2026-09-04_aab4f3dd483bf9ff3c93d0c236aa14dd_amadey_elex_floxif_pay2key_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_aab4f3dd483bf9ff3c93d0c236aa14dd_amadey_elex_floxif_pay2key_smoke-loader_stop
Size 1.8MB
Sample260905-a498rscl61
SHA256 f02b14268e8e9f4b807ca42bc596a9694b5c5545e919ed835cf84421ace21a4d
MD5 aab4f3dd483bf9ff3c93d0c236aa14dd
SHA1 837d4df9216c497e4e5ee36af66fd29e50f7e95d
SHA512 9ffb106080bdaa14638600297ac2b06c2d1e9a1fe06113a98dc29f33ede0fbe006c869f582268a58bccf255fb04d9c32feadcc8612935f43df564519e277776d
SSDEEP 49152:CtCejjt1nAV97yKtFnFUdstEPObW/BqLrH9pGY:Ct7jvAbhT9MY
TLSH
T138859D02ABD341B2FD866633112E67139B39AB1D0317E5CF96A03D6069712F31A7E2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-04_aab4f3dd483bf9ff3c93d0c236aa14dd_amadey_elex_floxif_pay2key_smoke-loader_stop

File Explorer

2026-09-04_aab4f3dd483bf9ff3c93d0c236aa14dd_amadey_elex_floxif_pay2key_smoke-loader_stop

.exe 1.8MB

2026-09-04_aab4f3dd483bf9ff3c93d0c236aa14dd_amadey_elex_floxif_pay2key_smoke-loader_stop

IMPHASH 0225ddae2adf3e15d8df8f0b49ff49e0
SHA256 f02b14268e8e9f4b807ca42bc596a9694b5c5545e919ed835cf84421ace21a4d
MD5 aab4f3dd483bf9ff3c93d0c236aa14dd
SHA1 837d4df9216c497e4e5ee36af66fd29e50f7e95d
SHA512 9ffb106080bdaa14638600297ac2b06c2d1e9a1fe06113a98dc29f33ede0fbe006c869f582268a58bccf255fb04d9c32feadcc8612935f43df564519e277776d
SSDEEP 49152:CtCejjt1nAV97yKtFnFUdstEPObW/BqLrH9pGY:Ct7jvAbhT9MY
TLSH
T138859D02ABD341B2FD866633112E67139B39AB1D0317E5CF96A03D6069712F31A7E2D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d8:4d:a0:60:2c:a7:b0:9c:44:a6:95:f2:19:11:01:60:7a:ec:61:01:61:95:22:04:cc:59:9b:db:4e:ff:60:46

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

Jan 23, 2026

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Serial Number

04:4c:41:86:39:d4:52:74:47:0b:f1:a5:fa:de:a0:18

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2025 - May 20, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1359060

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\dev\Everything-1.4\Release\Everything.pdb

comctl32

ImageList_GetIconSize ImageList_DrawEx _TrackMouseEvent InitCommonControlsEx

ws2_32

WSAGetLastError WSACleanup closesocket send recv socket connect WSAAsyncSelect setsockopt WSAStartup shutdown listen bind getpeername ntohs getsockname htons gethostbyname inet_addr accept

shlwapi

SHRegGetUSValueW PathIsRootW PathCombineW PathRemoveFileSpecW

kernel32

QueryPerformanceCounter QueryPerformanceFrequency ExitProcess SetConsoleScreenBufferSize SetStdHandle AllocConsole FreeConsole SetFilePointer FileTimeToSystemTime GetSystemTime FreeResource LockResource LoadResource SizeofResource GetSystemDefaultLangID LoadLibraryA TerminateProcess OpenProcess SetLastError HeapAlloc GetProcessHeap HeapFree VirtualAlloc VirtualFree SetErrorMode MoveFileExW GlobalFree GlobalUnlock WriteFile GlobalAlloc GetFileSize GetThreadPriority FreeLibrary LocalFileTimeToFileTime SystemTimeToFileTime FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime WaitForMultipleObjects GetSystemInfo GetVersionExA LocalFree LocalAlloc ConnectNamedPipe GetTimeZoneInformation MulDiv CompareStringA GetModuleHandleA GetModuleFileNameA GetWindowsDirectoryA GetSystemDirectoryA InterlockedExchange RtlUnwind SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetStartupInfoA GetCommandLineA CreateThread ExitThread FlushFileBuffers GetStdHandle GetFileType GetConsoleScreenBufferInfo SetConsoleTextAttribute DeviceIoControl GetOverlappedResult ResetEvent Sleep FindNextChangeNotification GetFileInformationByHandle GetLocalTime FindCloseChangeNotification FindClose GetSystemTimeAsFileTime GetCurrentThread SetThreadPriority InitializeCriticalSection WaitForSingleObject DeleteCriticalSection EnterCriticalSection GetTickCount LeaveCriticalSection SetEvent GetCommandLineW GetCurrentThreadId ReadFile GetLastError CloseHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapReAlloc HeapDestroy HeapCreate GetACP GetOEMCP FreeEnvironmentStringsA GetEnvironmentStrings SetHandleCount GetCurrentProcessId LCMapStringA GetStringTypeA GetLocaleInfoA HeapSize GlobalLock

