2026-10-21_ae60fa022832363c446d3f9460e73fb3_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_ae60fa022832363c446d3f9460e73fb3_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop
Size 182KB
Sample261022-qj13csty6m
SHA256 d5fd1e124007e5b9e483fa7676aa62983556c3c3859c22e85ffa543cde8e19cb
MD5 ae60fa022832363c446d3f9460e73fb3
SHA1 607d54d09e2d76dcf98b0488092c501f5ca65460
SHA512 86cc227e6fb3106b014f63ca1d28d385a13cd72246f1801bdb14254b06d900f95515133119743fbf8600f39da29d7cac7468a67ec146f76f54518cbb709b1248
SSDEEP 3072:7jerqWw8x3Mpxd6jNamVH+bm2lQBV+UdE+rECWp7hKE+:7jKqd8XlVSsBV+UdvrEFp7hKD
TLSH
T1BD04CF1132C0CBFEC456253034ACEAA55AE5E83C0ABF8597F396029D6F6C783566D21F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-21_ae60fa022832363c446d3f9460e73fb3_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-21_ae60fa022832363c446d3f9460e73fb3_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 182KB

2026-10-21_ae60fa022832363c446d3f9460e73fb3_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH f5a534e97f1abcbccccde8a7c2da2cef
SHA256 d5fd1e124007e5b9e483fa7676aa62983556c3c3859c22e85ffa543cde8e19cb
MD5 ae60fa022832363c446d3f9460e73fb3
SHA1 607d54d09e2d76dcf98b0488092c501f5ca65460
SHA512 86cc227e6fb3106b014f63ca1d28d385a13cd72246f1801bdb14254b06d900f95515133119743fbf8600f39da29d7cac7468a67ec146f76f54518cbb709b1248
SSDEEP 3072:7jerqWw8x3Mpxd6jNamVH+bm2lQBV+UdE+rECWp7hKE+:7jKqd8XlVSsBV+UdvrEFp7hKD
TLSH
T1BD04CF1132C0CBFEC456253034ACEAA55AE5E83C0ABF8597F396029D6F6C783566D21F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0c:14:e6:d0:4c:93:5b:12:87:7d:57:22:22:20:d3:28:07:3c:20:76:d1:95:ba:62:1b:44:75:f6:ac:7d:84:69

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=1147746831220,CN=LLC \"Stakhanovets\",O=LLC \"Stakhanovets\",L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

Chains

Nov 21, 2020

SERIALNUMBER=1147746831220,CN=LLC \"Stakhanovets\",O=LLC \"Stakhanovets\",L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=1147746831220,CN=LLC \"Stakhanovets\",O=LLC \"Stakhanovets\",L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

Serial Number

0b:b7:17:ac:21:60:17:22:8b:5a:50:af:26:aa:7a:44

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 21, 2020 - Feb 10, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

32537

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLogicalDrives lstrcmpA GetLastError SetEvent ResetEvent Sleep GetModuleFileNameA WaitForSingleObject CreateEventA QueryDosDeviceA CreateThread lstrcpyA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetDriveTypeA GetVolumeInformationA GetDiskFreeSpaceExA FindNextFileA RemoveDirectoryA FindFirstFileA FindClose GetModuleHandleA GetProcAddress SetFileAttributesA WriteFile DeleteFileA CreateFileA GetFileSize ReadFile TerminateThread CloseHandle FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount GetStringTypeW RaiseException RtlUnwind MoveFileA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree HeapAlloc GetCommandLineA GetStartupInfoA GetStdHandle GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize ExitProcess HeapCreate VirtualFree VirtualAlloc HeapReAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryA GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA CreateDirectoryA

user32

MessageBoxA

advapi32

RegQueryValueExA RegCloseKey InitializeSecurityDescriptor SetSecurityDescriptorDacl StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA StartServiceA DeleteService CreateServiceA SetServiceStatus OpenSCManagerA OpenServiceA QueryServiceStatus CloseServiceHandle ControlService RegOpenKeyExA

shell32

ShellExecuteA

shlwapi

StrStrIA

ws2_32

accept recv listen shutdown closesocket bind htons socket WSACleanup WSAStartup send

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_ae60fa022832363c446d3f9460e73fb3_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

shell32

shlwapi

ws2_32

generic