2026-09-16_fb012d3d81d258f5af8ea10faa5a7658_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_fb012d3d81d258f5af8ea10faa5a7658_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader
Size 988KB
Sample260916-skypqsbd76
SHA256 ac854908bcdc6453b122dc7b068e676657d78b871d7a6c61710d5c35455f0721
MD5 fb012d3d81d258f5af8ea10faa5a7658
SHA1 76717d52df9ed5b83bce388dbbc00d3b971d4c47
SHA512 6e96913fc5119492f4435bb9a12061d68522ea7e42332e3c3508c0bf7a0769af35133bf16d13be0b1d1612d90ac5da4b76ed5fcfe6e8a6bd9780ed28e8603654
SSDEEP 12288:vZ+eSDwmxvL/f3vCN1PMaLi6rAyIQjyBjvrEH7q:BhSDwADf3qN1PvQrEH7q
TLSH
T14325B411E7EB8339F9F36FBC697942620A76BCA15E38D64E5340065D18F4A90DA70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_fb012d3d81d258f5af8ea10faa5a7658_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader

File Explorer

2026-09-16_fb012d3d81d258f5af8ea10faa5a7658_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader

.exe 988KB

2026-09-16_fb012d3d81d258f5af8ea10faa5a7658_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader

IMPHASH 3ab7cc62e4963955ad408cd420cd8ef1
SHA256 ac854908bcdc6453b122dc7b068e676657d78b871d7a6c61710d5c35455f0721
MD5 fb012d3d81d258f5af8ea10faa5a7658
SHA1 76717d52df9ed5b83bce388dbbc00d3b971d4c47
SHA512 6e96913fc5119492f4435bb9a12061d68522ea7e42332e3c3508c0bf7a0769af35133bf16d13be0b1d1612d90ac5da4b76ed5fcfe6e8a6bd9780ed28e8603654
SSDEEP 12288:vZ+eSDwmxvL/f3vCN1PMaLi6rAyIQjyBjvrEH7q:BhSDwADf3qN1PvQrEH7q
TLSH
T14325B411E7EB8339F9F36FBC697942620A76BCA15E38D64E5340065D18F4A90DA70B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2f:87:94:18:4d:95:8f:e8:22:40:47:26:05:39:e4:07:cd:24:b4:0f:09:de:fb:7f:16:44:8a:26:61:45:ee:77

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

Chains

Apr 28, 2023

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

86:2a:db:16:b1:ce:37:c8:4b:de:4f:84:6a:46:41:6d:c3:64:6c:91

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

Chains

Apr 28, 2023

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

Serial Number

8b:a1:f1:72:fd:50:ba:8d:4c:11:b7:4f:fa:c8:a2:82

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2021 - Mar 24, 2024

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

135530

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

DpInst.pdb

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken IsTextUnicode SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid SetEntriesInAclW DeleteService StartServiceW ControlService OpenSCManagerW CloseServiceHandle OpenServiceW QueryServiceStatus RegDeleteValueW RegCreateKeyExW RegSetValueExW RegDeleteKeyW CheckTokenMembership ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

GetFileAttributesW DeleteFileW ReleaseMutex SetFilePointer HeapFree GetProcessHeap HeapAlloc CreateMutexW FreeConsole SetConsoleMode SetConsoleCursorPosition GetConsoleScreenBufferInfo FreeLibrary FillConsoleOutputCharacterW ReadConsoleOutputW GetConsoleMode GetStdHandle GetProcAddress LoadLibraryW WriteConsoleW IsValidLocale lstrlenW lstrcmpW CompareStringW GetTempFileNameW FindFirstFileW FindNextFileW FindClose CopyFileW SetFileAttributesW FormatMessageW RaiseException GetFileSize CreateFileMappingW MapViewOfFile WriteConsoleOutputW UnmapViewOfFile InterlockedDecrement InterlockedIncrement CreateFileW WriteFile CreateThread WaitForMultipleObjectsEx InterlockedCompareExchange WaitForSingleObjectEx SetEvent CreateEventW GetExitCodeProcess DeviceIoControl VerSetConditionMask VerifyVersionInfoW CreateDirectoryW RemoveDirectoryW GetCurrentDirectoryW GetShortPathNameW GetFullPathNameW GetSystemDirectoryW GetSystemWindowsDirectoryW MoveFileExW SearchPathW GetSystemDefaultUILanguage LoadLibraryExW CreateFileA SetEndOfFile GetConsoleOutputCP WriteConsoleA GetLocaleInfoW FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA GetConsoleCP GetLocaleInfoA Sleep LoadLibraryExA ReadFile LCMapStringW LCMapStringA GetThreadLocale SetThreadLocale GetUserDefaultUILanguage GetVersionExW GetLocalTime GetWindowsDirectoryW GetModuleFileNameW SetCurrentDirectoryW WaitForSingleObject GetOEMCP GetACP GetCPInfo UnhandledExceptionFilter TerminateProcess OutputDebugStringA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapCreate GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA GetFileType SetHandleCount GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA ExitProcess GetModuleHandleA SetUnhandledExceptionFilter VirtualQuery GetSystemInfo GetModuleHandleW VirtualAlloc VirtualProtect GetStartupInfoW GetEnvironmentVariableW lstrcmpiW WideCharToMultiByte InterlockedExchange HeapSize HeapReAlloc HeapDestroy GetVersionExA DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection GetCommandLineW LocalAlloc GlobalFree LocalFree MultiByteToWideChar GetCurrentProcess GetLastError CloseHandle FindResourceExW FindResourceW LoadResource LockResource SizeofResource EnumResourceLanguagesW LocalReAlloc EnterCriticalSection