user32

SetCapture ChangeClipboardChain DrawEdge DrawFrameControl EqualRect GetSubMenu GetMenu SetClipboardViewer EnumWindows ActivateKeyboardLayout IsDlgButtonChecked SetScrollInfo UpdateWindow ScrollWindowEx SetDlgItemInt GetMenuItemID RemoveMenu GetMenuState GetMenuDefaultItem EnableMenuItem AdjustWindowRect GetSysColorBrush OffsetRect InvalidateRgn MessageBeep SetCursorPos GetDlgItemInt GetDlgCtrlID GetDesktopWindow ValidateRect CreateIconIndirect CreateMenu SetMenuDefaultItem TrackPopupMenu DestroyMenu KillTimer GetDoubleClickTime RegisterHotKey UnregisterHotKey GetLastActivePopup OpenIcon GetForegroundWindow SetCursor SetActiveWindow BringWindowToTop EnumChildWindows CheckDlgButton GetKeyboardLayoutList GetScrollInfo InvalidateRect ClientToScreen ScreenToClient GetKeyState IsIconic GetWindowPlacement IsZoomed GetParent CopyRect EmptyClipboard SetClipboardData SetFocus PtInRect SetForegroundWindow BeginPaint EndPaint OpenClipboard CloseClipboard FillRect IsWindowVisible GetAsyncKeyState IsWindowEnabled GetFocus GetNextDlgTabItem SetWindowPos GetMenuItemCount CreatePopupMenu DeleteMenu AdjustWindowRectEx GetDlgItem GetWindowRect MapWindowPoints IntersectRect GetDC ReleaseDC WaitMessage UnhookWindowsHookEx CallNextHookEx TranslateMessage GetSystemMetrics GetClientRect GetCapture ReleaseCapture ShowWindow SetMenu RedrawWindow GetMessagePos RegisterWindowMessageA ReplyMessage AttachThreadInput GetCursorPos GetSysColor EndDialog DestroyIcon SetTimer DestroyWindow GetWindowThreadProcessId IsWindow GetKeyboardLayout PostQuitMessage

gdi32

StretchDIBits BitBlt CreateCompatibleDC GetTextAlign SetStretchBltMode GetDeviceCaps GetRegionData SelectClipRgn StretchBlt SetTextAlign CreateCompatibleBitmap OffsetClipRgn OffsetRgn CombineRgn GetDCOrgEx GetRandomRgn ExtCreateRegion GetStockObject GetNearestColor CreateSolidBrush CreateRectRgn CreateDIBSection GetCurrentObject ExcludeClipRect RectVisible DeleteDC SetBkMode CreateBitmapIndirect CreatePatternBrush SetBrushOrgEx SetBkColor SetTextColor PatBlt SelectObject GetDIBits DeleteObject

comdlg32

CommDlgExtendedError

advapi32

RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW DeleteService ControlService RegOpenKeyA InitializeSecurityDescriptor SetSecurityDescriptorDacl QueryServiceConfigW RegCloseKey RegisterEventSourceW ReportEventW DeregisterEventSource CreateServiceW StartServiceW OpenSCManagerW OpenServiceW CloseServiceHandle SetServiceStatus

shell32

DragAcceptFiles ord16 DragQueryPoint DragFinish SHGetDesktopFolder SHGetSpecialFolderLocation

ole32

CoTaskMemFree OleUninitialize OleInitialize CoCreateInstance CoInitializeEx CoUninitialize CLSIDFromString CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop DoDragDrop CreateBindCtx ReleaseStgMedium RegisterDragDrop

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_aab4f3dd483bf9ff3c93d0c236aa14dd_amadey_elex_floxif_pay2key_smoke-loader_stop

PE Signature issue

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic