2026-08-03_cafeb2db6b1dfb88eade709a5165f31f_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_cafeb2db6b1dfb88eade709a5165f31f_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader
Size 1.4MB
Sample260804-lpmppsxamf
SHA256 72c1af4d1a2503d42dd4f8807d62bdc0b7bdc1d0eab13c1eb27e38ecf3e67973
MD5 cafeb2db6b1dfb88eade709a5165f31f
SHA1 ebb83dbec419f587cb9d8e0cd0b923b8ff275254
SHA512 ab2b8d0062c57f44941e74b6c8f39c0bcccc5a774f98efbb8bfd8d37735ca76d02fc9010bdca59e50bb6d71fd7ce30856cf877d12edb78286ffc81f3e447b467
SSDEEP 24576:vL5W1snftlnJhf2n2A3DTv3IHv+/cEaQEprrCWBVtCOGpGITPvj7m+2rEH7JV:vLw1sn/7U2AG+EEaQEprCWfNCT3jy+TV
TLSH
T11B65AF13D7038235E1E100B7C57D97B6AA786B74231590E3E3C859E86AE85D1BE3E24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-03_cafeb2db6b1dfb88eade709a5165f31f_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader

File Explorer

2026-08-03_cafeb2db6b1dfb88eade709a5165f31f_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader

.exe 1.4MB

2026-08-03_cafeb2db6b1dfb88eade709a5165f31f_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader

IMPHASH 5483ae80bff8efdcf079eabc7e813443
SHA256 72c1af4d1a2503d42dd4f8807d62bdc0b7bdc1d0eab13c1eb27e38ecf3e67973
MD5 cafeb2db6b1dfb88eade709a5165f31f
SHA1 ebb83dbec419f587cb9d8e0cd0b923b8ff275254
SHA512 ab2b8d0062c57f44941e74b6c8f39c0bcccc5a774f98efbb8bfd8d37735ca76d02fc9010bdca59e50bb6d71fd7ce30856cf877d12edb78286ffc81f3e447b467
SSDEEP 24576:vL5W1snftlnJhf2n2A3DTv3IHv+/cEaQEprrCWBVtCOGpGITPvj7m+2rEH7JV:vLw1sn/7U2AG+EEaQEprCWfNCT3jy+TV
TLSH
T11B65AF13D7038235E1E100B7C57D97B6AA786B74231590E3E3C859E86AE85D1BE3E24F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b2:a6:a3:70:5c:74:1e:6f:f1:ca:69:e8:ce:18:54:73:e2:0c:10:f7:0e:7a:a8:a3:34:17:da:62:c1:19:d6:4f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Sep 16, 2024

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

44:85:59:e8:d5:9f:e0:56:29:9e:6e:8f

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2023 - Oct 9, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

762890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\16-09-2024\WindowsBuilds\DC_NATIVE\9093392\desktopcentral\ONPREMISE\SA_SRC\native\agent\Release\dcagentservice.pdb

advapi32

RevertToSelf RegOpenCurrentUser ImpersonateLoggedOnUser RegCloseKey RegOpenKeyExW RegCreateKeyExW RegEnumKeyExW RegQueryValueExW RegSetValueExW CloseServiceHandle CreateServiceW OpenSCManagerW DeleteService OpenServiceW SetServiceStatus RegCreateKeyW RegQueryValueExA RegOpenKeyExA ChangeServiceConfigW QueryServiceConfigW StartServiceCtrlDispatcherW CreateProcessAsUserW LookupAccountSidW GetTokenInformation OpenProcessToken RegCreateKeyExA RegisterServiceCtrlHandlerExW RegNotifyChangeKeyValue SetNamedSecurityInfoW RegQueryInfoKeyW RegEnumKeyW RegDeleteKeyA RegEnumKeyExA RegSetValueExA RegQueryInfoKeyA LookupPrivilegeNameA LookupPrivilegeValueA CreateProcessAsUserA LogonUserA RegDeleteValueA RegDeleteValueW RegEnumKeyA RegOpenKeyA GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid LookupAccountNameA CryptDestroyKey CryptReleaseContext CryptGenKey CryptGetUserKey CryptAcquireContextA ControlService OpenServiceA OpenSCManagerA QueryServiceStatusEx RegEnumValueA CryptDestroyHash CryptHashData CryptCreateHash DeregisterEventSource ReportEventA RegisterEventSourceA SetTokenInformation DuplicateTokenEx CryptGetHashParam QueryServiceStatus LookupAccountSidA

ole32

StringFromGUID2 CoInitializeEx CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitializeSecurity

oleaut32

SysFreeString SysAllocString SysStringLen SysAllocStringByteLen VariantClear VariantInit SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationA WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory

psapi

GetModuleFileNameExW EnumProcesses GetModuleBaseNameW EnumProcessModules

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile LoadUserProfileW LoadUserProfileA

wsock32

WSACleanup WSAGetLastError WSAStartup

netapi32

NetApiBufferFree NetGetJoinInformation NetWkstaUserGetInfo

crypt32

CryptQueryObject CryptStringToBinaryA CertCreateCertificateContext CertCloseStore CertAddCertificateContextToStore CertEnumCertificatesInStore CertOpenStore PFXImportCertStore PFXVerifyPassword CertDeleteCertificateFromStore CertVerifyTimeValidity CertFreeCertificateContext CertNameToStrW CertGetNameStringA CertFindCertificateInStore CryptMsgGetParam

winhttp

WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSetOption WinHttpReadData WinHttpQueryHeaders WinHttpConnect WinHttpSetCredentials WinHttpWriteData WinHttpQueryOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpSetStatusCallback WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest

dcagenthttp

AgentSendRequestEx

dclibxml2

xmlNewTextReaderFilename xmlStrcmp xmlFreeTextReader xmlTextReaderRead xmlTextReaderName xmlTextReaderDepth xmlTextReaderValue xmlTextReaderAttributeCount xmlTextReaderGetAttribute xmlCleanupParser xmlParseMemory xmlNodeListGetString xmlFree xmlDocGetRootElement xmlFreeDoc xmlParseFile

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW

shell32

SHCreateDirectoryExW SHCreateDirectoryExA

shlwapi

PathIsDirectoryA StrStrIW PathFindExtensionA PathFileExistsW StrStrIA StrTrimA

kernel32

GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy DeleteCriticalSection RaiseException MoveFileExA LocalLock InterlockedExchange DecodePointer GetLocaleInfoW GetStringTypeW RtlUnwind GetCommandLineA HeapSetInformation GetFileType PeekNamedPipe GetDriveTypeA FindFirstFileExA LocalUnlock DuplicateHandle GetCPInfo ExitThread ExitProcess EncodePointer CompareStringW LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree HeapCreate GetACP GetOEMCP IsValidCodePage SetHandleCount GetStdHandle GetStartupInfoW FreeEnvironmentStringsW GetEnvironmentStringsW GetConsoleCP GetConsoleMode SetStdHandle GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CreatePipe WriteConsoleW SetEndOfFile VirtualQuery SetEnvironmentVariableA ResumeThread SuspendThread GetNativeSystemInfo lstrcmpiA GetVersion lstrcmpW DisconnectNamedPipe SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar CloseHandle GetLastError DeleteFileW CreateDirectoryA GetProcAddress GetModuleHandleW InterlockedIncrement LocalFree GetModuleFileNameW LoadLibraryW Process32NextW Process32FirstW CreateToolhelp32Snapshot SystemTimeToFileTime GetCurrentProcess TerminateProcess OpenProcess CreateThread WideCharToMultiByte LocalAlloc lstrlenW FormatMessageW GetSystemTime FreeConsole GenerateConsoleCtrlEvent GetExitCodeProcess Sleep InterlockedDecrement WriteFile CreateFileA CreateProcessW GetCurrentProcessId WaitForSingleObject CreateFileW DeleteTimerQueue CreateTimerQueueTimer CreateTimerQueue GetCurrentThreadId FileTimeToLocalFileTime GetSystemTimeAsFileTime SetEvent OpenEventA DeleteTimerQueueTimer ReadFile GetTickCount CreateEventW FreeLibrary SetConsoleCtrlHandler DeviceIoControl GetDriveTypeW LeaveCriticalSection InitializeCriticalSection EnterCriticalSection TerminateThread MapViewOfFile CreateFileMappingW UnmapViewOfFile GetLocalTime ReleaseMutex WaitForMultipleObjects GetModuleHandleA lstrlenA GetFileSizeEx CreateDirectoryW CreateProcessA SetCurrentDirectoryA GetCurrentDirectoryA Process32Next ProcessIdToSessionId Process32First SetCurrentDirectoryW SetFilePointer LoadLibraryA DeleteFileA GetFileInformationByHandle GetModuleFileNameA ConnectNamedPipe CreateNamedPipeA SetLastError GetCurrentDirectoryW FileTimeToSystemTime GetSystemDirectoryA CopyFileA FindClose FindNextFileA SystemTimeToTzSpecificLocalTime FindFirstFileA ExpandEnvironmentStringsA GetSystemInfo GetVersionExA GetComputerNameExW FormatMessageA GetFileSize RemoveDirectoryA SetDllDirectoryA CreateMutexA GetTimeZoneInformation FindFirstFileW GetEnvironmentVariableA GetFileAttributesA GetLocaleInfoA FindNextFileW GetEnvironmentVariableW GetFileAttributesExA GetFullPathNameA InitializeCriticalSectionAndSpinCount QueryPerformanceCounter FlushFileBuffers CopyFileW

user32

UnregisterDeviceNotification wsprintfW wsprintfA RegisterDeviceNotificationW MessageBoxA

odbc32

ord39 ord36 ord9 ord41 ord31 ord1 ord2 ord20 ord16 ord12 ord19 ord3 ord49 ord48 ord72 ord26 ord13 ord29 ord8 ord18 ord11 ord43 ord4

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_cafeb2db6b1dfb88eade709a5165f31f_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader

PE Signature issue

advapi32

ole32

oleaut32

wtsapi32

psapi

userenv

wsock32

netapi32

crypt32

winhttp

dcagenthttp

dclibxml2

setupapi

shell32

shlwapi

kernel32

user32

odbc32

generic