2026-08-13_4908fc98b089bb132268803bf253b8be_amadey_elex_floxif_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_4908fc98b089bb132268803bf253b8be_amadey_elex_floxif_smoke-loader_stealc_stop
Size 6.8MB
Sample260813-varjsavalb
SHA256 e744bbf64a794010ed7e92cf8fec93b055f02f5d99ecf341a3f63d3cce72e24c
MD5 4908fc98b089bb132268803bf253b8be
SHA1 499ce700371b72389bce956b6f6e3536395107b6
SHA512 01872637a55c21607c2ad7799199fc182bd129b8658b3d2489c9f46f6241be43b9eb56d2f09204d967b1c41269a443a02b3b0ede181a0d18f44a0043c4e54b99
SSDEEP 196608:5G9MyFtXGnWMxowcD2IlKWpAN8RFlYvGH:5G/PX4WOowK22BAkV
TLSH
T12B76334032E9833BD0B31A3269F492B514F5BC696932D98BA3450F7C4E2D2E2DF55B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-13_4908fc98b089bb132268803bf253b8be_amadey_elex_floxif_smoke-loader_stealc_stop

File Explorer

2026-08-13_4908fc98b089bb132268803bf253b8be_amadey_elex_floxif_smoke-loader_stealc_stop

.exe 6.8MB

2026-08-13_4908fc98b089bb132268803bf253b8be_amadey_elex_floxif_smoke-loader_stealc_stop

IMPHASH cb62afda5a66eca097a889af3ca2eaa2
SHA256 e744bbf64a794010ed7e92cf8fec93b055f02f5d99ecf341a3f63d3cce72e24c
MD5 4908fc98b089bb132268803bf253b8be
SHA1 499ce700371b72389bce956b6f6e3536395107b6
SHA512 01872637a55c21607c2ad7799199fc182bd129b8658b3d2489c9f46f6241be43b9eb56d2f09204d967b1c41269a443a02b3b0ede181a0d18f44a0043c4e54b99
SSDEEP 196608:5G9MyFtXGnWMxowcD2IlKWpAN8RFlYvGH:5G/PX4WOowK22BAkV
TLSH
T12B76334032E9833BD0B31A3269F492B514F5BC696932D98BA3450F7C4E2D2E2DF55B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5f:2c:1e:e8:67:98:63:41:c4:e3:24:aa:05:1e:d0:41:6e:e6:d5:0a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Hewlett Packard,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop Consumer Solutions,O=Hewlett Packard,L=San Diego,ST=California,C=US

Chains

May 28, 2015

CN=Hewlett Packard,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop Consumer Solutions,O=Hewlett Packard,L=San Diego,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Hewlett Packard,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop Consumer Solutions,O=Hewlett Packard,L=San Diego,ST=California,C=US

Serial Number

44:23:9c:21:87:ef:ae:7b:a9:f3:cd:89:c4:fe:9d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 27, 2012 - Sep 3, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

116621

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

kernel32

WaitForSingleObject SetEvent ResetEvent WaitForMultipleObjects VirtualAlloc VirtualFree GetProcAddress GetModuleHandleA MultiByteToWideChar WideCharToMultiByte GetLastError LoadLibraryA AreFileApisANSI GetModuleFileNameA GetModuleFileNameW LocalFree FormatMessageA FormatMessageW SetFileAttributesA RemoveDirectoryA SetCurrentDirectoryA CreateDirectoryA DeleteFileA SetFileAttributesW RemoveDirectoryW CreateDirectoryW DeleteFileW lstrlenA GetFullPathNameA GetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryW GetTempPathA GetTempPathW GetFullPathNameW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW CreateFileA GetFileSize CreateThread ReadFile SetFileTime WriteFile SetEndOfFile CreateFileW CreateEventA GetStdHandle EnterCriticalSection LeaveCriticalSection GetUserDefaultLangID EnumResourceLanguagesA GetUserDefaultUILanguage GetVersionExA Sleep SetLastError DuplicateHandle GetCurrentProcess GetEnvironmentVariableW Process32Next OpenProcess Process32First CreateToolhelp32Snapshot GetExitCodeProcess CreateProcessA GetCommandLineW FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP GetLocaleInfoA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount CloseHandle DeleteCriticalSection InitializeCriticalSection SetFilePointer HeapSize HeapCreate HeapReAlloc InterlockedDecrement GetCurrentThreadId InterlockedIncrement TlsFree TlsSetValue RaiseException RtlUnwind HeapAlloc HeapFree GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW ExitProcess GetCommandLineA GetStartupInfoA TlsGetValue TlsAlloc

user32

CharLowerA CharUpperA DestroyWindow PostMessageA ShowWindow EndDialog KillTimer SetTimer SendMessageA GetDlgItem MessageBoxW DialogBoxParamW DialogBoxParamA GetWindowLongA SetWindowLongA GetWindowTextLengthW GetWindowTextW SetWindowTextW SetWindowTextA GetWindowTextA GetWindowTextLengthA LoadStringW LoadStringA CharLowerW CharUpperW

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

SHCreateDirectoryExW SHGetPathFromIDListW SHCreateDirectoryExA ShellExecuteExA SHBrowseForFolderW

ole32

OleInitialize CoTaskMemFree

oleaut32

SysAllocString VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_4908fc98b089bb132268803bf253b8be_amadey_elex_floxif_smoke-loader_stealc_stop

PE Signature issue

comctl32

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic