2026-09-08_e2b03c481444278176eeee8e46260509_amadey_elex_floxif_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_e2b03c481444278176eeee8e46260509_amadey_elex_floxif_remcos_smoke-loader_stop
Size 1.5MB
Sample260910-clarastdqb
SHA256 e629bff1eae708487f71f491e6922b4adc4a7a51b0f6ae782d50446e268cbd50
MD5 e2b03c481444278176eeee8e46260509
SHA1 41641577ec9f97a13f0179b090cc7132ad76d03a
SHA512 24b1e134e26054d118f7bca6492d4b89b2717601d06eac56101c6fc2d66ebb44b8676b4de58054134cf0f4ea51113d30f7568ad1438808600734e217fdfbe1d3
SSDEEP 24576:eCt/2ZZ61TtK83kr4nWu97zlmKTMPIm1ei3dgNbWWVTSIUZLgQbKSVnl+RMdtCg6:/iYDu4WwURgChMOO
TLSH
T18875CF41B6C782F2D4036C78306ABB1FD965A2554728A5D3B7E42D0AE8743E07DFB287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-08_e2b03c481444278176eeee8e46260509_amadey_elex_floxif_remcos_smoke-loader_stop

File Explorer

2026-09-08_e2b03c481444278176eeee8e46260509_amadey_elex_floxif_remcos_smoke-loader_stop

.exe 1.5MB

2026-09-08_e2b03c481444278176eeee8e46260509_amadey_elex_floxif_remcos_smoke-loader_stop

IMPHASH 03b8835bfb89fccfff5040ff927847e1
SHA256 e629bff1eae708487f71f491e6922b4adc4a7a51b0f6ae782d50446e268cbd50
MD5 e2b03c481444278176eeee8e46260509
SHA1 41641577ec9f97a13f0179b090cc7132ad76d03a
SHA512 24b1e134e26054d118f7bca6492d4b89b2717601d06eac56101c6fc2d66ebb44b8676b4de58054134cf0f4ea51113d30f7568ad1438808600734e217fdfbe1d3
SSDEEP 24576:eCt/2ZZ61TtK83kr4nWu97zlmKTMPIm1ei3dgNbWWVTSIUZLgQbKSVnl+RMdtCg6:/iYDu4WwURgChMOO
TLSH
T18875CF41B6C782F2D4036C78306ABB1FD965A2554728A5D3B7E42D0AE8743E07DFB287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8e:af:41:6a:02:b7:ab:26:7c:46:35:a9:d9:db:0a:42:33:99:25:5f:59:87:21:48:36:b5:ad:28:45:01:1a:9a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=F.lux Software LLC,O=F.lux Software LLC,ST=California,C=US

Chains

Apr 8, 2026

CN=F.lux Software LLC,O=F.lux Software LLC,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=F.lux Software LLC,O=F.lux Software LLC,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

35:13:5e:d8:47:ea:c3:cd:6f:72:4d:ac:08:b3:16:2b:49:84:fc:5b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=F.lux Software LLC,O=F.lux Software LLC,ST=California,C=US

Chains

Apr 8, 2026

CN=F.lux Software LLC,O=F.lux Software LLC,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=F.lux Software LLC,O=F.lux Software LLC,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=F.lux Software LLC,O=F.lux Software LLC,ST=California,C=US

Serial Number

1e:76:07:71:52:58:3a:37:2c:33:8a:f1:1a:6e:cf:83

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 14, 2023 - Apr 13, 2026

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

658069

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\mherf\git\projects\flux\NoAccount\flux.pdb

netapi32

NetGetJoinInformation NetApiBufferFree

wsock32

htons setsockopt sendto recv bind socket closesocket send select ioctlsocket WSAStartup connect

winmm

timeGetTime timeBeginPeriod

kernel32

EnterCriticalSection GetModuleFileNameA LoadLibraryExA CreateMutexA ExitProcess GetDiskFreeSpaceExA QueryPerformanceCounter TerminateProcess OpenProcess GetCurrentProcess ResetEvent IsProcessorFeaturePresent InterlockedCompareExchange SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetProcAddress GetStringTypeW GetStringTypeA WaitForSingleObject DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId CloseHandle GetLastError LeaveCriticalSection CreateEventA Sleep GetTickCount SetEvent InitializeCriticalSectionAndSpinCount LCMapStringW LCMapStringA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetHandleCount GetConsoleMode GetConsoleCP HeapSize IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue HeapReAlloc VirtualFree HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemInfo GetModuleHandleW VirtualAlloc VirtualProtect RtlUnwind GetFileType SetStdHandle GetStartupInfoA GetCommandLineA CreateThread ResumeThread ExitThread GetSystemTimeAsFileTime HeapAlloc GetProcessHeap HeapFree WriteFile ReadFile UnmapViewOfFile FlushFileBuffers GetFileSize SetEndOfFile SetFilePointer lstrcmpW InterlockedDecrement InterlockedIncrement FreeLibrary RaiseException LoadResource SetLastError DisableThreadLibraryCalls lstrcmpA FlushInstructionCache IsDBCSLeadByte lstrcmpiA lstrlenA lstrlenW FindResourceA MultiByteToWideChar WideCharToMultiByte SetThreadPriority TerminateThread GetCurrentThreadId lstrcpynA LocalFree FormatMessageA LoadLibraryA GetComputerNameA GetProcessHandleCount GlobalAlloc GlobalLock GlobalUnlock CreateFileA GetVersion GetVersionExA GetLocaleInfoA GetStdHandle VerSetConditionMask VerifyVersionInfoA GetSystemPowerStatus SetThreadExecutionState FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetLocalTime LocalFileTimeToFileTime GetTimeFormatA QueryPerformanceFrequency GetFileAttributesExA DeleteFileA GetFileAttributesA MulDiv GetModuleHandleA VirtualQuery CreateDirectoryA SizeofResource

