2026-07-15_8f4a70972b36c7d86ea49026b10c8136_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_8f4a70972b36c7d86ea49026b10c8136_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader
Size 987KB
Sample260715-e8g51abx6m
SHA256 4afea8cde6f8f771db04578fd166ebdbb22c7c1fa307b97334923307d5a60493
MD5 8f4a70972b36c7d86ea49026b10c8136
SHA1 4debcdfb3308ee87ab8bf96f8447dad4e185daa9
SHA512 12a5c5f9b45a53016a50d94bc074955827afac76e161f297f56121d1c60ab5045381eab48ba3cedf6e5d78d8f282a9550cecce2af62f20033dcb60bbefc2b904
SSDEEP 12288:bZxSFwmxpHL/f3vCN1PMaLi6rAyIQjUBjvrEH7I:FxSFwANf3qN1PvKrEH7I
TLSH
T1AD25C411E7FB8239F9F36F7C697952620A76BCA19E38D64E1340065D08F4A90DA74B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-15_8f4a70972b36c7d86ea49026b10c8136_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader

File Explorer

2026-07-15_8f4a70972b36c7d86ea49026b10c8136_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader

.exe 987KB

2026-07-15_8f4a70972b36c7d86ea49026b10c8136_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader

IMPHASH 3ab7cc62e4963955ad408cd420cd8ef1
SHA256 4afea8cde6f8f771db04578fd166ebdbb22c7c1fa307b97334923307d5a60493
MD5 8f4a70972b36c7d86ea49026b10c8136
SHA1 4debcdfb3308ee87ab8bf96f8447dad4e185daa9
SHA512 12a5c5f9b45a53016a50d94bc074955827afac76e161f297f56121d1c60ab5045381eab48ba3cedf6e5d78d8f282a9550cecce2af62f20033dcb60bbefc2b904
SSDEEP 12288:bZxSFwmxpHL/f3vCN1PMaLi6rAyIQjUBjvrEH7I:FxSFwANf3qN1PvKrEH7I
TLSH
T1AD25C411E7FB8239F9F36F7C697952620A76BCA19E38D64E1340065D08F4A90DA74B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

97:aa:3c:aa:8e:6c:dc:f8:84:e5:5e:52:1e:6e:a7:90:a6:f5:ee:de:75:1d:9c:24:04:4f:5b:82:bd:3f:89:a8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

Chains

Apr 19, 2022

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

a8:08:2f:33:bb:aa:d3:cd:cf:b3:34:82:22:57:e0:f3:c7:2d:ad:a6

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

Chains

Apr 19, 2022

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

Serial Number

8b:a1:f1:72:fd:50:ba:8d:4c:11:b7:4f:fa:c8:a2:82

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2021 - Mar 24, 2024

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

135530

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

DpInst.pdb

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken IsTextUnicode SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid SetEntriesInAclW DeleteService StartServiceW ControlService OpenSCManagerW CloseServiceHandle OpenServiceW QueryServiceStatus RegDeleteValueW RegCreateKeyExW RegSetValueExW RegDeleteKeyW CheckTokenMembership ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

GetFileAttributesW DeleteFileW ReleaseMutex SetFilePointer HeapFree GetProcessHeap HeapAlloc CreateMutexW FreeConsole SetConsoleMode SetConsoleCursorPosition GetConsoleScreenBufferInfo FreeLibrary FillConsoleOutputCharacterW ReadConsoleOutputW GetConsoleMode GetStdHandle GetProcAddress LoadLibraryW WriteConsoleW IsValidLocale lstrlenW lstrcmpW CompareStringW GetTempFileNameW FindFirstFileW FindNextFileW FindClose CopyFileW SetFileAttributesW FormatMessageW RaiseException GetFileSize CreateFileMappingW MapViewOfFile WriteConsoleOutputW UnmapViewOfFile InterlockedDecrement InterlockedIncrement CreateFileW WriteFile CreateThread WaitForMultipleObjectsEx InterlockedCompareExchange WaitForSingleObjectEx SetEvent CreateEventW GetExitCodeProcess DeviceIoControl VerSetConditionMask VerifyVersionInfoW CreateDirectoryW RemoveDirectoryW GetCurrentDirectoryW GetShortPathNameW GetFullPathNameW GetSystemDirectoryW GetSystemWindowsDirectoryW MoveFileExW SearchPathW GetSystemDefaultUILanguage LoadLibraryExW CreateFileA SetEndOfFile GetConsoleOutputCP WriteConsoleA GetLocaleInfoW FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA GetConsoleCP GetLocaleInfoA Sleep LoadLibraryExA ReadFile LCMapStringW LCMapStringA GetThreadLocale SetThreadLocale GetUserDefaultUILanguage GetVersionExW GetLocalTime GetWindowsDirectoryW GetModuleFileNameW SetCurrentDirectoryW WaitForSingleObject GetOEMCP GetACP GetCPInfo UnhandledExceptionFilter TerminateProcess OutputDebugStringA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapCreate GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA GetFileType SetHandleCount GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA ExitProcess GetModuleHandleA SetUnhandledExceptionFilter VirtualQuery GetSystemInfo GetModuleHandleW VirtualAlloc VirtualProtect GetStartupInfoW GetEnvironmentVariableW lstrcmpiW WideCharToMultiByte InterlockedExchange HeapSize HeapReAlloc HeapDestroy GetVersionExA DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection GetCommandLineW LocalAlloc GlobalFree LocalFree MultiByteToWideChar GetCurrentProcess GetLastError CloseHandle FindResourceExW FindResourceW LoadResource LockResource SizeofResource EnumResourceLanguagesW LocalReAlloc EnterCriticalSection

