2026-11-03_fff4cffbda5fadad74f19ec7f82247af_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_fff4cffbda5fadad74f19ec7f82247af_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 587KB
Sample261104-a5g9daev3x
SHA256 7c37608c827ca25bffa9bbe5781fd3bf9ede9286bc60a4adfcb87348b7920987
MD5 fff4cffbda5fadad74f19ec7f82247af
SHA1 3a93136a5621115100e8cfa37615aafaa7b036bd
SHA512 15f4b46202b294a8a27b8951b2ddee96bd92e4d66c9f666a2748e8ba3d3573018025507f6fc98d0a4bbde42f41e58a5f2930f7790bc3800738205d0b7a106e39
SSDEEP 12288:NxX01VylmInKnO2Axg2Mcgzb55WWzA/EPHRBjvrEH7nC:NpgyZWO3gzb55WgbPrEH7C
TLSH
T19BD49D2076A0C2B6C15231702DA7E32965B9BE755F3547C7B7D02F2E6E391D29B3820E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-03_fff4cffbda5fadad74f19ec7f82247af_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-03_fff4cffbda5fadad74f19ec7f82247af_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 587KB

2026-11-03_fff4cffbda5fadad74f19ec7f82247af_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 23ef6b6a0a02ea6ff4afdaffe1ab857f
SHA256 7c37608c827ca25bffa9bbe5781fd3bf9ede9286bc60a4adfcb87348b7920987
MD5 fff4cffbda5fadad74f19ec7f82247af
SHA1 3a93136a5621115100e8cfa37615aafaa7b036bd
SHA512 15f4b46202b294a8a27b8951b2ddee96bd92e4d66c9f666a2748e8ba3d3573018025507f6fc98d0a4bbde42f41e58a5f2930f7790bc3800738205d0b7a106e39
SSDEEP 12288:NxX01VylmInKnO2Axg2Mcgzb55WWzA/EPHRBjvrEH7nC:NpgyZWO3gzb55WgbPrEH7C
TLSH
T19BD49D2076A0C2B6C15231702DA7E32965B9BE755F3547C7B7D02F2E6E391D29B3820E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

60:b1:58:8b:33:02:4f:a0:70:37:0c:7e:4c:a3:78:49:e7:4c:d4:9c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=ZTE CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ZTE CORPORATION,L=Shenzhen,ST=Guangdong,C=CN

Chains

Dec 31, 2014

CN=ZTE CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ZTE CORPORATION,L=Shenzhen,ST=Guangdong,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=ZTE CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ZTE CORPORATION,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

48:d6:38:3a:8d:14:9c:1c:dc:e6:9a:72:8b:dd:24:f6

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 9, 2012 - Apr 25, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

234075

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\SVN\daima\bin\ShowTip.pdb

kernel32

IsDebuggerPresent HeapAlloc HeapFree HeapReAlloc RtlUnwind RaiseException ExitProcess SetStdHandle GetFileType HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo SetUnhandledExceptionFilter GetOEMCP IsValidCodePage GetTimeFormatA GetDateFormatA GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringW InitializeCriticalSectionAndSpinCount LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap CreateFileA SetEnvironmentVariableA UnhandledExceptionFilter GetSystemTimeAsFileTime GetStartupInfoW SetErrorMode GlobalFlags GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetFileTime GetFileSizeEx GetFileAttributesW TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue InterlockedIncrement GetThreadLocale lstrlenA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GetModuleHandleA InterlockedDecrement GlobalAddAtomW FreeResource GlobalDeleteAtom ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FileTimeToLocalFileTime FileTimeToSystemTime GlobalLock GlobalUnlock FormatMessageW lstrlenW MulDiv GetTickCount OutputDebugStringA GlobalFree GlobalAlloc TerminateProcess LocalFree LocalAlloc GetCurrentThread FindClose FindFirstFileW CreateDirectoryW GetCurrentProcess GetCurrentProcessId WideCharToMultiByte GetVersionExW Sleep OutputDebugStringW SetLastError LoadLibraryW CreateFileW FreeLibrary MultiByteToWideChar GetProcAddress GetModuleHandleW WritePrivateProfileStringW GetPrivateProfileStringW ReleaseMutex GetCurrentThreadId GetSystemTime WaitForSingleObject CopyFileW DeleteFileW FindResourceW LoadResource LockResource SizeofResource CloseHandle GetTempPathW GetPrivateProfileIntW GetModuleFileNameW GetLastError GetACP CreateMutexW

user32

UnregisterClassW MessageBeep GetNextDlgGroupItem InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW CharNextW ReleaseCapture SetCapture CharUpperW LoadCursorW GetSysColorBrush RegisterWindowMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect CopyRect PtInRect DefWindowProcW CallWindowProcW GetMenu OffsetRect SystemParametersInfoA GetWindowPlacement GetWindowRect GetSysColor EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetWindowTextW SetFocus ShowWindow MoveWindow SetWindowLongW GetDlgCtrlID SetWindowTextW IsDialogMessageW SendDlgItemMessageW SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem EndDialog UnhookWindowsHookEx GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW GetActiveWindow DestroyMenu RegisterClipboardFormatW IsWindowVisible GetKeyState PostThreadMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindow SetWindowContextHelpId GetParent MapDialogRect SetWindowPos PostQuitMessage PostMessageW GetDesktopWindow GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu DestroyIcon EnableWindow KillTimer SetTimer DrawIcon GetClientRect GetSystemMetrics IsIconic SendMessageW LoadIconW TranslateMessage PeekMessageW DispatchMessageW IntersectRect

gdi32

GetMapMode GetRgnBox ExtTextOutW TextOutW RectVisible PtVisible Escape CreateRectRgnIndirect GetTextColor GetBkColor GetStockObject DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx GetDeviceCaps GetWindowExtEx GetViewportExtEx GetObjectW DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap SelectObject

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW ExtractIconW Shell_NotifyIconW ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW UrlUnescapeW PathFindExtensionW PathFindFileNameW PathStripToRootW PathRemoveFileSpecW PathIsUNCW

oledlg

OleUIBusyW

ole32

CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

SysAllocString OleCreateFontIndirect SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy VariantInit VariantChangeType VariantClear SysAllocStringLen SysFreeString SysStringLen

ws2_32

WSACleanup WSAGetLastError gethostbyname WSAStartup

wininet

InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallbackW InternetOpenW InternetGetLastResponseInfoW InternetCloseHandle HttpQueryInfoW InternetQueryDataAvailable InternetQueryOptionW InternetCrackUrlW InternetOpenUrlW InternetCanonicalizeUrlW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_fff4cffbda5fadad74f19ec7f82247af_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

wininet

generic