2026-11-09_7be650970f57ed176f54c314b2fcee73_amadey_elex_floxif_rhadamanthys_smoke-loader_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_7be650970f57ed176f54c314b2fcee73_amadey_elex_floxif_rhadamanthys_smoke-loader_tofsee
Size 800KB
Sample261110-sd2g2say5l
SHA256 8b8d8abc9fbb612d465ca635baeaff1909f1c0c89754ac330a1a5672dc980f1f
MD5 7be650970f57ed176f54c314b2fcee73
SHA1 2952b1eb7a6c0d1a61de44eda2307a87f5335537
SHA512 6a3d8326b79481bb89d6372d884e0693b1a129cc127e79dc8d767d06760a43dfa6943d22bb7212b16180b9ff68ddcaaae0013886008521b1c6142c83d435cd2f
SSDEEP 6144:p1P/z9gBR4tZdw137o9uaNr7qlTP5lUSfI1ftMgKi7sSRtpMeK33nG5OfClBV+Ur:D/z9YRgg137o97Nr7O4NlBjvrEH7aB
TLSH
T17B05A3A02694E5D6F351CC74A0F5DFBF84F96C3909668006A6EAB6BD9B3E3753C05203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-09_7be650970f57ed176f54c314b2fcee73_amadey_elex_floxif_rhadamanthys_smoke-loader_tofsee

File Explorer

2026-11-09_7be650970f57ed176f54c314b2fcee73_amadey_elex_floxif_rhadamanthys_smoke-loader_tofsee

.exe 800KB

2026-11-09_7be650970f57ed176f54c314b2fcee73_amadey_elex_floxif_rhadamanthys_smoke-loader_tofsee

IMPHASH da7f3cb9b2ede4d3aa1a7fcc9722a992
SHA256 8b8d8abc9fbb612d465ca635baeaff1909f1c0c89754ac330a1a5672dc980f1f
MD5 7be650970f57ed176f54c314b2fcee73
SHA1 2952b1eb7a6c0d1a61de44eda2307a87f5335537
SHA512 6a3d8326b79481bb89d6372d884e0693b1a129cc127e79dc8d767d06760a43dfa6943d22bb7212b16180b9ff68ddcaaae0013886008521b1c6142c83d435cd2f
SSDEEP 6144:p1P/z9gBR4tZdw137o9uaNr7qlTP5lUSfI1ftMgKi7sSRtpMeK33nG5OfClBV+Ur:D/z9YRgg137o97Nr7O4NlBjvrEH7aB
TLSH
T17B05A3A02694E5D6F351CC74A0F5DFBF84F96C3909668006A6EAB6BD9B3E3753C05203
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

9d:4c:b4:76:da:35:61:79:3a:80:b9:1a:2b:64:e8:f8:67:0e:3a:cc

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Unity Technologies ApS,OU=SECURE APPLICATION DEVELOPMENT,O=Unity Technologies ApS,L=Copenhagen,ST=Copenhagen,C=DK

Chains

Oct 2, 2014

CN=Unity Technologies ApS,OU=SECURE APPLICATION DEVELOPMENT,O=Unity Technologies ApS,L=Copenhagen,ST=Copenhagen,C=DK

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Unity Technologies ApS,OU=SECURE APPLICATION DEVELOPMENT,O=Unity Technologies ApS,L=Copenhagen,ST=Copenhagen,C=DK

Serial Number

1e:8c:ad:a3:bd:09:4a:b8:e3:5b:ee:e8:01:43:12:ef

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Jul 3, 2013 - Aug 6, 2015

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

68136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\d3d49558e4d408f4\build\WindowsWebplugin\UnityBugReporter.pdb

kernel32

lstrlenW SetFileAttributesW DeleteFileW GetLastError RemoveDirectoryW GetCurrentProcess GetVersion CreateDirectoryW lstrcmpiW lstrlenA WriteFile FlushInstructionCache lstrcpyW ReadFile GetCurrentThreadId EnterCriticalSection LeaveCriticalSection SetLastError WaitForSingleObject CreateEventW CreateThread SetEvent FileTimeToDosDateTime GetFileSize SetFilePointer SystemTimeToFileTime FileTimeToSystemTime GetLocalTime GetFileType GetFileInformationByHandle GetPrivateProfileStringW WritePrivateProfileStringW lstrcpynW lstrcpyA ExpandEnvironmentStringsA GetModuleHandleW GetSystemInfo GetVersionExA SetFilePointerEx GetFileTime SetFileTime GetTickCount InterlockedPopEntrySList VirtualAlloc VirtualFree InterlockedPushEntrySList InterlockedCompareExchange GetProcessHeap FlushFileBuffers SetEnvironmentVariableA CompareStringW WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP GetStringTypeW RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW Sleep GetModuleFileNameW GetStdHandle DeleteCriticalSection InitializeCriticalSectionAndSpinCount LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP FindClose FindNextFileW lstrcmpW FindFirstFileW CloseHandle GetFileSizeEx CreateFileW GetLocaleInfoW GetUserDefaultLCID GlobalMemoryStatusEx MultiByteToWideChar FreeLibrary GetProcAddress LoadLibraryW FindResourceExW FindResourceW LoadResource LockResource SizeofResource RaiseException WideCharToMultiByte LocalFree FormatMessageA GetACP InterlockedDecrement InterlockedIncrement GetCPInfo HeapSize HeapReAlloc HeapDestroy HeapCreate TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW HeapSetInformation GetCommandLineW HeapAlloc GetTimeZoneInformation EncodePointer DecodePointer ExitProcess HeapFree

user32

DestroyWindow SetWindowLongW GetWindowLongW ReleaseDC CallWindowProcW GetSysColor SendMessageW GetDesktopWindow MonitorFromWindow GetDC CreateWindowExW DefWindowProcW MessageBoxW GetClientRect FillRect BeginPaint GetSystemMetrics DrawIcon GetWindowTextW GetWindowTextLengthW DrawTextW EndPaint GetDlgItem SetWindowTextW EndDialog wsprintfA PostMessageW EnableWindow UnregisterClassA SendDlgItemMessageW DialogBoxParamW GetActiveWindow DestroyIcon LoadIconW SetWindowPos LoadCursorW GetSysColorBrush SetCursor TrackMouseEvent

gdi32

SetPixelFormat SetBkColor GetTextExtentPoint32W SelectObject SetBkMode CreateSolidBrush SetTextColor CreateFontIndirectW GetObjectW DeleteObject ChoosePixelFormat

advapi32

RegCreateKeyExW RegCloseKey RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegSetValueExW

shell32

SHGetFolderPathW

ole32

CoSetProxyBlanket CoCreateInstance CoCreateGuid CoTaskMemFree CoInitialize

oleaut32

SysAllocString SysFreeString

shlwapi

PathFindFileNameW PathCombineW PathAppendW UrlEscapeW PathCompactPathW

opengl32

wglMakeCurrent glGetString wglCreateContext wglDeleteContext

wininet

InternetReadFile InternetCrackUrlW HttpQueryInfoW InternetSetOptionW InternetSetStatusCallbackW InternetConnectW InternetCloseHandle HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestExW InternetWriteFile InternetQueryDataAvailable InternetOpenW HttpEndRequestW

version

GetFileVersionInfoSizeW VerQueryValueA GetFileVersionInfoW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_7be650970f57ed176f54c314b2fcee73_amadey_elex_floxif_rhadamanthys_smoke-loader_tofsee

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

opengl32

wininet

version

generic