development\SW\Src\Apps\ICC\ICC_Proxy\ICCProxy\Release\ICCProxy.pdb

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

kernel32

FindResourceW LoadLibraryExW GetCommandLineW GetCurrentThread EnterCriticalSection LeaveCriticalSection WriteFile ReadFile CreateFileW GetOverlappedResult DeviceIoControl LoadResource SetNamedPipeHandleState CreateFileA SizeofResource MultiByteToWideChar FreeLibrary SetEvent InterlockedDecrement InterlockedIncrement GetCurrentThreadId CreateEventW CreateThread Sleep GetModuleFileNameW GetVersionExW lstrcmpiW GetModuleHandleW GetProcAddress GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException lstrlenW WaitForSingleObject CloseHandle GetCPInfo GetACP GetOEMCP IsValidCodePage WaitNamedPipeW GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetConsoleMode SetStdHandle FlushFileBuffers GetLocaleInfoA LoadLibraryA GetConsoleCP SetFilePointer WideCharToMultiByte GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType HeapAlloc HeapFree RtlUnwind VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree HeapReAlloc HeapCreate ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount

user32

TranslateMessage MessageBoxW DispatchMessageW GetMessageW PostThreadMessageW LoadStringW CharNextW CharUpperW

advapi32

PrivilegeCheck LookupPrivilegeValueA OpenThreadToken SetThreadToken StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW RegEnumKeyExW ControlService DeleteService CreateServiceW ChangeServiceConfigW ChangeServiceConfig2W RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource OpenSCManagerW OpenServiceW CloseServiceHandle

ole32

CoTaskMemAlloc CoUninitialize CoInitializeSecurity CoTaskMemRealloc CoRevokeClassObject CoRegisterClassObject StringFromGUID2 CoCreateInstance CoRevertToSelf CoImpersonateClient CoInitialize CoTaskMemFree

oleaut32

LoadRegTypeLi VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

userenv

UnloadUserProfile

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_c5a34814c9ec56362db834038905a10a_amadey_elex_floxif_rhadamanthys_smoke-loader_stealc_stop_tofsee

PE Signature issue

setupapi

kernel32

user32

advapi32

ole32

oleaut32

userenv

generic