2026-08-01_dd0737af676290ca1a213f3e07c8f50e_amadey_elex_floxif_hijackloader_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_dd0737af676290ca1a213f3e07c8f50e_amadey_elex_floxif_hijackloader_rhadamanthys_stop
Size 461KB
Sample260802-efvkmatfnd
SHA256 0b587279bfb4c28cbc4af6145c5033fed7905e14ba2fd65c5527a4977da328b6
MD5 dd0737af676290ca1a213f3e07c8f50e
SHA1 831d2f41b6e3b938246c0139ec19f985f1701d03
SHA512 211881b603abaa039b1d2039e024f680a2ad589006e86169ee4f43c47a75e828abeac7c8aa3efc8eccbc8b2271931f09338d6010518ce25900c56b361703a241
SSDEEP 12288:/vNEG186VrIflKVRmX5HpKIi7r/UthtBjvrEH7M3:/a0relaRW5HpKI5rEH7M3
TLSH
T167A4C01077D0C7B2C59225323859D73966F6AD395F2582C7B3806A6DAE3D3C29A7830F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-01_dd0737af676290ca1a213f3e07c8f50e_amadey_elex_floxif_hijackloader_rhadamanthys_stop

File Explorer

2026-08-01_dd0737af676290ca1a213f3e07c8f50e_amadey_elex_floxif_hijackloader_rhadamanthys_stop

.exe 461KB

2026-08-01_dd0737af676290ca1a213f3e07c8f50e_amadey_elex_floxif_hijackloader_rhadamanthys_stop

IMPHASH 15469153035a2484976c6d5285cd5b5b
SHA256 0b587279bfb4c28cbc4af6145c5033fed7905e14ba2fd65c5527a4977da328b6
MD5 dd0737af676290ca1a213f3e07c8f50e
SHA1 831d2f41b6e3b938246c0139ec19f985f1701d03
SHA512 211881b603abaa039b1d2039e024f680a2ad589006e86169ee4f43c47a75e828abeac7c8aa3efc8eccbc8b2271931f09338d6010518ce25900c56b361703a241
SSDEEP 12288:/vNEG186VrIflKVRmX5HpKIi7r/UthtBjvrEH7M3:/a0relaRW5HpKI5rEH7M3
TLSH
T167A4C01077D0C7B2C59225323859D73966F6AD395F2582C7B3806A6DAE3D3C29A7830F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

34:e5:05:d8:9d:a5:7e:86:4a:d7:45:9a:0d:17:11:da:bf:77:b1:55:3e:26:5c:6c:1e:3b:e2:d6:81:03:e7:9c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Feb 3, 2023

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

d0:e0:4f:b5:40:35:ea:fc:b7:1f:08:6b:27:ce:ec:9e:cc:ac:a4:0d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Feb 3, 2023

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Serial Number

0f:f5:03:34:76:03:fb:03:4b:12:c6:db:62:fe:6c:3f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 14, 2022 - Apr 16, 2024

Minor OS version

Major OS version

Entry point

114827

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Data\src\_apluspoint\alupdate-windows\Bin\Release\DebugInfo\eausvc.pdb

kernel32

RtlUnwind ExitProcess RaiseException HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualFree VirtualAlloc HeapCreate GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetStartupInfoW GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode SetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileAttributesW CreateFileW SetEndOfFile SetFilePointer GlobalFindAtomW LoadLibraryA GetVersionExA lstrlenA GlobalAddAtomW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GlobalFlags GetModuleHandleA InterlockedDecrement WritePrivateProfileStringW SetLastError GlobalFree GlobalUnlock FormatMessageW LocalFree lstrlenW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW InterlockedExchange GlobalLock lstrcmpW GlobalAlloc GetModuleHandleW GetVersionExW TerminateProcess OpenProcess Process32NextW ProcessIdToSessionId lstrcmpiW Process32FirstW CreateToolhelp32Snapshot FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcess HeapFree DisconnectNamedPipe FlushFileBuffers WriteFile ReadFile HeapAlloc GetProcessHeap CreateThread ConnectNamedPipe CreateNamedPipeW MultiByteToWideChar WideCharToMultiByte Sleep GetCurrentProcessId GetLocalTime DeleteFileW FindClose FindFirstFileW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CloseHandle TerminateThread WaitForSingleObject GetLastError GetModuleFileNameW GetSystemDefaultLCID FindResourceW LoadResource LockResource GetTickCount SizeofResource

user32

GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics GetSysColorBrush GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW GetWindow GetCapture GetWindowRect GetWindowLongW GetClassNameW PtInRect GetWindowTextW SetWindowTextW GetSysColor ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW UnhookWindowsHookEx SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible SendMessageW GetKeyState PeekMessageW GetCursorPos ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu PostQuitMessage PostMessageW LoadCursorW SetCursor WinHelpW LoadIconW RegisterWindowMessageW GetDlgCtrlID DestroyMenu ShowWindow

gdi32

PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap GetStockObject GetDeviceCaps

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW CreateProcessAsUserW DuplicateTokenEx GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryValueExW RegOpenKeyExW DeleteService ControlService QueryServiceStatus StartServiceW OpenServiceW ChangeServiceConfig2W CreateServiceW OpenSCManagerW CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

shlwapi

PathQuoteSpacesW PathFindExtensionW

oleaut32

VariantChangeType VariantInit VariantClear

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_dd0737af676290ca1a213f3e07c8f50e_amadey_elex_floxif_hijackloader_rhadamanthys_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

userenv

generic