2026-06-30_d42cefefb3fa78724380134bfbad53af_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_d42cefefb3fa78724380134bfbad53af_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop
Size 409KB
Sample260701-c4brbaex2v
SHA256 21d6f2087c81a22f442e175c2ebbb966b18a52034a5c650be52443a6591a2f3f
MD5 d42cefefb3fa78724380134bfbad53af
SHA1 d02ca50fa6050c4ce08165231723b34e01abbe69
SHA512 ff9b0b72f898e145bb242e11cdf0a3433f5ec2978d5793fa1f0f514059cd32853edad9b3bc16fa92d43c2cfcb08d5d3dbd4613e1dbcd0808ec6b01da8810a479
SSDEEP 12288:E1GNX7daxRhD/W5vc9cHzpf6sFSqg4lPr/BjvrEH72m:zro7QvcWHzpf3a4xhrEH7h
TLSH
T1DA94B010F582C3F7D8A314B4B1B98F760CAA6539136E80E7A3A44AE94F6C3D1967570F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-30_d42cefefb3fa78724380134bfbad53af_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop

File Explorer

2026-06-30_d42cefefb3fa78724380134bfbad53af_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop

.exe 409KB

2026-06-30_d42cefefb3fa78724380134bfbad53af_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop

IMPHASH 592b911e681a28961b590d5de64f3f78
SHA256 21d6f2087c81a22f442e175c2ebbb966b18a52034a5c650be52443a6591a2f3f
MD5 d42cefefb3fa78724380134bfbad53af
SHA1 d02ca50fa6050c4ce08165231723b34e01abbe69
SHA512 ff9b0b72f898e145bb242e11cdf0a3433f5ec2978d5793fa1f0f514059cd32853edad9b3bc16fa92d43c2cfcb08d5d3dbd4613e1dbcd0808ec6b01da8810a479
SSDEEP 12288:E1GNX7daxRhD/W5vc9cHzpf6sFSqg4lPr/BjvrEH72m:zro7QvcWHzpf3a4xhrEH7h
TLSH
T1DA94B010F582C3F7D8A314B4B1B98F760CAA6539136E80E7A3A44AE94F6C3D1967570F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b8:d4:9e:6e:21:ff:a6:fd:fa:c0:8a:3c:7c:62:b4:c2:48:25:b8:d8:49:9b:38:63:59:2a:7a:fc:96:69:3e:3b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-4646191,CN=Yettiesoft co. Ltd,O=Yettiesoft co. Ltd,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Aug 29, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

6e:c6:8c:d7:ad:2f:d7:e4:71:92:2d:55:95:29:67:ff:0d:eb:b3:f2

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Aug 29, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

Serial Number

0b:b4:6f:4b:72:fc:f9:fd:66:d3:af:47:6d:9f:bf:7e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 16, 2023 - Nov 18, 2026

Minor OS version

Major OS version

Entry point

83294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\Goji_Release\Goji\Release\Goji.pdb

kernel32

OpenProcess ReadProcessMemory TerminateProcess WaitForSingleObject SetEnvironmentVariableA GetTimeZoneInformation GetCurrentProcess GetProcAddress LoadLibraryA Sleep CreateThread Process32NextW Process32FirstW GetCurrentDirectoryW GetFullPathNameW GetProcessHeap SetEndOfFile CompareStringW FindNextFileW DeleteFileA GetFileAttributesW FindFirstFileExW GetDriveTypeW FindClose CreateDirectoryW CreateFileA PeekNamedPipe GetFileInformationByHandle FileTimeToLocalFileTime FileTimeToSystemTime ResumeThread ExitThread CreateToolhelp32Snapshot DisconnectNamedPipe ConnectNamedPipe ReadFile GetOverlappedResult ResetEvent WaitForMultipleObjects CreateEventA GetLastError CreateNamedPipeA CloseHandle OutputDebugStringA GetModuleFileNameA GetFileAttributesA CreateDirectoryA HeapFree DecodePointer EncodePointer GetCommandLineA HeapSetInformation GetModuleHandleW ExitProcess EnterCriticalSection IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter HeapCreate HeapAlloc IsProcessorFeaturePresent RaiseException WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetConsoleCtrlHandler FreeLibrary LoadLibraryW SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar RtlUnwind HeapSize HeapReAlloc FlushFileBuffers SetStdHandle WriteConsoleW LCMapStringW GetStringTypeW CreateFileW SetEvent CreateMutexA ReleaseMutex SuspendThread GetCurrentDirectoryA UnmapViewOfFile MapViewOfFileEx CreateSemaphoreA ReleaseSemaphore CreateFileMappingA OpenFileMappingA GetLocalTime SetErrorMode FormatMessageA GetModuleHandleA LoadLibraryExA MapViewOfFile OutputDebugStringW GetCurrentThreadId LeaveCriticalSection GetConsoleWindow

user32

WaitForInputIdle

advapi32

DeleteService CloseServiceHandle OpenServiceA StartServiceCtrlDispatcherA RegSetValueExA RegisterServiceCtrlHandlerA RegQueryValueExA CreateServiceA RegDeleteKeyA RegCreateKeyA StartServiceA RegOpenKeyExA SetServiceStatus OpenSCManagerA ControlService RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken CreateProcessAsUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHGetSpecialFolderPathA SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

userenv

CreateEnvironmentBlock

ws2_32

getaddrinfo setsockopt sendto recv socket freeaddrinfo closesocket send inet_addr accept WSAStartup WSAGetLastError WSACleanup ntohl htonl htons ntohs inet_ntoa recvfrom getsockopt __WSAFDIsSet bind select connect ioctlsocket listen

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_d42cefefb3fa78724380134bfbad53af_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

shlwapi

userenv

ws2_32

generic