2026-08-19_c199793e10c5fe69a5cc02d40f8f35d6_amadey_elex_floxif_pay2key_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_c199793e10c5fe69a5cc02d40f8f35d6_amadey_elex_floxif_pay2key_smoke-loader_stop
Size 1.8MB
Sample260819-pyyecavale
SHA256 f1a8e1b4d863cb530535a1fc86a7d154941cf5620e03eba9f9e4e8e369e7c81a
MD5 c199793e10c5fe69a5cc02d40f8f35d6
SHA1 9cb53bf3158af7fd6f9f681fd7c9fc19fa4cd826
SHA512 c5b7d18612188dbda0db67aec08b422b299c71f6e5c70f771f9a5b1b351adb9fa5707c11203b8fb45895b8b88e2bd4216c0211e13cf8bbff5f1975a7edc73a78
SSDEEP 49152:CtCejjt1nAV97yKtFnFK2dstEPObW+BqLrH9pGb:Ct7j2AbYT9Mb
TLSH
T16D859D02A7D341B2FD866633112E67139B39AB1D0317E5CF96A03D6069712F31ABE2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-19_c199793e10c5fe69a5cc02d40f8f35d6_amadey_elex_floxif_pay2key_smoke-loader_stop

File Explorer

2026-08-19_c199793e10c5fe69a5cc02d40f8f35d6_amadey_elex_floxif_pay2key_smoke-loader_stop

.exe 1.8MB

2026-08-19_c199793e10c5fe69a5cc02d40f8f35d6_amadey_elex_floxif_pay2key_smoke-loader_stop

IMPHASH 0225ddae2adf3e15d8df8f0b49ff49e0
SHA256 f1a8e1b4d863cb530535a1fc86a7d154941cf5620e03eba9f9e4e8e369e7c81a
MD5 c199793e10c5fe69a5cc02d40f8f35d6
SHA1 9cb53bf3158af7fd6f9f681fd7c9fc19fa4cd826
SHA512 c5b7d18612188dbda0db67aec08b422b299c71f6e5c70f771f9a5b1b351adb9fa5707c11203b8fb45895b8b88e2bd4216c0211e13cf8bbff5f1975a7edc73a78
SSDEEP 49152:CtCejjt1nAV97yKtFnFK2dstEPObW+BqLrH9pGb:Ct7j2AbYT9Mb
TLSH
T16D859D02A7D341B2FD866633112E67139B39AB1D0317E5CF96A03D6069712F31ABE2D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

cb:40:65:c8:18:1d:b8:90:f0:b4:52:d3:e3:cf:b2:d4:7e:aa:64:f7:8a:22:4b:c5:17:18:bd:a4:35:5b:3f:ac

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

Jan 23, 2026

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Serial Number

04:4c:41:86:39:d4:52:74:47:0b:f1:a5:fa:de:a0:18

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2025 - May 20, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1359060

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\dev\Everything-1.4\Release\Everything.pdb

comctl32

ImageList_GetIconSize ImageList_DrawEx _TrackMouseEvent InitCommonControlsEx

ws2_32

WSAGetLastError WSACleanup closesocket send recv socket connect WSAAsyncSelect setsockopt WSAStartup shutdown listen bind getpeername ntohs getsockname htons gethostbyname inet_addr accept

shlwapi

SHRegGetUSValueW PathIsRootW PathCombineW PathRemoveFileSpecW

kernel32

QueryPerformanceCounter QueryPerformanceFrequency ExitProcess SetConsoleScreenBufferSize SetStdHandle AllocConsole FreeConsole SetFilePointer FileTimeToSystemTime GetSystemTime FreeResource LockResource LoadResource SizeofResource GetSystemDefaultLangID LoadLibraryA TerminateProcess OpenProcess SetLastError HeapAlloc GetProcessHeap HeapFree VirtualAlloc VirtualFree SetErrorMode MoveFileExW GlobalFree GlobalUnlock WriteFile GlobalAlloc GetFileSize GetThreadPriority FreeLibrary LocalFileTimeToFileTime SystemTimeToFileTime FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime WaitForMultipleObjects GetSystemInfo GetVersionExA LocalFree LocalAlloc ConnectNamedPipe GetTimeZoneInformation MulDiv CompareStringA GetModuleHandleA GetModuleFileNameA GetWindowsDirectoryA GetSystemDirectoryA InterlockedExchange RtlUnwind SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetStartupInfoA GetCommandLineA CreateThread ExitThread FlushFileBuffers GetStdHandle GetFileType GetConsoleScreenBufferInfo SetConsoleTextAttribute DeviceIoControl GetOverlappedResult ResetEvent Sleep FindNextChangeNotification GetFileInformationByHandle GetLocalTime FindCloseChangeNotification FindClose GetSystemTimeAsFileTime GetCurrentThread SetThreadPriority InitializeCriticalSection WaitForSingleObject DeleteCriticalSection EnterCriticalSection GetTickCount LeaveCriticalSection SetEvent GetCommandLineW GetCurrentThreadId ReadFile GetLastError CloseHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapReAlloc HeapDestroy HeapCreate GetACP GetOEMCP FreeEnvironmentStringsA GetEnvironmentStrings SetHandleCount GetCurrentProcessId LCMapStringA GetStringTypeA GetLocaleInfoA HeapSize GlobalLock

