2026-08-25_cab8079dd4f604ef241400fc8369d645_amadey_elex_floxif_hijackloader_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_cab8079dd4f604ef241400fc8369d645_amadey_elex_floxif_hijackloader_rhadamanthys_stop
Size 461KB
Sample260826-lcdw2ace89
SHA256 7c095afa6daf0442da028c9a946ffc35b2728a259a45f1898b477298ac5e5a8e
MD5 cab8079dd4f604ef241400fc8369d645
SHA1 1400ce3675cd8a4722a42dcc10c431be1b9f9068
SHA512 8d2ca4d79c3b9be84f5b8847f1b77ba2ec976ae0220e38a494914d79f7419a3ad25df3fa4d861edb22f12b6768175aab65a586934bc810053cc32a42bd436a9b
SSDEEP 12288:FLvNEeSv6VrIflKVRmX5HpKIi7r/UthtBjvrEH7uVW:tU0relaRW5HpKI5rEH7P
TLSH
T141A4BF1077D0C7B6C65225323859D73566FAAD394F2582C7B3806A6DAE3D7C29A3830F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-25_cab8079dd4f604ef241400fc8369d645_amadey_elex_floxif_hijackloader_rhadamanthys_stop

File Explorer

2026-08-25_cab8079dd4f604ef241400fc8369d645_amadey_elex_floxif_hijackloader_rhadamanthys_stop

.exe 461KB

2026-08-25_cab8079dd4f604ef241400fc8369d645_amadey_elex_floxif_hijackloader_rhadamanthys_stop

IMPHASH 15469153035a2484976c6d5285cd5b5b
SHA256 7c095afa6daf0442da028c9a946ffc35b2728a259a45f1898b477298ac5e5a8e
MD5 cab8079dd4f604ef241400fc8369d645
SHA1 1400ce3675cd8a4722a42dcc10c431be1b9f9068
SHA512 8d2ca4d79c3b9be84f5b8847f1b77ba2ec976ae0220e38a494914d79f7419a3ad25df3fa4d861edb22f12b6768175aab65a586934bc810053cc32a42bd436a9b
SSDEEP 12288:FLvNEeSv6VrIflKVRmX5HpKIi7r/UthtBjvrEH7uVW:tU0relaRW5HpKI5rEH7P
TLSH
T141A4BF1077D0C7B6C65225323859D73566FAAD394F2582C7B3806A6DAE3D7C29A3830F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

37:cb:eb:bb:b1:54:4a:00:ce:06:18:f5:51:fb:7a:0f:06:ae:38:e8:73:52:38:f2:84:7f:fa:a7:07:66:aa:ef

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Feb 3, 2023

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

f6:13:f1:60:63:e6:09:04:29:c0:80:94:e6:9b:ee:95:1a:f7:20:a6

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Feb 3, 2023

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Serial Number

0f:f5:03:34:76:03:fb:03:4b:12:c6:db:62:fe:6c:3f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 14, 2022 - Apr 16, 2024

Minor OS version

Major OS version

Entry point

114827

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Data\src\_apluspoint\alupdate-windows\Bin\Release\DebugInfo\eausvc.pdb

kernel32

RtlUnwind ExitProcess RaiseException HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualFree VirtualAlloc HeapCreate GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetStartupInfoW GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode SetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileAttributesW CreateFileW SetEndOfFile SetFilePointer GlobalFindAtomW LoadLibraryA GetVersionExA lstrlenA GlobalAddAtomW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GlobalFlags GetModuleHandleA InterlockedDecrement WritePrivateProfileStringW SetLastError GlobalFree GlobalUnlock FormatMessageW LocalFree lstrlenW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW InterlockedExchange GlobalLock lstrcmpW GlobalAlloc GetModuleHandleW GetVersionExW TerminateProcess OpenProcess Process32NextW ProcessIdToSessionId lstrcmpiW Process32FirstW CreateToolhelp32Snapshot FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcess HeapFree DisconnectNamedPipe FlushFileBuffers WriteFile ReadFile HeapAlloc GetProcessHeap CreateThread ConnectNamedPipe CreateNamedPipeW MultiByteToWideChar WideCharToMultiByte Sleep GetCurrentProcessId GetLocalTime DeleteFileW FindClose FindFirstFileW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CloseHandle TerminateThread WaitForSingleObject GetLastError GetModuleFileNameW GetSystemDefaultLCID FindResourceW LoadResource LockResource GetTickCount SizeofResource

user32

GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics GetSysColorBrush GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW GetWindow GetCapture GetWindowRect GetWindowLongW GetClassNameW PtInRect GetWindowTextW SetWindowTextW GetSysColor ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW UnhookWindowsHookEx SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible SendMessageW GetKeyState PeekMessageW GetCursorPos ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu PostQuitMessage PostMessageW LoadCursorW SetCursor WinHelpW LoadIconW RegisterWindowMessageW GetDlgCtrlID DestroyMenu ShowWindow

gdi32

PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap GetStockObject GetDeviceCaps

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW CreateProcessAsUserW DuplicateTokenEx GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryValueExW RegOpenKeyExW DeleteService ControlService QueryServiceStatus StartServiceW OpenServiceW ChangeServiceConfig2W CreateServiceW OpenSCManagerW CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

shlwapi

PathQuoteSpacesW PathFindExtensionW

oleaut32

VariantChangeType VariantInit VariantClear

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_cab8079dd4f604ef241400fc8369d645_amadey_elex_floxif_hijackloader_rhadamanthys_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

userenv

generic