2026-08-14_e6561885ac4054ff10154ca321ff6b0c_amadey_elex_floxif_redline-stealer_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_e6561885ac4054ff10154ca321ff6b0c_amadey_elex_floxif_redline-stealer_smoke-loader_stop
Size 623KB
Sample260814-dea9xstbme
SHA256 a6c297ff0671fbd2e1c38c9db72a0b761c52cc76addf370e50763aaad50bf07c
MD5 e6561885ac4054ff10154ca321ff6b0c
SHA1 0041ab8684a575aa7237ca9c0a5d5732e52473a5
SHA512 484258e164567d3b9a75dbee469c3b83a38403366ada76056223ed59140cf51b777f7f5dc0fb0dc1149a254745fbdc06b935c63b5409e3a8647b1d143b23f6db
SSDEEP 12288:RkaeBKGNVzagJTRfun9YVxi6zVpJXgfdfrTBjvrEH76:mpLFuYi6zV/wFfrJrEH76
TLSH
T185D48E307EF48275D4F35174666D622151F9FC740B3980CBA38053AEAAB4BD2AB35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-14_e6561885ac4054ff10154ca321ff6b0c_amadey_elex_floxif_redline-stealer_smoke-loader_stop

File Explorer

2026-08-14_e6561885ac4054ff10154ca321ff6b0c_amadey_elex_floxif_redline-stealer_smoke-loader_stop

.exe 623KB

2026-08-14_e6561885ac4054ff10154ca321ff6b0c_amadey_elex_floxif_redline-stealer_smoke-loader_stop

IMPHASH 42645007a264b7140470af60d4c881c0
SHA256 a6c297ff0671fbd2e1c38c9db72a0b761c52cc76addf370e50763aaad50bf07c
MD5 e6561885ac4054ff10154ca321ff6b0c
SHA1 0041ab8684a575aa7237ca9c0a5d5732e52473a5
SHA512 484258e164567d3b9a75dbee469c3b83a38403366ada76056223ed59140cf51b777f7f5dc0fb0dc1149a254745fbdc06b935c63b5409e3a8647b1d143b23f6db
SSDEEP 12288:RkaeBKGNVzagJTRfun9YVxi6zVpJXgfdfrTBjvrEH76:mpLFuYi6zV/wFfrJrEH76
TLSH
T185D48E307EF48275D4F35174666D622151F9FC740B3980CBA38053AEAAB4BD2AB35B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2c:8f:c7:08:9c:dc:5a:87:91:b8:2e:38:1b:ef:9e:43:5d:ea:4b:bf

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 12, 2009

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:27:81:00:00:00:00:00:08

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2008 - Jan 22, 2010

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

Major OS version

Entry point

254003

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

install.pdb

kernel32

GetLastError LeaveCriticalSection UnmapViewOfFile DeleteCriticalSection GetTempPathW GetCurrentProcess GetCurrentThread CreateDirectoryW GetFileSize WideCharToMultiByte WriteFile FlushFileBuffers GetModuleFileNameW GetCommandLineW DeleteFileW lstrlenA MultiByteToWideChar GetCurrentThreadId ResetEvent MapViewOfFile FlushInstructionCache WaitForMultipleObjects FormatMessageW MulDiv lstrlenW GetDriveTypeW GlobalHandle lstrcmpW TerminateThread InterlockedIncrement InterlockedDecrement GetModuleHandleW lstrcmpiW LoadLibraryExW InterlockedExchange HeapSetInformation GetUserDefaultLangID CreateFileMappingW EnterCriticalSection InitializeCriticalSection SizeofResource LockResource LoadResource FindResourceW GetSystemDirectoryW SetEvent CreateThread CreateEventW Sleep SetLastError GetTickCount GetExitCodeProcess WaitForSingleObject CreateProcessW GetProcAddress GetVersionExW LoadLibraryW FreeLibrary SetFilePointer GlobalAlloc LocalFree LocalAlloc GlobalUnlock ReadFile GlobalLock GlobalReAlloc GlobalFree CloseHandle RaiseException CreateFileW GetDriveTypeA GetCurrentDirectoryA PeekNamedPipe GetFileInformationByHandle ResumeThread ExitThread FileTimeToLocalFileTime FileTimeToSystemTime GetModuleHandleA SetEndOfFile FindClose DuplicateHandle GetSystemDefaultLCID ReleaseMutex IsProcessorFeaturePresent GetProcessHeap InterlockedCompareExchange SetEnvironmentVariableA CompareStringA CreateFileA GetTimeZoneInformation GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeA LCMapStringA GetConsoleMode GetConsoleCP RtlUnwind InitializeCriticalSectionAndSpinCount HeapSize GetOEMCP GetACP HeapReAlloc VirtualAlloc IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetCurrentProcessId QueryPerformanceCounter VirtualFree HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA GetStdHandle ExitProcess SetUnhandledExceptionFilter GetLocalTime GetSystemTimeAsFileTime HeapFree HeapAlloc LoadLibraryA