user32

SetCapture ChangeClipboardChain DrawEdge DrawFrameControl EqualRect GetSubMenu GetMenu SetClipboardViewer EnumWindows ActivateKeyboardLayout IsDlgButtonChecked SetScrollInfo UpdateWindow ScrollWindowEx SetDlgItemInt GetMenuItemID RemoveMenu GetMenuState GetMenuDefaultItem EnableMenuItem AdjustWindowRect GetSysColorBrush OffsetRect InvalidateRgn MessageBeep SetCursorPos GetDlgItemInt GetDlgCtrlID GetDesktopWindow ValidateRect CreateIconIndirect CreateMenu SetMenuDefaultItem TrackPopupMenu DestroyMenu KillTimer GetDoubleClickTime RegisterHotKey UnregisterHotKey GetLastActivePopup OpenIcon GetForegroundWindow SetCursor SetActiveWindow BringWindowToTop EnumChildWindows CheckDlgButton GetKeyboardLayoutList GetScrollInfo InvalidateRect ClientToScreen ScreenToClient GetKeyState IsIconic GetWindowPlacement IsZoomed GetParent CopyRect EmptyClipboard SetClipboardData SetFocus PtInRect SetForegroundWindow BeginPaint EndPaint OpenClipboard CloseClipboard FillRect IsWindowVisible GetAsyncKeyState IsWindowEnabled GetFocus GetNextDlgTabItem SetWindowPos GetMenuItemCount CreatePopupMenu DeleteMenu AdjustWindowRectEx GetDlgItem GetWindowRect MapWindowPoints IntersectRect GetDC ReleaseDC WaitMessage UnhookWindowsHookEx CallNextHookEx TranslateMessage GetSystemMetrics GetClientRect GetCapture ReleaseCapture ShowWindow SetMenu RedrawWindow GetMessagePos RegisterWindowMessageA ReplyMessage AttachThreadInput GetCursorPos GetSysColor EndDialog DestroyIcon SetTimer DestroyWindow GetWindowThreadProcessId IsWindow GetKeyboardLayout PostQuitMessage

gdi32

StretchDIBits BitBlt CreateCompatibleDC GetTextAlign SetStretchBltMode GetDeviceCaps GetRegionData SelectClipRgn StretchBlt SetTextAlign CreateCompatibleBitmap OffsetClipRgn OffsetRgn CombineRgn GetDCOrgEx GetRandomRgn ExtCreateRegion GetStockObject GetNearestColor CreateSolidBrush CreateRectRgn CreateDIBSection GetCurrentObject ExcludeClipRect RectVisible DeleteDC SetBkMode CreateBitmapIndirect CreatePatternBrush SetBrushOrgEx SetBkColor SetTextColor PatBlt SelectObject GetDIBits DeleteObject

comdlg32

CommDlgExtendedError

advapi32

RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW DeleteService ControlService RegOpenKeyA InitializeSecurityDescriptor SetSecurityDescriptorDacl QueryServiceConfigW RegCloseKey RegisterEventSourceW ReportEventW DeregisterEventSource CreateServiceW StartServiceW OpenSCManagerW OpenServiceW CloseServiceHandle SetServiceStatus

shell32

DragAcceptFiles ord16 DragQueryPoint DragFinish SHGetDesktopFolder SHGetSpecialFolderLocation

ole32

CoTaskMemFree OleUninitialize OleInitialize CoCreateInstance CoInitializeEx CoUninitialize CLSIDFromString CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop DoDragDrop CreateBindCtx ReleaseStgMedium RegisterDragDrop

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_c199793e10c5fe69a5cc02d40f8f35d6_amadey_elex_floxif_pay2key_smoke-loader_stop

PE Signature issue

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic