2026-10-24_bfdb855ac2aa5316ad1adc9acbcc0f2b_elex_floxif_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-24_bfdb855ac2aa5316ad1adc9acbcc0f2b_elex_floxif_rhadamanthys_stop
Size 330KB
Sample261025-k63ltagg27
SHA256 2f95b6f590118a349a03944d5a546baafb0d07b72c548e08bde20c5064cb888e
MD5 bfdb855ac2aa5316ad1adc9acbcc0f2b
SHA1 79c5df5b13935e7d69b14b2c927170effd498cc2
SHA512 66d1d31fd493eb76efb3cd54695e21cf2515e2d0d92a6f0ae3b885ae0c09672108a7df9c0872cdb542cd94710c3e84a5f5ea2c7b2a0b2ae384444ee137f2cb69
SSDEEP 6144:HFEJaPULfhi2yVOPNMT/bi6BBV+UdvrEFp7hKHVb:HFEJaPU9i2wOuBjvrEH7SVb
TLSH
T196746C2022E88764F7F21872DAFDC1155D7A79A84B35C2CF12D0851E5EB9AD29E31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-24_bfdb855ac2aa5316ad1adc9acbcc0f2b_elex_floxif_rhadamanthys_stop

File Explorer

2026-10-24_bfdb855ac2aa5316ad1adc9acbcc0f2b_elex_floxif_rhadamanthys_stop

.exe 330KB

2026-10-24_bfdb855ac2aa5316ad1adc9acbcc0f2b_elex_floxif_rhadamanthys_stop

IMPHASH 418b70b265d0be212528368423ccbeb8
SHA256 2f95b6f590118a349a03944d5a546baafb0d07b72c548e08bde20c5064cb888e
MD5 bfdb855ac2aa5316ad1adc9acbcc0f2b
SHA1 79c5df5b13935e7d69b14b2c927170effd498cc2
SHA512 66d1d31fd493eb76efb3cd54695e21cf2515e2d0d92a6f0ae3b885ae0c09672108a7df9c0872cdb542cd94710c3e84a5f5ea2c7b2a0b2ae384444ee137f2cb69
SSDEEP 6144:HFEJaPULfhi2yVOPNMT/bi6BBV+UdvrEFp7hKHVb:HFEJaPU9i2wOuBjvrEH7SVb
TLSH
T196746C2022E88764F7F21872DAFDC1155D7A79A84B35C2CF12D0851E5EB9AD29E31B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

cf:20:db:48:35:e4:e3:ca:40:a6:22:24:ab:f5:1d:04:10:4d:39:4d:bc:00:ef:f1:3a:ad:85:84:63:5e:98:72

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 27, 2015

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

67:d1:df:b4:3e:ad:7e:e1:f8:d3:d5:18:e4:f3:d4:55:7d:58:bf:c1

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Chains

Aug 18, 2014

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Serial Number

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2013 - Jul 11, 2016

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 19, 2014 - Mar 19, 2016

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:29:61:51:29:c9:95:06:f9:00:00:00:00:00:57

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Minor OS version

Major OS version

Entry point

34576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Project\RtkAudioService\Win32\Release\RtkAudioService.pdb

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceInstanceIdW CM_Get_Parent CM_Get_First_Log_Conf SetupDiGetDeviceRegistryPropertyW CM_Get_Res_Des_Data CM_Get_DevNode_Status CM_Get_Res_Des_Data_Size CM_Free_Res_Des_Handle CM_Get_Next_Res_Des CM_Get_Device_IDW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces

winmm

timeEndPeriod timeBeginPeriod

userenv

CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

kernel32

RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId lstrlenA FindResourceExW FindResourceW LoadResource OpenProcess SizeofResource CreateFileW GetLastError Process32FirstW ProcessIdToSessionId GetExitCodeThread LockResource DeviceIoControl Process32NextW WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot CloseHandle WideCharToMultiByte MultiByteToWideChar RaiseException WaitForSingleObject SetEvent ResetEvent CreateEventW WaitForMultipleObjects CreateThread InitializeCriticalSection DeleteCriticalSection SetWaitableTimer CancelWaitableTimer Sleep LeaveCriticalSection EnterCriticalSection LocalAlloc CreateWaitableTimerW LocalFree GetCurrentThreadId DuplicateHandle GetCurrentProcess CreateFileA ReadFile SetEndOfFile GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer InterlockedDecrement InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetModuleHandleA LoadLibraryA GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapCreate VirtualFree VirtualAlloc LCMapStringW ExitProcess WriteFile GetStdHandle GetModuleFileNameA

user32

RegisterDeviceNotificationW UnregisterDeviceNotification

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegNotifyChangeKeyValue RegCloseKey AdjustTokenPrivileges RegOpenKeyExW DuplicateTokenEx LookupPrivilegeValueW SetTokenInformation CreateProcessAsUserW RegQueryValueExW OpenProcessToken RegSetValueExW

shell32

SHGetFolderPathW

ole32

CoInitializeSecurity CoTaskMemFree CoSetProxyBlanket CoCreateInstance StringFromGUID2 CoUninitialize PropVariantClear CoInitializeEx

oleaut32

SysFreeString SafeArrayUnaccessData VariantChangeType VariantInit SafeArrayAccessData VariantClear SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-24_bfdb855ac2aa5316ad1adc9acbcc0f2b_elex_floxif_rhadamanthys_stop

PE Signature issue

PE Signature issue

setupapi

winmm

userenv

wtsapi32

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic