2026-09-30_5de49065c65c0b9862eb8bf76648e28a_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_5de49065c65c0b9862eb8bf76648e28a_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader
Size 1.4MB
Sample260930-m8b8razvhx
SHA256 b2d9af9e063d2559388eee97c8f9b015448f4900bfc095a62bc3867699f706a1
MD5 5de49065c65c0b9862eb8bf76648e28a
SHA1 badf27254ad13a1ac971304f2e887af763e25d0c
SHA512 7c0fd134bb1400f8c2ab3826ebbdcf945c9b8b7b3fb69eea602402045e71cfc34c28df33d9c50cea6fa76a312671a694ef7ad27dfd88843ad015388e7e02c2a6
SSDEEP 24576:vL5W1snfFJhf2n2A3DTv3IHv+/cEaTEprrCWBVtCOGpGITPvj7m+2rEH79:vLw1snt7U2AG+EEaTEprCWfNCT3jy+T
TLSH
T1DE65AF13D7038235E1E100B7D57D87B6AA786B74231190E3E3C859E89AE85D1BE3E25F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor rat

Malware Config

Signatures

DCAgent remote management tool 1 IoCs

DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
sample	hacktool_dcagent

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-30_5de49065c65c0b9862eb8bf76648e28a_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader

File Explorer

2026-09-30_5de49065c65c0b9862eb8bf76648e28a_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader

.exe 1.4MB

2026-09-30_5de49065c65c0b9862eb8bf76648e28a_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader

IMPHASH 5483ae80bff8efdcf079eabc7e813443
SHA256 b2d9af9e063d2559388eee97c8f9b015448f4900bfc095a62bc3867699f706a1
MD5 5de49065c65c0b9862eb8bf76648e28a
SHA1 badf27254ad13a1ac971304f2e887af763e25d0c
SHA512 7c0fd134bb1400f8c2ab3826ebbdcf945c9b8b7b3fb69eea602402045e71cfc34c28df33d9c50cea6fa76a312671a694ef7ad27dfd88843ad015388e7e02c2a6
SSDEEP 24576:vL5W1snfFJhf2n2A3DTv3IHv+/cEaTEprrCWBVtCOGpGITPvj7m+2rEH79:vLw1snt7U2AG+EEaTEprCWfNCT3jy+T
TLSH
T1DE65AF13D7038235E1E100B7D57D87B6AA786B74231190E3E3C859E89AE85D1BE3E25F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

DCAgent remote management tool

DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

backdoor rat
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

9d:2c:15:56:26:f7:25:49:49:e3:5b:e5:3e:9b:3b:85:9d:9b:18:ab:f5:85:60:b3:d4:c3:d0:37:b5:85:74:0f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Sep 16, 2024

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

44:85:59:e8:d5:9f:e0:56:29:9e:6e:8f

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2023 - Oct 9, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

762890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\16-09-2024\WindowsBuilds\DC_NATIVE\9093392\desktopcentral\ONPREMISE\SA_SRC\native\agent\Release\dcagentservice.pdb

advapi32

RevertToSelf RegOpenCurrentUser ImpersonateLoggedOnUser RegCloseKey RegOpenKeyExW RegCreateKeyExW RegEnumKeyExW RegQueryValueExW RegSetValueExW CloseServiceHandle CreateServiceW OpenSCManagerW DeleteService OpenServiceW SetServiceStatus RegCreateKeyW RegQueryValueExA RegOpenKeyExA ChangeServiceConfigW QueryServiceConfigW StartServiceCtrlDispatcherW CreateProcessAsUserW LookupAccountSidW GetTokenInformation OpenProcessToken RegCreateKeyExA RegisterServiceCtrlHandlerExW RegNotifyChangeKeyValue SetNamedSecurityInfoW RegQueryInfoKeyW RegEnumKeyW RegDeleteKeyA RegEnumKeyExA RegSetValueExA RegQueryInfoKeyA LookupPrivilegeNameA LookupPrivilegeValueA CreateProcessAsUserA LogonUserA RegDeleteValueA RegDeleteValueW RegEnumKeyA RegOpenKeyA GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid LookupAccountNameA CryptDestroyKey CryptReleaseContext CryptGenKey CryptGetUserKey CryptAcquireContextA ControlService OpenServiceA OpenSCManagerA QueryServiceStatusEx RegEnumValueA CryptDestroyHash CryptHashData CryptCreateHash DeregisterEventSource ReportEventA RegisterEventSourceA SetTokenInformation DuplicateTokenEx CryptGetHashParam QueryServiceStatus LookupAccountSidA

ole32

StringFromGUID2 CoInitializeEx CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitializeSecurity

oleaut32

SysFreeString SysAllocString SysStringLen SysAllocStringByteLen VariantClear VariantInit SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationA WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory

psapi

GetModuleFileNameExW EnumProcesses GetModuleBaseNameW EnumProcessModules

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile LoadUserProfileW LoadUserProfileA

wsock32

WSACleanup WSAGetLastError WSAStartup

netapi32

NetApiBufferFree NetGetJoinInformation NetWkstaUserGetInfo

crypt32

CryptQueryObject CryptStringToBinaryA CertCreateCertificateContext CertCloseStore CertAddCertificateContextToStore CertEnumCertificatesInStore CertOpenStore PFXImportCertStore PFXVerifyPassword CertDeleteCertificateFromStore CertVerifyTimeValidity CertFreeCertificateContext CertNameToStrW CertGetNameStringA CertFindCertificateInStore CryptMsgGetParam

