2026-11-03_ebecbeccc041da50448decce7cc9bad6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_ebecbeccc041da50448decce7cc9bad6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 200KB
Sample261104-eet8gax1hv
SHA256 c7d5465b62bb888976827b87e02909d3d5b65a0789a50083c6847d999cc8bd89
MD5 ebecbeccc041da50448decce7cc9bad6
SHA1 a8d7cfdbecd0cfe8c6210ffac9866bd65234948c
SHA512 6e258db13b8149dad047879a53c4ad6063fa66071981778f694bafa6b564c4f4592f6973801984f7304854df8370ffff8fd88658aa45f4837f4b5e8e9047cec3
SSDEEP 6144:JdOj8sLq5MXV8aZkGMBV+UdvrEFp7hKhv:JdOj8su5MXqaWGMBjvrEH78v
TLSH
T18814AE113280C3FAD496143079ACABA15AF9E83D07AE40C7B3A50B6D5F6C7C35A7971B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-03_ebecbeccc041da50448decce7cc9bad6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-03_ebecbeccc041da50448decce7cc9bad6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

.exe 200KB

2026-11-03_ebecbeccc041da50448decce7cc9bad6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

IMPHASH 2817bb13896acd253922c0b39f2c6765
SHA256 c7d5465b62bb888976827b87e02909d3d5b65a0789a50083c6847d999cc8bd89
MD5 ebecbeccc041da50448decce7cc9bad6
SHA1 a8d7cfdbecd0cfe8c6210ffac9866bd65234948c
SHA512 6e258db13b8149dad047879a53c4ad6063fa66071981778f694bafa6b564c4f4592f6973801984f7304854df8370ffff8fd88658aa45f4837f4b5e8e9047cec3
SSDEEP 6144:JdOj8sLq5MXV8aZkGMBV+UdvrEFp7hKhv:JdOj8su5MXqaWGMBjvrEH78v
TLSH
T18814AE113280C3FAD496143079ACABA15AF9E83D07AE40C7B3A50B6D5F6C7C35A7971B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a4:ed:bb:93:94:09:8d:5c:ef:ed:13:16:1c:41:d9:38:b1:04:bd:51:61:47:3b:80:71:07:0c:84:ae:3b:b0:f0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Sophos BV,O=Sophos BV,L=Hengelo,C=NL

Chains

Feb 5, 2026

CN=Sophos BV,O=Sophos BV,L=Hengelo,C=NL

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Sophos BV,O=Sophos BV,L=Hengelo,C=NL

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Sophos BV,O=Sophos BV,L=Hengelo,C=NL

Serial Number

0e:86:0f:95:e6:ec:c9:51:97:4d:df:41:a1:d8:93:25

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 31, 2025 - Apr 16, 2027

Minor OS version

Major OS version

Entry point

20798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\SurfRight\Producten\HitmanPro35\bin\x86\Release MT\Scheduler.pdb

shlwapi

PathCombineW

kernel32

WTSGetActiveConsoleSessionId SetEvent WaitForMultipleObjects SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP GetModuleFileNameW GetCurrentProcess GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetTimeZoneInformation WriteConsoleA GetVersionExW LocalFree CreateEventW LocalAlloc GetModuleHandleW OpenMutexW GetLongPathNameW OpenProcess Sleep CreateWaitableTimerW CreateMutexW GetCurrentProcessId ProcessIdToSessionId SetWaitableTimer CreateProcessW OpenEventW GetLocalTime FileTimeToSystemTime CompareFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetLastError LeaveCriticalSection CloseHandle WriteFile SetFilePointer CreateFileW EnterCriticalSection GetModuleHandleA InitializeCriticalSection RaiseException SetStdHandle LoadLibraryA RtlUnwind InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP WideCharToMultiByte GetTickCount HeapAlloc HeapFree GetSystemTimeAsFileTime GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetProcAddress ExitProcess GetStdHandle GetModuleFileNameA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter

user32

MessageBoxA SetTimer PeekMessageW CreateWindowExW RegisterClassExW LoadIconW DefWindowProcW KillTimer PostQuitMessage GetWindowThreadProcessId GetWindowLongW GetSystemMetrics GetWindowRect GetWindowTextA GetDesktopWindow GetTopWindow GetForegroundWindow MsgWaitForMultipleObjectsEx DispatchMessageW TranslateMessage IsDialogMessageW

gdi32

GetStockObject

advapi32

ControlService StartServiceW DeleteService OpenServiceW CloseServiceHandle ChangeServiceConfig2W CreateServiceW OpenSCManagerW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus RevertToSelf ImpersonateLoggedOnUser GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW SetTokenInformation DuplicateTokenEx OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW RegOpenKeyW CreateProcessAsUserW FreeSid CheckTokenMembership AllocateAndInitializeSid RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

CommandLineToArgvW SHGetFolderPathW

wtsapi32

WTSQueryUserToken

psapi

GetModuleFileNameExW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_ebecbeccc041da50448decce7cc9bad6_amadey_elex_floxif_rhadamanthys_smoke-loader_stop

PE Signature issue

shlwapi

kernel32

user32

gdi32

advapi32

shell32

wtsapi32

psapi

userenv

generic