gdi32

GetStockObject CreateSolidBrush GetObjectW GetTextExtentPoint32W CreateCompatibleBitmap CreateFontIndirectW GetDeviceCaps SetBkMode SetTextColor SetBkColor CreatePalette DeleteObject SetDIBitsToDevice PatBlt DeleteDC BitBlt SelectObject CreateCompatibleDC CreateDIBitmap RealizePalette SelectPalette

comctl32

ImageList_ReplaceIcon _TrackMouseEvent ImageList_Create InitCommonControlsEx ImageList_Destroy

imm32

ImmGetContext ImmAssociateContext ImmReleaseContext

ole32

CoCreateInstance CoGetClassObject CLSIDFromProgID CLSIDFromString OleInitialize CoTaskMemFree CreateStreamOnHGlobal OleLockRunning StringFromGUID2 CoTaskMemAlloc OleUninitialize CoUninitialize CoInitialize CoTaskMemRealloc

oleaut32

SysStringByteLen SysFreeString SysAllocString OleCreateFontIndirect SysStringLen LoadRegTypeLi LoadTypeLi VariantClear VariantInit SysAllocStringLen VarBstrCmp VarUI4FromStr SysAllocStringByteLen

shell32

SHGetSpecialFolderLocation SHGetDesktopFolder ShellExecuteW

shlwapi

PathCombineW PathIsRootW PathStripToRootW PathRemoveBackslashW PathAddBackslashW PathRemoveBlanksW PathCanonicalizeW

user32

GetActiveWindow DialogBoxIndirectParamW DestroyAcceleratorTable InvalidateRgn FillRect ReleaseCapture SetCapture MoveWindow ClientToScreen CreateAcceleratorTableW RedrawWindow GetClassNameW IsChild EndPaint BeginPaint GetWindowTextLengthW RegisterWindowMessageW LoadImageW DestroyIcon SetWindowContextHelpId MapDialogRect UnregisterClassA IsWindow IsDialogMessageW ShowWindow SystemParametersInfoW EndDialog GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent ScreenToClient MapWindowPoints SetWindowPos LoadIconW GetDesktopWindow GetSystemMenu EnableMenuItem SetFocus GetFocus SendMessageW DestroyWindow DefWindowProcW GetSystemMetrics CharPrevW CharNextW DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects ReleaseDC GetDC PtInRect GetCursorPos PostQuitMessage IsDlgButtonChecked GetSysColorBrush InvalidateRect SetCursor KillTimer SetTimer GetDlgItem SetDlgItemTextW SendDlgItemMessageW SetWindowTextW CallWindowProcW SetWindowLongW DialogBoxParamW CreateDialogParamW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW DrawFocusRect DrawTextW GetWindowTextW GetCursor EnableWindow GetClientRect GetSysColor PostMessageW MessageBoxW ExitWindowsEx

setupapi

SetupIterateCabinetW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_e6561885ac4054ff10154ca321ff6b0c_amadey_elex_floxif_redline-stealer_smoke-loader_stop

PE Signature issue

kernel32

gdi32

comctl32

imm32

ole32

oleaut32

shell32

shlwapi

user32

setupapi

generic