2026-09-19_8caf408aaba4295177c3e93f216044cf_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_8caf408aaba4295177c3e93f216044cf_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee
Size 5.7MB
Sample260919-3dendszthv
SHA256 9547e92014daf6729508db2c96ee246f380910045c1e0f6c8464046fce7ed533
MD5 8caf408aaba4295177c3e93f216044cf
SHA1 83f7003c726fd903cd603ef88f607e9487777f17
SHA512 7f63ea40f9a8c6ddaff0a0b823e00b4d38786ae86b9f5bf2276dde95652682acf9eb45a23abb5a3bed7b0c6eb7eb3992783e20ab279e9600623d43db12dd80aa
SSDEEP 98304:gL3sCZV8X2JT0y0g9Q0ZxLkbchqoZCqmIgmhmacu7mdWTc99rp2t1Efyk6lcblK2:w8C/8Xkgy3+ugwzjbhmacu7mdxNp2vmb
TLSH
T1DE5633160371D3F7D0D311B0346EF7B169B02B3D023D9A1B9B5C6B1A9A6A793CA79902
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-19_8caf408aaba4295177c3e93f216044cf_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee

File Explorer

2026-09-19_8caf408aaba4295177c3e93f216044cf_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee

.exe 5.7MB

2026-09-19_8caf408aaba4295177c3e93f216044cf_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee

IMPHASH 9b2f6a441f9ff8df98ae6e9e6b5d4271
SHA256 9547e92014daf6729508db2c96ee246f380910045c1e0f6c8464046fce7ed533
MD5 8caf408aaba4295177c3e93f216044cf
SHA1 83f7003c726fd903cd603ef88f607e9487777f17
SHA512 7f63ea40f9a8c6ddaff0a0b823e00b4d38786ae86b9f5bf2276dde95652682acf9eb45a23abb5a3bed7b0c6eb7eb3992783e20ab279e9600623d43db12dd80aa
SSDEEP 98304:gL3sCZV8X2JT0y0g9Q0ZxLkbchqoZCqmIgmhmacu7mdWTc99rp2t1Efyk6lcblK2:w8C/8Xkgy3+ugwzjbhmacu7mdxNp2vmb
TLSH
T1DE5633160371D3F7D0D311B0346EF7B169B02B3D023D9A1B9B5C6B1A9A6A793CA79902
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

73:5a:39:58:91:df:16:22:d6:6a:e2:61:2f:6c:f5:ca:a1:94:7a:63:3e:fa:f6:61:9e:71:a6:10:46:4d:10:04

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 28, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

61:3c:7a:7b:7e:4f:43:c8:c0:6c:14:92:23:6f:40:50:5c:43:96:ad

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 28, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 12, 2018 - Jul 26, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:eb:69:aa:cc:3e:29:9f:2d:39:00:00:00:00:00:eb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 23, 2018 - Nov 23, 2019

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 12, 2018 - Jul 26, 2019

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ee:f8:c5:f5:36:3b:81:1c:8c:00:00:00:00:00:ee

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 24, 2018 - Jan 10, 2020

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

Major OS version

Entry point

102119

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb

advapi32

CreateWellKnownSid InitializeSecurityDescriptor SetEntriesInAclW SetSecurityDescriptorDacl SetSecurityDescriptorOwner CryptAcquireContextW CryptGenRandom CryptReleaseContext DecryptFileW

kernel32

GetTickCount SetEnvironmentVariableW GetLastError ExpandEnvironmentStringsW CreateProcessW Sleep WaitForSingleObject GetExitCodeProcess CloseHandle SetFileAttributesW InitializeCriticalSection CreateEventW GetEnvironmentVariableW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetCommandLineW lstrlenW CompareStringW LocalFree CreateDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetErrorMode RemoveDirectoryW MoveFileExW GetProcAddress GetSystemDirectoryW LoadLibraryW GetModuleHandleW CreateThread LocalAlloc RaiseException ExitThread WaitForMultipleObjects ResetEvent CreateEventA GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime GetModuleHandleA GetVersionExA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetEndOfFile DuplicateHandle ReadFile SetFilePointerEx GlobalFree GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc LCMapStringW FreeLibrary InterlockedExchange RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent SetStdHandle WriteConsoleW FlushFileBuffers CreateFileA GetLocalTime GetComputerNameW lstrlenA FormatMessageW GetSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileW GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW GetProcessHeap GlobalAlloc LoadLibraryA

comctl32

ord17

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW GetTopWindow GetWindowThreadProcessId GetWindow SendMessageW PostMessageW DialogBoxParamW GetDlgItem SetWindowTextW EndDialog PostQuitMessage LoadStringW SetWindowLongW GetWindowLongW CharUpperW

oleaut32

SysAllocString VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_8caf408aaba4295177c3e93f216044cf_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee

PE Signature issue

PE Signature issue

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

oleaut32

generic