2026-07-20_f6bef68aca9ba09590a92da78ca4ef81_amadey_elex_floxif_hijackloader_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_f6bef68aca9ba09590a92da78ca4ef81_amadey_elex_floxif_hijackloader_rhadamanthys_stop
Size 461KB
Sample260720-rbslpact2j
SHA256 18481af75269dc820739b43fe9abae307fce26215bc12bb4899593014e105aac
MD5 f6bef68aca9ba09590a92da78ca4ef81
SHA1 c1f49d746f94c26d0d5a125186741117c278434a
SHA512 7234a41af32e605074446eab642639ed9e5637ac1455a3941e8c968c8e19fb47d5189dec1577d0d8dffb9e71777f77245643157bef6d0734143680ac4fff16bf
SSDEEP 12288:m9vNEeS66VrIflKVRmX5HpKIi7r/UthtBjvrEH7S:mt0relaRW5HpKI5rEH7S
TLSH
T120A4BF1077D0C7B2D65225323859973966FAAD395F2582C7B3502A6DEE3C3C29A7830F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_f6bef68aca9ba09590a92da78ca4ef81_amadey_elex_floxif_hijackloader_rhadamanthys_stop

File Explorer

2026-07-20_f6bef68aca9ba09590a92da78ca4ef81_amadey_elex_floxif_hijackloader_rhadamanthys_stop

.exe 461KB

2026-07-20_f6bef68aca9ba09590a92da78ca4ef81_amadey_elex_floxif_hijackloader_rhadamanthys_stop

IMPHASH 15469153035a2484976c6d5285cd5b5b
SHA256 18481af75269dc820739b43fe9abae307fce26215bc12bb4899593014e105aac
MD5 f6bef68aca9ba09590a92da78ca4ef81
SHA1 c1f49d746f94c26d0d5a125186741117c278434a
SHA512 7234a41af32e605074446eab642639ed9e5637ac1455a3941e8c968c8e19fb47d5189dec1577d0d8dffb9e71777f77245643157bef6d0734143680ac4fff16bf
SSDEEP 12288:m9vNEeS66VrIflKVRmX5HpKIi7r/UthtBjvrEH7S:mt0relaRW5HpKI5rEH7S
TLSH
T120A4BF1077D0C7B2D65225323859973966FAAD395F2582C7B3502A6DEE3C3C29A7830F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

29:34:3b:ca:7d:38:22:22:b5:fd:20:d9:b6:f9:3c:74:27:45:33:b5:1b:37:c2:e9:d4:08:32:ea:bd:04:b3:15

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Feb 3, 2023

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

80:ba:06:bd:5c:9b:f7:6b:5c:f1:6f:17:45:3b:98:4f:5e:f7:7a:bc

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Feb 3, 2023

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Serial Number

0f:f5:03:34:76:03:fb:03:4b:12:c6:db:62:fe:6c:3f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 14, 2022 - Apr 16, 2024

Minor OS version

Major OS version

Entry point

114827

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Data\src\_apluspoint\alupdate-windows\Bin\Release\DebugInfo\eausvc.pdb

kernel32

RtlUnwind ExitProcess RaiseException HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualFree VirtualAlloc HeapCreate GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetStartupInfoW GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode SetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileAttributesW CreateFileW SetEndOfFile SetFilePointer GlobalFindAtomW LoadLibraryA GetVersionExA lstrlenA GlobalAddAtomW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GlobalFlags GetModuleHandleA InterlockedDecrement WritePrivateProfileStringW SetLastError GlobalFree GlobalUnlock FormatMessageW LocalFree lstrlenW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW InterlockedExchange GlobalLock lstrcmpW GlobalAlloc GetModuleHandleW GetVersionExW TerminateProcess OpenProcess Process32NextW ProcessIdToSessionId lstrcmpiW Process32FirstW CreateToolhelp32Snapshot FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcess HeapFree DisconnectNamedPipe FlushFileBuffers WriteFile ReadFile HeapAlloc GetProcessHeap CreateThread ConnectNamedPipe CreateNamedPipeW MultiByteToWideChar WideCharToMultiByte Sleep GetCurrentProcessId GetLocalTime DeleteFileW FindClose FindFirstFileW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CloseHandle TerminateThread WaitForSingleObject GetLastError GetModuleFileNameW GetSystemDefaultLCID FindResourceW LoadResource LockResource GetTickCount SizeofResource

user32

GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics GetSysColorBrush GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW GetWindow GetCapture GetWindowRect GetWindowLongW GetClassNameW PtInRect GetWindowTextW SetWindowTextW GetSysColor ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW UnhookWindowsHookEx SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible SendMessageW GetKeyState PeekMessageW GetCursorPos ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu PostQuitMessage PostMessageW LoadCursorW SetCursor WinHelpW LoadIconW RegisterWindowMessageW GetDlgCtrlID DestroyMenu ShowWindow

gdi32

PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap GetStockObject GetDeviceCaps

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW CreateProcessAsUserW DuplicateTokenEx GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryValueExW RegOpenKeyExW DeleteService ControlService QueryServiceStatus StartServiceW OpenServiceW ChangeServiceConfig2W CreateServiceW OpenSCManagerW CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

shlwapi

PathQuoteSpacesW PathFindExtensionW

oleaut32

VariantChangeType VariantInit VariantClear

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_f6bef68aca9ba09590a92da78ca4ef81_amadey_elex_floxif_hijackloader_rhadamanthys_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

userenv

generic