2026-08-09_19635f05e556f46fe5f359c4a79dc077_amadey_elex_floxif_hijackloader_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_19635f05e556f46fe5f359c4a79dc077_amadey_elex_floxif_hijackloader_remcos_stop
Size 2.2MB
Sample260809-hvfa2ahd22
SHA256 01c8957b80caf08d16fe92de1a2e512035b3f4e10dafdf3ea451e730f7dcc571
MD5 19635f05e556f46fe5f359c4a79dc077
SHA1 14919d65d73aba985013341bc8d736d4a50b0eea
SHA512 2dab12ddc32d4ddb23a08ef499ce5df816a55edca674d8b056a2f46150ab467202a5c33e68df3a805eaf9ea5d9aa753dbd0b696591ad695a6739d384c74deb47
SSDEEP 49152:odseFFnQWNk+ddfmUcvW9mggvmeWI3IFjfyk3NV5Oq2l:xWFnQsYhW9V6k3vbY
TLSH
T1B9A523207790C3BAC94302319A5AE7AB59EDB53D0B7652C7F398072D9F782D28634B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_19635f05e556f46fe5f359c4a79dc077_amadey_elex_floxif_hijackloader_remcos_stop

File Explorer

2026-08-09_19635f05e556f46fe5f359c4a79dc077_amadey_elex_floxif_hijackloader_remcos_stop

.exe 2.2MB

2026-08-09_19635f05e556f46fe5f359c4a79dc077_amadey_elex_floxif_hijackloader_remcos_stop

IMPHASH 33cad3c4dcfa32e50442d1412d415563
SHA256 01c8957b80caf08d16fe92de1a2e512035b3f4e10dafdf3ea451e730f7dcc571
MD5 19635f05e556f46fe5f359c4a79dc077
SHA1 14919d65d73aba985013341bc8d736d4a50b0eea
SHA512 2dab12ddc32d4ddb23a08ef499ce5df816a55edca674d8b056a2f46150ab467202a5c33e68df3a805eaf9ea5d9aa753dbd0b696591ad695a6739d384c74deb47
SSDEEP 49152:odseFFnQWNk+ddfmUcvW9mggvmeWI3IFjfyk3NV5Oq2l:xWFnQsYhW9V6k3vbY
TLSH
T1B9A523207790C3BAC94302319A5AE7AB59EDB53D0B7652C7F398072D9F782D28634B47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

30:10:52:28:e2:6a:b6:57:38:6a:b2:f3:c6:20:e8:04:45:ad:8c:10:f8:42:6a:b1:80:ee:13:d2:c5:73:df:42

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES

Chains

Jan 22, 2025

CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES

Serial Number

01:44:e5:1c:11:d9:c2:9d:6c:f7:65:c5:89:27:19:ad

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2024 - Nov 14, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

166496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetStdHandle WaitForMultipleObjects Sleep VirtualAlloc VirtualFree GetVersionExA WaitForSingleObject CreateEventA SetEvent ResetEvent InitializeCriticalSection GetExitCodeProcess CreateProcessA GetCommandLineW GetVersionExW lstrcmpiW HeapAlloc GetCurrentProcess HeapFree TerminateProcess GetFileInformationByHandle CreateFileA GetConsoleOutputCP WriteConsoleA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetLocaleInfoW LoadLibraryA InterlockedExchange SetStdHandle FlushFileBuffers GetConsoleMode GetConsoleCP LCMapStringA LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings InterlockedCompareExchange FreeEnvironmentStringsA HeapSize ExitProcess HeapCreate InterlockedDecrement InterlockedIncrement TlsFree TlsSetValue TlsAlloc SetEndOfFile WriteFile ReadFile SetFilePointer GetFileSize GetFileAttributesA GetFileAttributesW GetModuleHandleA FindNextFileA FindNextFileW FindFirstFileA FindFirstFileW FindClose GetCurrentThreadId GetTickCount GetCurrentProcessId GetTempPathA GetTempPathW GetCurrentDirectoryA GetCurrentDirectoryW SetCurrentDirectoryA SetCurrentDirectoryW DeleteFileA DeleteFileW CreateDirectoryA CreateDirectoryW GetModuleHandleW GetProcAddress RemoveDirectoryA RemoveDirectoryW SetFileAttributesA SetFileAttributesW SetLastError CreateFileW SetFileTime CloseHandle GetSystemDirectoryW FormatMessageA FormatMessageW LocalFree GetModuleFileNameA GetModuleFileNameW LoadLibraryExW FreeLibrary AreFileApisANSI GetLastError WideCharToMultiByte MultiByteToWideChar TlsGetValue GetSystemTimeAsFileTime IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoA GetCommandLineA CreateThread ExitThread HeapReAlloc RaiseException RtlUnwind LeaveCriticalSection EnterCriticalSection WriteConsoleW DeleteCriticalSection

user32

CharUpperW LoadStringA LoadStringW SendMessageA CharUpperA GetSystemMetrics LoadIconA EndDialog KillTimer SetTimer PostMessageA DestroyWindow MessageBoxW DialogBoxParamW DialogBoxParamA GetDlgItem GetWindowLongA SetWindowLongA ShowWindow SetWindowTextW SetWindowTextA

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

ShellExecuteExA

oleaut32

VariantClear SysStringLen SysAllocStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_19635f05e556f46fe5f359c4a79dc077_amadey_elex_floxif_hijackloader_remcos_stop

PE Signature issue

kernel32

user32

advapi32

shell32

oleaut32

generic