winhttp

WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSetOption WinHttpReadData WinHttpQueryHeaders WinHttpConnect WinHttpSetCredentials WinHttpWriteData WinHttpQueryOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpSetStatusCallback WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest

dcagenthttp

AgentSendRequestEx

dclibxml2

xmlNewTextReaderFilename xmlStrcmp xmlFreeTextReader xmlTextReaderRead xmlTextReaderName xmlTextReaderDepth xmlTextReaderValue xmlTextReaderAttributeCount xmlTextReaderGetAttribute xmlCleanupParser xmlParseMemory xmlNodeListGetString xmlFree xmlDocGetRootElement xmlFreeDoc xmlParseFile

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW

shell32

SHCreateDirectoryExW SHCreateDirectoryExA

shlwapi

PathIsDirectoryA StrStrIW PathFindExtensionA PathFileExistsW StrStrIA StrTrimA

kernel32

GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy DeleteCriticalSection RaiseException MoveFileExA LocalLock InterlockedExchange DecodePointer GetLocaleInfoW GetStringTypeW RtlUnwind GetCommandLineA HeapSetInformation GetFileType PeekNamedPipe GetDriveTypeA FindFirstFileExA LocalUnlock DuplicateHandle GetCPInfo ExitThread ExitProcess EncodePointer CompareStringW LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree HeapCreate GetACP GetOEMCP IsValidCodePage SetHandleCount GetStdHandle GetStartupInfoW FreeEnvironmentStringsW GetEnvironmentStringsW GetConsoleCP GetConsoleMode SetStdHandle GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CreatePipe WriteConsoleW SetEndOfFile VirtualQuery SetEnvironmentVariableA ResumeThread SuspendThread GetNativeSystemInfo lstrcmpiA GetVersion lstrcmpW DisconnectNamedPipe SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar CloseHandle GetLastError DeleteFileW CreateDirectoryA GetProcAddress GetModuleHandleW InterlockedIncrement LocalFree GetModuleFileNameW LoadLibraryW Process32NextW Process32FirstW CreateToolhelp32Snapshot SystemTimeToFileTime GetCurrentProcess TerminateProcess OpenProcess CreateThread WideCharToMultiByte LocalAlloc lstrlenW FormatMessageW GetSystemTime FreeConsole GenerateConsoleCtrlEvent GetExitCodeProcess Sleep InterlockedDecrement WriteFile CreateFileA CreateProcessW GetCurrentProcessId WaitForSingleObject CreateFileW DeleteTimerQueue CreateTimerQueueTimer CreateTimerQueue GetCurrentThreadId FileTimeToLocalFileTime GetSystemTimeAsFileTime SetEvent OpenEventA DeleteTimerQueueTimer ReadFile GetTickCount CreateEventW FreeLibrary SetConsoleCtrlHandler DeviceIoControl GetDriveTypeW LeaveCriticalSection InitializeCriticalSection EnterCriticalSection TerminateThread MapViewOfFile CreateFileMappingW UnmapViewOfFile GetLocalTime ReleaseMutex WaitForMultipleObjects GetModuleHandleA lstrlenA GetFileSizeEx CreateDirectoryW CreateProcessA SetCurrentDirectoryA GetCurrentDirectoryA Process32Next ProcessIdToSessionId Process32First SetCurrentDirectoryW SetFilePointer LoadLibraryA DeleteFileA GetFileInformationByHandle GetModuleFileNameA ConnectNamedPipe CreateNamedPipeA SetLastError GetCurrentDirectoryW FileTimeToSystemTime GetSystemDirectoryA CopyFileA FindClose FindNextFileA SystemTimeToTzSpecificLocalTime FindFirstFileA ExpandEnvironmentStringsA GetSystemInfo GetVersionExA GetComputerNameExW FormatMessageA GetFileSize RemoveDirectoryA SetDllDirectoryA CreateMutexA GetTimeZoneInformation FindFirstFileW GetEnvironmentVariableA GetFileAttributesA GetLocaleInfoA FindNextFileW GetEnvironmentVariableW GetFileAttributesExA GetFullPathNameA InitializeCriticalSectionAndSpinCount QueryPerformanceCounter FlushFileBuffers CopyFileW

user32

UnregisterDeviceNotification wsprintfW wsprintfA RegisterDeviceNotificationW MessageBoxA

odbc32

ord39 ord36 ord9 ord41 ord31 ord1 ord2 ord20 ord16 ord12 ord19 ord3 ord49 ord48 ord72 ord26 ord13 ord29 ord8 ord18 ord11 ord43 ord4

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_5de49065c65c0b9862eb8bf76648e28a_amadey_elex_floxif_hijackloader_mafia_remcos_smoke-loader

PE Signature issue

advapi32

ole32

oleaut32

wtsapi32

psapi

userenv

wsock32

netapi32

crypt32

winhttp

dcagenthttp

dclibxml2

setupapi

shell32

shlwapi

kernel32

user32

odbc32

generic