gdi32

SetLayout DeleteDC GetObjectW CreateCompatibleBitmap CreateBitmap SelectObject StartPage EndPage StartDocW EndDoc GetTextMetricsW GetDeviceCaps CreateFontIndirectW DeleteObject CreateCompatibleDC

user32

AllowSetForegroundWindow DefWindowProcW PostQuitMessage GetUserObjectInformationW GetProcessWindowStation GetIconInfo DrawIconEx CreateIconIndirect LoadIconW LoadBitmapW DrawTextExW LoadImageW GetSystemMetrics GetSysColor DestroyWindow GetWindowLongW SendDlgItemMessageW InvalidateRect SystemParametersInfoW GetDC ReleaseDC SetWindowLongW SetWindowTextW GetParent PostMessageW IsDlgButtonChecked CheckDlgButton SetFocus CallWindowProcW DestroyIcon DialogBoxParamW SetDlgItemTextW CharLowerW GetDlgItem SendMessageW MessageBoxW RegisterClassExW CreateWindowExW ShowWindow UnregisterClassA EndDialog

ntdll

RtlNtStatusToDosError NtOpenThreadToken NtQueryInformationToken NtOpenProcessToken RtlUnwind NtClose

shell32

SHGetFolderPathW ShellExecuteExW ord59 CommandLineToArgvW

setupapi

SetupDiClassNameFromGuidW SetupDiOpenClassRegKey SetupInstallFilesFromInfSectionW SetupPromptReboot SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW SetupDiGetActualSectionToInstallW SetupFindNextLine SetupFindNextMatchLineW SetupOpenInfFileW SetupGetLineCountW SetupCloseInfFile SetupFindFirstLineW SetupGetStringFieldW pSetupSetGlobalFlags pSetupGetGlobalFlags SetupGetFieldCount SetupGetIntField SetupOpenAppendInfFileW SetupDiSetClassInstallParamsW SetupDiGetClassDevsW SetupDiGetSelectedDriverW SetupDiGetDriverInfoDetailW CM_Enumerate_Classes CM_Get_DevNode_Status SetupDiCreateDeviceInfoList SetupDiSetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiOpenDevRegKey SetupDiOpenDeviceInfoW SetupDiSetSelectedDevice SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiBuildDriverInfoList SetupDiCallClassInstaller SetupDiGetDeviceRegistryPropertyW SetupGetTargetPathW SetupQueueCopyIndirectW SetupQueueCopyW SetupOpenFileQueue SetupInitDefaultQueueCallbackEx SetupDefaultQueueCallbackW SetupCommitFileQueueW SetupTermDefaultQueueCallback SetupCloseFileQueue SetupCopyOEMInfW CM_Locate_DevNodeW CM_Get_Device_ID_List_SizeW CM_Get_Device_ID_ListW CM_Get_Device_IDW CM_Setup_DevNode SetupDiEnumDeviceInfo CMP_WaitNoPendingInstallEvents CM_Query_And_Remove_SubTreeW

wintrust

WinVerifyTrust CryptCATAdminCalcHashFromFileHandle

ole32

CoTaskMemFree StringFromCLSID CoUninitialize CoInitialize CoCreateInstance

oleaut32

VariantInit VariantClear VariantChangeType SysAllocString SysFreeString

comctl32

CreatePropertySheetPageW ImageList_ReplaceIcon ImageList_SetBkColor PropertySheetW ImageList_Create

comdlg32

PrintDlgExW GetSaveFileNameW

crypt32

CertFreeCertificateContext CertFreeCTLContext CertGetCTLContextProperty CryptQueryObject

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_8f4a70972b36c7d86ea49026b10c8136_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader

PE Signature issue

PE Signature issue

advapi32

kernel32

gdi32

user32

ntdll

shell32

setupapi

wintrust

ole32

oleaut32

comctl32

comdlg32

crypt32

version

generic