2026-10-31_e8ba8d4c5bf4acf6e7c0b7b59c4aefdc_amadey_elex_floxif_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_e8ba8d4c5bf4acf6e7c0b7b59c4aefdc_amadey_elex_floxif_rhadamanthys_smoke-loader
Size 41.1MB
Sample261101-xleepsda88
SHA256 fee8bbfd621358d2d26f086cb79b2042b2d2cbc68b500c9e1182c0ae3eb87c46
MD5 e8ba8d4c5bf4acf6e7c0b7b59c4aefdc
SHA1 b5c21f3108cb694d1892341b2607f75147fe0120
SHA512 f7c766b029301567911ebf19bfed2eb7b4783a767319f7e562c4f6a45fe4fe4636bf1067f66765f997452225c0b15c1dbe750a73aed66f4ef5c8ca7fac064baf
SSDEEP 786432:820rtPwxD5pJfxAHKJ6ETbpu3bxmdAMsbRAn8RthR6L:ErtP4TAHaTEbxmdApA8s
TLSH
T174973314A390D7BCD05BE9F4149E603D3BF9FC8663649F8BEB680A5E61DE3C254205CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-31_e8ba8d4c5bf4acf6e7c0b7b59c4aefdc_amadey_elex_floxif_rhadamanthys_smoke-loader

File Explorer

2026-10-31_e8ba8d4c5bf4acf6e7c0b7b59c4aefdc_amadey_elex_floxif_rhadamanthys_smoke-loader

.exe 41.1MB

2026-10-31_e8ba8d4c5bf4acf6e7c0b7b59c4aefdc_amadey_elex_floxif_rhadamanthys_smoke-loader

IMPHASH 02483cd76378259a50b7b66146b45f06
SHA256 fee8bbfd621358d2d26f086cb79b2042b2d2cbc68b500c9e1182c0ae3eb87c46
MD5 e8ba8d4c5bf4acf6e7c0b7b59c4aefdc
SHA1 b5c21f3108cb694d1892341b2607f75147fe0120
SHA512 f7c766b029301567911ebf19bfed2eb7b4783a767319f7e562c4f6a45fe4fe4636bf1067f66765f997452225c0b15c1dbe750a73aed66f4ef5c8ca7fac064baf
SSDEEP 786432:820rtPwxD5pJfxAHKJ6ETbpu3bxmdAMsbRAn8RthR6L:ErtP4TAHaTEbxmdApA8s
TLSH
T174973314A390D7BCD05BE9F4149E603D3BF9FC8663649F8BEB680A5E61DE3C254205CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

09:77:0f:1c:ec:bf:38:a0:8d:72:23:d1:20:60:42:83:33:f2:29:73

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 18, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:94:2d:00:00:00:00:00:09

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

Major OS version

Entry point

102854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

boxstub.pdb

advapi32

CryptGenRandom CryptReleaseContext DecryptFileW CryptAcquireContextA

kernel32

Sleep WaitForSingleObject GetExitCodeProcess CloseHandle SetFileAttributesW InitializeCriticalSection CreateEventA CreateThread DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetCommandLineW CreateProcessW CompareStringW LocalFree QueryDosDeviceW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetErrorMode CreateDirectoryW RemoveDirectoryW MoveFileExW LoadLibraryW GetProcAddress GetSystemDirectoryW GetVersion GetLastError SetEnvironmentVariableW ExitThread GetTickCount GetEnvironmentVariableW GetModuleHandleW lstrlenW WaitForMultipleObjects ResetEvent GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetEndOfFile DuplicateHandle ReadFile SetFilePointerEx GlobalFree GlobalAlloc GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc LCMapStringW RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent SetStdHandle WriteConsoleW FlushFileBuffers CreateFileA GetLocalTime GetComputerNameW lstrlenA FormatMessageW GetSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileW GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW ExpandEnvironmentStringsW GetProcessHeap RaiseException

comctl32

ord17

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW GetTopWindow GetWindowThreadProcessId GetWindow SendMessageA PostMessageW SendMessageW DialogBoxParamA GetDlgItem SetWindowTextW EndDialog PostQuitMessage DialogBoxParamW SetWindowLongW GetWindowLongW LoadStringW CharUpperW

cabinet

ord22 ord23 ord20

oleaut32

SysAllocString VariantClear

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_e8ba8d4c5bf4acf6e7c0b7b59c4aefdc_amadey_elex_floxif_rhadamanthys_smoke-loader

PE Signature issue

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

cabinet

oleaut32

version

generic