user32

EnableWindow AdjustWindowRect LoadImageA DestroyMenu SetWindowTextW RegisterHotKey SetWindowTextA SystemParametersInfoA UnregisterHotKey SetMenuDefaultItem GetWindowThreadProcessId PostMessageA AppendMenuA IsDlgButtonChecked CreatePopupMenu ShowWindow GetLastInputInfo CheckDlgButton GetDesktopWindow MsgWaitForMultipleObjects PeekMessageA DispatchMessageA EndPaint GetClassNameA GetClassInfoExA BeginPaint GetSysColor EnumDisplayMonitors MessageBeep ExitWindowsEx UpdateWindow ClientToScreen SetTimer GetWindowTextLengthA GetWindowTextA LoadStringA SetFocus IsIconic SetActiveWindow GetWindow GetWindowLongA GetClassInfoA SetWindowLongA DestroyWindow EndDialog EnumThreadWindows IsWindow RegisterWindowMessageA GetParent CreateWindowExA IsWindowVisible ShowWindowAsync SetMenu RegisterClassA SetClassLongA DefWindowProcA SetWindowPos MoveWindow GetSystemMetrics ReleaseCapture GetActiveWindow FlashWindowEx PostQuitMessage CallWindowProcA wsprintfA GetAsyncKeyState LoadCursorA SetCursor ShowCursor UnregisterClassA GetCursorPos SetCursorPos IsDialogMessageA TranslateAcceleratorA TranslateMessage MessageBoxA EnumChildWindows OpenClipboard EmptyClipboard SetClipboardData CloseClipboard SetDlgItemTextA FillRect SetCapture CharNextA ScreenToClient InvalidateRect InvalidateRgn RedrawWindow IsChild RegisterClassExA DestroyAcceleratorTable GetFocus CreateAcceleratorTableA DialogBoxParamA AdjustWindowRectEx GetMenu SetParent GetTopWindow GetMessageExtraInfo GetWindowRect KillTimer SetForegroundWindow LoadIconA FindWindowExA WindowFromPoint GetClientRect SendMessageA GetDC GetForegroundWindow TrackPopupMenuEx AppendMenuW ReleaseDC GetDlgItem

gdi32

SelectObject CreateCompatibleDC DeleteDC CreateDCA GetStockObject GetDeviceCaps SetDeviceGammaRamp GetDeviceGammaRamp CreateSolidBrush DeleteObject CreateCompatibleBitmap BitBlt GetObjectA GetKerningPairsA GetGlyphOutlineA CreateFontIndirectA SetBkMode StretchBlt SetStretchBltMode CreateDIBSection Rectangle CreatePen

advapi32

CheckTokenMembership OpenProcessToken LookupPrivilegeValueA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyA RegSetValueExA RegCreateKeyExA RegCloseKey RegQueryValueExA RegOpenKeyExA CreateWellKnownSid GetUserNameA AdjustTokenPrivileges CryptAcquireContextA CryptGenRandom

ole32

CoTaskMemRealloc CoTaskMemAlloc CoRegisterClassObject CLSIDFromString CreateStreamOnHGlobal CLSIDFromProgID CoGetClassObject OleLockRunning CoSetProxyBlanket OleUninitialize CoResumeClassObjects CoInitialize CoTaskMemFree CoInitializeEx CoUninitialize OleInitialize StringFromGUID2 CoCreateInstance

oleaut32

SysFreeString VariantClear VariantInit OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysAllocStringLen VariantTimeToSystemTime SystemTimeToVariantTime SysAllocString

psapi

GetProcessMemoryInfo GetModuleFileNameExA

setupapi

SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiOpenDevRegKey SetupDiGetClassDevsExA

mscms

WcsGetDefaultColorProfile WcsGetUsePerUserProfiles GetColorDirectoryA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

wininet

InternetCrackUrlA HttpEndRequestA HttpSendRequestExA HttpOpenRequestA InternetSetOptionA InternetCloseHandle HttpSendRequestA InternetConnectA InternetOpenA DeleteUrlCacheEntry HttpAddRequestHeadersA InternetWriteFile HttpQueryInfoA InternetQueryDataAvailable InternetReadFile

urlmon

URLDownloadToFileA UrlMkSetSessionOption URLDownloadToCacheFileA

dbghelp

MiniDumpWriteDump

comctl32

InitCommonControlsEx PropertySheetA CreatePropertySheetPageA

shlwapi

PathAddBackslashA SHDeleteValueA

wintrust

WinVerifyTrust

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteExA ShellExecuteA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_e2b03c481444278176eeee8e46260509_amadey_elex_floxif_remcos_smoke-loader_stop

PE Signature issue

PE Signature issue

netapi32

wsock32

winmm

kernel32

user32

gdi32

advapi32

ole32

oleaut32

psapi

setupapi

mscms

version

wininet

urlmon

dbghelp

comctl32

shlwapi

wintrust

shell32

generic