2026-08-08_ca75cee5dee2cf48861c4e0e3efea128_amadey_elex_floxif_smoke-loader_stealc_tofsee

General

Target
2026-08-08_ca75cee5dee2cf48861c4e0e3efea128_amadey_elex_floxif_smoke-loader_stealc_tofsee
Size 285KB
Sample260808-vsww8a1eme
SHA256 669cd95804540470ac30742bd911dca9dac607199730b07e09335593c3b69ca6
MD5 ca75cee5dee2cf48861c4e0e3efea128
SHA1 1bc687f6018ad77d4b08c58085dcc9b76725c5dd
SHA512 e174cb2580affe905368e012b195d7ff37f30173b207465a9ef45637bd41eb6bf28fc79b922c4cd103d3f2bab6cb3b1d95a866c179418456cbd0c421ce4d7b0e
SSDEEP 6144:B8sMBRPgL8emVPbp2OzzxQFXrVtTG+BV+UdvrEFp7hKLo7:B8sMXPgIem5p2azxIXrVFBjvrEH7Y6
TLSH
T17054BE303540C3F2C452117536A9AB71B9F9A93D237601C7B7582AB92E6C7E2A77930F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_ca75cee5dee2cf48861c4e0e3efea128_amadey_elex_floxif_smoke-loader_stealc_tofsee

File Explorer

2026-08-08_ca75cee5dee2cf48861c4e0e3efea128_amadey_elex_floxif_smoke-loader_stealc_tofsee

.exe 285KB

2026-08-08_ca75cee5dee2cf48861c4e0e3efea128_amadey_elex_floxif_smoke-loader_stealc_tofsee

IMPHASH 942955e336984bec735ab06f4df0b7fc
SHA256 669cd95804540470ac30742bd911dca9dac607199730b07e09335593c3b69ca6
MD5 ca75cee5dee2cf48861c4e0e3efea128
SHA1 1bc687f6018ad77d4b08c58085dcc9b76725c5dd
SHA512 e174cb2580affe905368e012b195d7ff37f30173b207465a9ef45637bd41eb6bf28fc79b922c4cd103d3f2bab6cb3b1d95a866c179418456cbd0c421ce4d7b0e
SSDEEP 6144:B8sMBRPgL8emVPbp2OzzxQFXrVtTG+BV+UdvrEFp7hKLo7:B8sMXPgIem5p2azxIXrVFBjvrEH7Y6
TLSH
T17054BE303540C3F2C452117536A9AB71B9F9A93D237601C7B7582AB92E6C7E2A77930F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

87608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

M:\MBRUtil\Release\MBRUtil.pdb

kernel32

DeviceIoControl CloseHandle LocalFree GetProcAddress LoadLibraryA GetModuleHandleA GetCurrentProcess GetConsoleOutputCP GetVersionExA GetVersion GetVolumeNameForVolumeMountPointA GetLogicalDriveStringsA SetFilePointerEx ReadFile GetFileSizeEx GetLastError GetLocaleInfoA GetNumberFormatA FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetFilePointer SetConsoleMode ReadConsoleInputA CreateFileW SetEnvironmentVariableA CompareStringW GetStdHandle SetConsoleCursorPosition WriteFile FormatMessageA CreateFileA GetComputerNameA HeapSize GetTimeZoneInformation EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileExA MultiByteToWideChar WideCharToMultiByte GetCommandLineA HeapSetInformation TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DecodePointer EncodePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection Sleep HeapFree GetModuleHandleW ExitProcess RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetFullPathNameA GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW HeapAlloc RaiseException IsProcessorFeaturePresent GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId HeapReAlloc LoadLibraryW FlushFileBuffers SetStdHandle WriteConsoleW GetStringTypeW GetDriveTypeW SetEndOfFile GetProcessHeap

user32

DispatchMessageA wsprintfA MessageBoxA GetMessageA ExitWindowsEx

advapi32

GetTokenInformation RegCloseKey RegOpenKeyExA RegQueryValueExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_ca75cee5dee2cf48861c4e0e3efea128_amadey_elex_floxif_smoke-loader_stealc_tofsee

kernel32

user32

advapi32

generic