2026-10-22_9255f0464431d5d87ebb43cbb171946a_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_9255f0464431d5d87ebb43cbb171946a_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop
Size 174KB
Sample261024-e7p48afx7v
SHA256 4fadf8c4cbc2c100ed42986ec6dcbd0ba19730db5378f30f006193fba04c2495
MD5 9255f0464431d5d87ebb43cbb171946a
SHA1 822a143bfbbdd543292201a35b4033c82bd71f9e
SHA512 abcfade691c0ab359154a791a7a68445a370693465fb6ded78bab04dec4694fcffbd3bacb83ea8d2844973dad07d5c022516f36b87f8ab65dd0367a3647e3905
SSDEEP 3072:i+YVROgbEZN0gVL9oLFQ+hXw9PK2lQBV+UdE+rECWp7hKGTxrS:2NA70gVL9oRTKYBV+UdvrEFp7hKGTxG
TLSH
T14F04BE0179D0C3FAD1921830355CE6505AFAF93D0B6A40C7B3A612595FACBD39B7A32B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-22_9255f0464431d5d87ebb43cbb171946a_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-22_9255f0464431d5d87ebb43cbb171946a_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 174KB

2026-10-22_9255f0464431d5d87ebb43cbb171946a_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH bd7dbcc8c07b8d3a5ed549bf070cb152
SHA256 4fadf8c4cbc2c100ed42986ec6dcbd0ba19730db5378f30f006193fba04c2495
MD5 9255f0464431d5d87ebb43cbb171946a
SHA1 822a143bfbbdd543292201a35b4033c82bd71f9e
SHA512 abcfade691c0ab359154a791a7a68445a370693465fb6ded78bab04dec4694fcffbd3bacb83ea8d2844973dad07d5c022516f36b87f8ab65dd0367a3647e3905
SSDEEP 3072:i+YVROgbEZN0gVL9oLFQ+hXw9PK2lQBV+UdE+rECWp7hKGTxrS:2NA70gVL9oRTKYBV+UdvrEFp7hKGTxG
TLSH
T14F04BE0179D0C3FAD1921830355CE6505AFAF93D0B6A40C7B3A612595FACBD39B7A32B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

80:a5:3e:a5:81:05:1d:c0:f1:c5:7f:59:f4:a7:39:06:f5:1c:87:a3

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

May 27, 2016

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Serial Number

04:65:a3:13:e4:ba:e0:10:b1:8b:d5:18:02:7d:4a:88

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 25, 2015 - Jan 23, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

23745

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\aldev-svn\common\Zumlib\trunk\Bin\Release\ezt.pdb

kernel32

Process32FirstW Process32NextW LockResource FindResourceExW GetCommandLineW LocalFree GetCurrentThreadId GetCurrentProcess CloseHandle FlushFileBuffers CreateToolhelp32Snapshot WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InterlockedIncrement InterlockedDecrement DeleteCriticalSection InitializeCriticalSection GetModuleFileNameW GetModuleHandleW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar GetLastError EnterCriticalSection RaiseException LeaveCriticalSection lstrcmpiW lstrlenW GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoA GetStringTypeW CreateFileA FreeLibrary HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep ExitProcess VirtualFree VirtualAlloc HeapCreate WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA

user32

DefWindowProcW CharNextW DestroyWindow

advapi32

RegQueryValueExW RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey

shell32

CommandLineToArgvW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize CoUninitialize

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_9255f0464431d5d87ebb43cbb171946a_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

generic