2026-08-13_6b7c69718f11f86eca5ec93cb47c7687_elex_floxif_redline-stealer_smoke-loader_stop

General

Target
2026-08-13_6b7c69718f11f86eca5ec93cb47c7687_elex_floxif_redline-stealer_smoke-loader_stop
Size 171KB
Sample260813-t7wpbscb59
SHA256 8a8c81a6399c689ce602b825f37d0e351eac8c4161657515f42306db10d51d50
MD5 6b7c69718f11f86eca5ec93cb47c7687
SHA1 bf2becfa7d319a7a937928dc2ab4d1999700a251
SHA512 e0ed2aae1389a549b18fee7c99c72cbd86fab0bc4c67cee6615fd935a057e28390228016396bf493df07280861444cd39683a903a74a484a6b601a0ba3c5f4b6
SSDEEP 3072:LR+vA7C3H3q5ymKy/v//vwXMEZ2lQBV+UdE+rECWp7hKf:Lx7CH1mKy/v//vsM4BV+UdvrEFp7hKf
TLSH
T1F904BF02754387FECD581430742AA79496D6AA3C07AF42CBE73A35896E7DBC25E3520F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-13_6b7c69718f11f86eca5ec93cb47c7687_elex_floxif_redline-stealer_smoke-loader_stop

File Explorer

2026-08-13_6b7c69718f11f86eca5ec93cb47c7687_elex_floxif_redline-stealer_smoke-loader_stop

.exe 171KB

2026-08-13_6b7c69718f11f86eca5ec93cb47c7687_elex_floxif_redline-stealer_smoke-loader_stop

IMPHASH ed367c5d8941fde27372309f67b28748
SHA256 8a8c81a6399c689ce602b825f37d0e351eac8c4161657515f42306db10d51d50
MD5 6b7c69718f11f86eca5ec93cb47c7687
SHA1 bf2becfa7d319a7a937928dc2ab4d1999700a251
SHA512 e0ed2aae1389a549b18fee7c99c72cbd86fab0bc4c67cee6615fd935a057e28390228016396bf493df07280861444cd39683a903a74a484a6b601a0ba3c5f4b6
SSDEEP 3072:LR+vA7C3H3q5ymKy/v//vwXMEZ2lQBV+UdE+rECWp7hKf:Lx7CH1mKy/v//vsM4BV+UdvrEFp7hKf
TLSH
T1F904BF02754387FECD581430742AA79496D6AA3C07AF42CBE73A35896E7DBC25E3520F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3a:54:b7:84:79:68:a6:53:c5:53:0d:07:22:6f:48:28:50:7b:34:60

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,OU=Information Service & Support Department,O=SEIKO EPSON CORPORATION,L=Suwa-shi,ST=Nagano,C=JP

Chains

Sep 9, 2016

CN=SEIKO EPSON CORPORATION,OU=Information Service & Support Department,O=SEIKO EPSON CORPORATION,L=Suwa-shi,ST=Nagano,C=JP

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=SEIKO EPSON CORPORATION,OU=Information Service & Support Department,O=SEIKO EPSON CORPORATION,L=Suwa-shi,ST=Nagano,C=JP

Serial Number

61:90:9f:3f:8b:97:06:c0:42:b0:85:47:a3:d7:6e:81

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 1, 2016 - Sep 30, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

0

Major OS version

5

Entry point

14861

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ENP.pdb

shlwapi

PathIsDirectoryW PathFileExistsW

kernel32

WriteFile CreateMutexW GetLastError WaitForSingleObject CloseHandle GetModuleHandleW GetProcAddress GetCurrentProcess GetModuleFileNameW VerSetConditionMask VerifyVersionInfoW InitializeCriticalSectionAndSpinCount LoadLibraryA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapAlloc HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId LCMapStringW Sleep ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc LCMapStringA WideCharToMultiByte MultiByteToWideChar GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

PostMessageW

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_6b7c69718f11f86eca5ec93cb47c7687_elex_floxif_redline-stealer_smoke-loader_stop

PE Signature issue

shlwapi

kernel32

user32

shell32

generic