gdi32

SetLayout DeleteDC GetObjectW CreateCompatibleBitmap CreateBitmap SelectObject StartPage EndPage StartDocW EndDoc GetTextMetricsW GetDeviceCaps CreateFontIndirectW DeleteObject CreateCompatibleDC

user32

AllowSetForegroundWindow DefWindowProcW PostQuitMessage GetUserObjectInformationW GetProcessWindowStation GetIconInfo DrawIconEx CreateIconIndirect LoadIconW LoadBitmapW DrawTextExW LoadImageW GetSystemMetrics GetSysColor DestroyWindow GetWindowLongW SendDlgItemMessageW InvalidateRect SystemParametersInfoW GetDC ReleaseDC SetWindowLongW SetWindowTextW GetParent PostMessageW IsDlgButtonChecked CheckDlgButton SetFocus CallWindowProcW DestroyIcon DialogBoxParamW SetDlgItemTextW CharLowerW GetDlgItem SendMessageW MessageBoxW RegisterClassExW CreateWindowExW ShowWindow UnregisterClassA EndDialog

ntdll

RtlNtStatusToDosError NtOpenThreadToken NtQueryInformationToken NtOpenProcessToken RtlUnwind NtClose

shell32

SHGetFolderPathW ShellExecuteExW ord59 CommandLineToArgvW

setupapi

SetupDiClassNameFromGuidW SetupDiOpenClassRegKey SetupInstallFilesFromInfSectionW SetupPromptReboot SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW SetupDiGetActualSectionToInstallW SetupFindNextLine SetupFindNextMatchLineW SetupOpenInfFileW SetupGetLineCountW SetupCloseInfFile SetupFindFirstLineW SetupGetStringFieldW pSetupSetGlobalFlags pSetupGetGlobalFlags SetupGetFieldCount SetupGetIntField SetupOpenAppendInfFileW SetupDiSetClassInstallParamsW SetupDiGetClassDevsW SetupDiGetSelectedDriverW SetupDiGetDriverInfoDetailW CM_Enumerate_Classes CM_Get_DevNode_Status SetupDiCreateDeviceInfoList SetupDiSetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiOpenDevRegKey SetupDiOpenDeviceInfoW SetupDiSetSelectedDevice SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiBuildDriverInfoList SetupDiCallClassInstaller SetupDiGetDeviceRegistryPropertyW SetupGetTargetPathW SetupQueueCopyIndirectW SetupQueueCopyW SetupOpenFileQueue SetupInitDefaultQueueCallbackEx SetupDefaultQueueCallbackW SetupCommitFileQueueW SetupTermDefaultQueueCallback SetupCloseFileQueue SetupCopyOEMInfW CM_Locate_DevNodeW CM_Get_Device_ID_List_SizeW CM_Get_Device_ID_ListW CM_Get_Device_IDW CM_Setup_DevNode SetupDiEnumDeviceInfo CMP_WaitNoPendingInstallEvents CM_Query_And_Remove_SubTreeW

wintrust

WinVerifyTrust CryptCATAdminCalcHashFromFileHandle

ole32

CoTaskMemFree StringFromCLSID CoUninitialize CoInitialize CoCreateInstance

oleaut32

VariantInit VariantClear VariantChangeType SysAllocString SysFreeString

comctl32

CreatePropertySheetPageW ImageList_ReplaceIcon ImageList_SetBkColor PropertySheetW ImageList_Create

comdlg32

PrintDlgExW GetSaveFileNameW

crypt32

CertFreeCertificateContext CertFreeCTLContext CertGetCTLContextProperty CryptQueryObject

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_fb012d3d81d258f5af8ea10faa5a7658_amadey_cobalt-strike_conti_darkgate_elex_floxif_hijackloader

PE Signature issue

PE Signature issue

advapi32

kernel32

gdi32

user32

ntdll

shell32

setupapi

wintrust

ole32

oleaut32

comctl32

comdlg32

crypt32

version

generic