2026-09-29_f47c4361fd052f4c2c250109b24aec29_amadey_elex_floxif_pay2key_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_f47c4361fd052f4c2c250109b24aec29_amadey_elex_floxif_pay2key_smoke-loader_stop
Size 1.8MB
Sample260930-scftyst1et
SHA256 fb6ddee8f181e62b61444791d0b022dd107bbc9bd4a94978b299802a79c8bbac
MD5 f47c4361fd052f4c2c250109b24aec29
SHA1 473df28d55c1ba8bb9051e2ccc84bb5946bfa38b
SHA512 78e8a66d57ba73234b55842a42302c4427a8a82a8c597a994b0a4e815fadfd9dbaaba4687c43c295b9cd413fa72a69333910a40815f710bfcf7ad2b64bebda62
SSDEEP 49152:CtCejjt1nAV97yKtFnFK26stEPObW0BqLrH9pGP:Ct7j2jbWT9MP
TLSH
T12F859D02ABD341B2FD866633112E67139B39AB1D0317E5CF96A03D6069712F31A7E2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-29_f47c4361fd052f4c2c250109b24aec29_amadey_elex_floxif_pay2key_smoke-loader_stop

File Explorer

2026-09-29_f47c4361fd052f4c2c250109b24aec29_amadey_elex_floxif_pay2key_smoke-loader_stop

.exe 1.8MB

2026-09-29_f47c4361fd052f4c2c250109b24aec29_amadey_elex_floxif_pay2key_smoke-loader_stop

IMPHASH 0225ddae2adf3e15d8df8f0b49ff49e0
SHA256 fb6ddee8f181e62b61444791d0b022dd107bbc9bd4a94978b299802a79c8bbac
MD5 f47c4361fd052f4c2c250109b24aec29
SHA1 473df28d55c1ba8bb9051e2ccc84bb5946bfa38b
SHA512 78e8a66d57ba73234b55842a42302c4427a8a82a8c597a994b0a4e815fadfd9dbaaba4687c43c295b9cd413fa72a69333910a40815f710bfcf7ad2b64bebda62
SSDEEP 49152:CtCejjt1nAV97yKtFnFK26stEPObW0BqLrH9pGP:Ct7j2jbWT9MP
TLSH
T12F859D02ABD341B2FD866633112E67139B39AB1D0317E5CF96A03D6069712F31A7E2D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a4:01:16:17:96:ca:c2:be:ce:6a:22:e7:1d:91:e8:1d:c3:b4:f3:31:6f:14:2d:bf:68:7b:07:87:09:88:30:bd

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

Jan 23, 2026

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Serial Number

04:4c:41:86:39:d4:52:74:47:0b:f1:a5:fa:de:a0:18

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2025 - May 20, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1359060

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\dev\Everything-1.4\Release\Everything.pdb

comctl32

ImageList_GetIconSize ImageList_DrawEx _TrackMouseEvent InitCommonControlsEx

ws2_32

WSAGetLastError WSACleanup closesocket send recv socket connect WSAAsyncSelect setsockopt WSAStartup shutdown listen bind getpeername ntohs getsockname htons gethostbyname inet_addr accept

