2026-08-13_a833b35187b94fb5f48f7ff2e65df6fe_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_a833b35187b94fb5f48f7ff2e65df6fe_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee
Size 40.2MB
Sample260813-sdr9dabl2v
SHA256 12d11a314bf1fd08aba5af74cb657dacc92c0983f7fe70bc0efc5d10de65640e
MD5 a833b35187b94fb5f48f7ff2e65df6fe
SHA1 83a7093c3fe9fe00a419f5560509d9ad5dab2f99
SHA512 f1f24df5373996090b19c3db32b030a09e10d4cf79f8a4dcd1e5689879be5df4ec318f757de3c245622c0433e2b4fe0456476c323a597d5ca904d136b4aa6837
SSDEEP 786432:HA/S7gkBNoCy+Et2+P/kgNs1m2rweMXRClT5XT90EOf593w5CGWlMaO5wSFPHnjk:zs9Cy+C2K3uwzXRWT5XTCEOfTWr0MaR9
TLSH
T118973305F2EC87B3D2070774DAF55A914434DA0F30B72698F92E5B8095AE07E6B74AE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-13_a833b35187b94fb5f48f7ff2e65df6fe_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee

File Explorer

2026-08-13_a833b35187b94fb5f48f7ff2e65df6fe_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee

.exe 40.2MB

2026-08-13_a833b35187b94fb5f48f7ff2e65df6fe_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee

IMPHASH f248ec36f6cec966c3b020d2fcb9224b
SHA256 12d11a314bf1fd08aba5af74cb657dacc92c0983f7fe70bc0efc5d10de65640e
MD5 a833b35187b94fb5f48f7ff2e65df6fe
SHA1 83a7093c3fe9fe00a419f5560509d9ad5dab2f99
SHA512 f1f24df5373996090b19c3db32b030a09e10d4cf79f8a4dcd1e5689879be5df4ec318f757de3c245622c0433e2b4fe0456476c323a597d5ca904d136b4aa6837
SSDEEP 786432:HA/S7gkBNoCy+Et2+P/kgNs1m2rweMXRClT5XT90EOf593w5CGWlMaO5wSFPHnjk:zs9Cy+C2K3uwzXRWT5XTCEOfTWr0MaR9
TLSH
T118973305F2EC87B3D2070774DAF55A914434DA0F30B72698F92E5B8095AE07E6B74AE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

59:48:81:96:b9:0e:ad:7d:ec:f4:01:7e:e9:4d:dd:be:fd:08:2a:cd:a4:f0:64:9e:3b:b5:cb:f0:cd:fd:07:d0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 31, 2017

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

52:d2:f3:ed:8c:7a:54:63:92:c5:40:38:6a:89:5c:e2:55:3f:8c:c6

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 31, 2017

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 17, 2016 - Feb 17, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9d:20:9c:56:77:55:d4:28:9a:00:00:00:00:00:9d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

Major OS version

Entry point

101358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dd\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb

advapi32

CreateWellKnownSid InitializeSecurityDescriptor SetEntriesInAclW SetSecurityDescriptorDacl SetSecurityDescriptorOwner CryptAcquireContextW CryptGenRandom CryptReleaseContext DecryptFileW

kernel32

CreateProcessW Sleep WaitForSingleObject GetExitCodeProcess CloseHandle SetFileAttributesW InitializeCriticalSection CreateEventW CreateThread DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsW SetEvent GetCommandLineW lstrlenW CompareStringW LocalFree CreateDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetErrorMode RemoveDirectoryW MoveFileExW LoadLibraryW GetProcAddress GetSystemDirectoryW GetLastError SetEnvironmentVariableW ExitThread GetTickCount GetEnvironmentVariableW GetModuleHandleW LeaveCriticalSection WaitForMultipleObjects ResetEvent CreateEventA GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime GetModuleHandleA GetVersionExA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetEndOfFile DuplicateHandle ReadFile GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc LCMapStringW RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent SetStdHandle WriteConsoleW FlushFileBuffers CreateFileA GetLocalTime GetComputerNameW lstrlenA FormatMessageW GetSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileW GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW GetProcessHeap GlobalAlloc GlobalFree SetFilePointerEx RaiseException

comctl32

ord17

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

shell32

SHBrowseForFolderW SHGetPathFromIDListW CommandLineToArgvW

shlwapi

PathRemoveExtensionW

user32

GetTopWindow GetWindowThreadProcessId GetWindow SendMessageW MessageBoxW PostMessageW DialogBoxParamW GetDlgItem SetWindowTextW EndDialog PostQuitMessage SetWindowLongW GetWindowLongW LoadStringW CharUpperW

cabinet

ord22 ord23 ord20

oleaut32

VariantClear SysAllocString

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_a833b35187b94fb5f48f7ff2e65df6fe_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee

PE Signature issue

PE Signature issue

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

cabinet

oleaut32

version

generic