2026-08-27_dbf0fb3960fcc5b5967c8609610f69f7_amadey_elex_floxif_redline-stealer_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_dbf0fb3960fcc5b5967c8609610f69f7_amadey_elex_floxif_redline-stealer_smoke-loader_stop
Size 347KB
Sample260828-e934vstblf
SHA256 27bc0d1418bb468ec6f90acfe39304f81716cfb975cadedd5704d47d55aaf6f6
MD5 dbf0fb3960fcc5b5967c8609610f69f7
SHA1 1a96083b05f25c66674aef5d426ab4a331666d0d
SHA512 1bbe6c39f69b4a07c1319238a89c9ba5269c81fbfb8eaf0754449feab6ba588c166ae25a72418b7d07deac9fb525d0df6f637f0803503b9b818ab7cc5738c4e7
SSDEEP 6144:rQOl40oRey2d9vZw0svcmpmhn8i4/SgGQ3HnfLgBV+UdvrEFp7hKU2:r3vy2bxw/cmpmhnlcSkfLgBjvrEH7p2
TLSH
T1C274AF103390CBF6D153243928A9D37869FAF53C4B6A51C7B7D40B7D9E686D24A3838B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-27_dbf0fb3960fcc5b5967c8609610f69f7_amadey_elex_floxif_redline-stealer_smoke-loader_stop

File Explorer

2026-08-27_dbf0fb3960fcc5b5967c8609610f69f7_amadey_elex_floxif_redline-stealer_smoke-loader_stop

.exe 347KB

2026-08-27_dbf0fb3960fcc5b5967c8609610f69f7_amadey_elex_floxif_redline-stealer_smoke-loader_stop

IMPHASH 5cce9326c999417aa97670acc4cb6c19
SHA256 27bc0d1418bb468ec6f90acfe39304f81716cfb975cadedd5704d47d55aaf6f6
MD5 dbf0fb3960fcc5b5967c8609610f69f7
SHA1 1a96083b05f25c66674aef5d426ab4a331666d0d
SHA512 1bbe6c39f69b4a07c1319238a89c9ba5269c81fbfb8eaf0754449feab6ba588c166ae25a72418b7d07deac9fb525d0df6f637f0803503b9b818ab7cc5738c4e7
SSDEEP 6144:rQOl40oRey2d9vZw0svcmpmhn8i4/SgGQ3HnfLgBV+UdvrEFp7hKU2:r3vy2bxw/cmpmhnlcSkfLgBjvrEH7p2
TLSH
T1C274AF103390CBF6D153243928A9D37869FAF53C4B6A51C7B7D40B7D9E686D24A3838B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5c:ed:67:3d:06:28:53:de:e0:ba:7f:f5:1e:84:da:15:ad:bb:9f:aa

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Arvato Digital Services Canada Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Arvato Digital Services Canada Inc,L=Vancouver,ST=British Columbia,C=CA

Chains

Apr 30, 2014

CN=Arvato Digital Services Canada Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Arvato Digital Services Canada Inc,L=Vancouver,ST=British Columbia,C=CA

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Arvato Digital Services Canada Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Arvato Digital Services Canada Inc,L=Vancouver,ST=British Columbia,C=CA

Serial Number

6b:f6:39:c6:33:10:03:f6:b9:d1:e5:e0:29:13:5b:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 28, 2012 - May 8, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

66037

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Build\PSIKey\BRANCH_ACTIVATOR_3_3_0\Parts\bin\ReleaseAntiCrack\PSIService_2.pdb

rpcrt4

RpcServerListen RpcServerRegisterIf RpcServerUseProtseqEpA NdrServerCall2 RpcMgmtStopServerListening

kernel32

VirtualAlloc HeapReAlloc HeapSize Sleep ExitProcess GetACP IsValidCodePage LCMapStringA LCMapStringW HeapCreate VirtualFree GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW RaiseException SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW RtlUnwind GetCommandLineA HeapAlloc HeapFree IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetOEMCP GetCPInfo GetLocaleInfoA GlobalFlags CreateFileA GetCurrentProcess FlushFileBuffers SetFilePointer WriteFile ReadFile GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpW lstrcmpA GlobalGetAtomNameA InterlockedIncrement GetModuleHandleW CompareStringA GetCurrentThreadId CloseHandle FormatMessageA MultiByteToWideChar lstrlenA GetCurrentProcessId WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource InterlockedDecrement TlsFree GlobalFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection GetLastError SetLastError FreeLibrary LoadLibraryA GetSystemInfo GetVersionExA LocalFree LocalAlloc GetModuleHandleA GetProcAddress FindFirstFileA SetEvent WaitForSingleObject CreateThread CreateEventA lstrcmpiA GetModuleFileNameA GetEnvironmentStringsW

user32

PostQuitMessage GrayStringA DrawTextExA DrawTextA TabbedTextOutA DestroyMenu ClientToScreen SetWindowTextA RegisterWindowMessageA LoadIconA WinHelpA GetCapture GetClassLongA GetClassNameA GetPropA RemovePropA IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu UnhookWindowsHookEx MessageBoxA EnableWindow IsWindowEnabled SetForegroundWindow GetClientRect PostMessageA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx CopyRect GetDlgCtrlID DefWindowProcA CallWindowProcA PtInRect GetMenu SetWindowLongA SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect SetPropA GetLastActivePopup GetWindowLongA GetParent SendMessageA GetWindowThreadProcessId GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA GetFocus ModifyMenuA EnableMenuItem CheckMenuItem GetWindowTextA LoadCursorA GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExA CallNextHookEx DispatchMessageA GetKeyState PeekMessageA ValidateRect

gdi32

GetStockObject SetViewportExtEx DeleteDC ScaleWindowExtEx SetWindowExtEx GetClipBox CreateBitmap GetDeviceCaps OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape TextOutA RectVisible PtVisible SetMapMode RestoreDC SaveDC ExtTextOutA DeleteObject SetBkColor SetTextColor ScaleViewportExtEx

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

ReportEventA DeregisterEventSource RegSetValueExA RegCreateKeyExA RegCloseKey QueryServiceConfigA UnlockServiceDatabase LockServiceDatabase DeleteService StartServiceA CreateServiceA ControlService CloseServiceHandle OpenServiceA OpenSCManagerA SetServiceStatus RegisterServiceCtrlHandlerA StartServiceCtrlDispatcherA RegisterEventSourceA

oleaut32

VariantClear VariantChangeType VariantInit

oleacc

LresultFromObject CreateStdAccessibleObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_dbf0fb3960fcc5b5967c8609610f69f7_amadey_elex_floxif_redline-stealer_smoke-loader_stop

PE Signature issue

rpcrt4

kernel32

user32

gdi32

winspool.drv

advapi32

oleaut32

oleacc

generic