shlwapi

SHRegGetUSValueW PathIsRootW PathCombineW PathRemoveFileSpecW

kernel32

QueryPerformanceCounter QueryPerformanceFrequency ExitProcess SetConsoleScreenBufferSize SetStdHandle AllocConsole FreeConsole SetFilePointer FileTimeToSystemTime GetSystemTime FreeResource LockResource LoadResource SizeofResource GetSystemDefaultLangID LoadLibraryA TerminateProcess OpenProcess SetLastError HeapAlloc GetProcessHeap HeapFree VirtualAlloc VirtualFree SetErrorMode MoveFileExW GlobalFree GlobalUnlock WriteFile GlobalAlloc GetFileSize GetThreadPriority FreeLibrary LocalFileTimeToFileTime SystemTimeToFileTime FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime WaitForMultipleObjects GetSystemInfo GetVersionExA LocalFree LocalAlloc ConnectNamedPipe GetTimeZoneInformation MulDiv CompareStringA GetModuleHandleA GetModuleFileNameA GetWindowsDirectoryA GetSystemDirectoryA InterlockedExchange RtlUnwind SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetStartupInfoA GetCommandLineA CreateThread ExitThread FlushFileBuffers GetStdHandle GetFileType GetConsoleScreenBufferInfo SetConsoleTextAttribute DeviceIoControl GetOverlappedResult ResetEvent Sleep FindNextChangeNotification GetFileInformationByHandle GetLocalTime FindCloseChangeNotification FindClose GetSystemTimeAsFileTime GetCurrentThread SetThreadPriority InitializeCriticalSection WaitForSingleObject DeleteCriticalSection EnterCriticalSection GetTickCount LeaveCriticalSection SetEvent GetCommandLineW GetCurrentThreadId ReadFile GetLastError CloseHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapReAlloc HeapDestroy HeapCreate GetACP GetOEMCP FreeEnvironmentStringsA GetEnvironmentStrings SetHandleCount GetCurrentProcessId LCMapStringA GetStringTypeA GetLocaleInfoA HeapSize GlobalLock

user32

SetCapture ChangeClipboardChain DrawEdge DrawFrameControl EqualRect GetSubMenu GetMenu SetClipboardViewer EnumWindows ActivateKeyboardLayout IsDlgButtonChecked SetScrollInfo UpdateWindow ScrollWindowEx SetDlgItemInt GetMenuItemID RemoveMenu GetMenuState GetMenuDefaultItem EnableMenuItem AdjustWindowRect GetSysColorBrush OffsetRect InvalidateRgn MessageBeep SetCursorPos GetDlgItemInt GetDlgCtrlID GetDesktopWindow ValidateRect CreateIconIndirect CreateMenu SetMenuDefaultItem TrackPopupMenu DestroyMenu KillTimer GetDoubleClickTime RegisterHotKey UnregisterHotKey GetLastActivePopup OpenIcon GetForegroundWindow SetCursor SetActiveWindow BringWindowToTop EnumChildWindows CheckDlgButton GetKeyboardLayoutList GetScrollInfo InvalidateRect ClientToScreen ScreenToClient GetKeyState IsIconic GetWindowPlacement IsZoomed GetParent CopyRect EmptyClipboard SetClipboardData SetFocus PtInRect SetForegroundWindow BeginPaint EndPaint OpenClipboard CloseClipboard FillRect IsWindowVisible GetAsyncKeyState IsWindowEnabled GetFocus GetNextDlgTabItem SetWindowPos GetMenuItemCount CreatePopupMenu DeleteMenu AdjustWindowRectEx GetDlgItem GetWindowRect MapWindowPoints IntersectRect GetDC ReleaseDC WaitMessage UnhookWindowsHookEx CallNextHookEx TranslateMessage GetSystemMetrics GetClientRect GetCapture ReleaseCapture ShowWindow SetMenu RedrawWindow GetMessagePos RegisterWindowMessageA ReplyMessage AttachThreadInput GetCursorPos GetSysColor EndDialog DestroyIcon SetTimer DestroyWindow GetWindowThreadProcessId IsWindow GetKeyboardLayout PostQuitMessage

gdi32

StretchDIBits BitBlt CreateCompatibleDC GetTextAlign SetStretchBltMode GetDeviceCaps GetRegionData SelectClipRgn StretchBlt SetTextAlign CreateCompatibleBitmap OffsetClipRgn OffsetRgn CombineRgn GetDCOrgEx GetRandomRgn ExtCreateRegion GetStockObject GetNearestColor CreateSolidBrush CreateRectRgn CreateDIBSection GetCurrentObject ExcludeClipRect RectVisible DeleteDC SetBkMode CreateBitmapIndirect CreatePatternBrush SetBrushOrgEx SetBkColor SetTextColor PatBlt SelectObject GetDIBits DeleteObject

comdlg32

CommDlgExtendedError

advapi32

RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW DeleteService ControlService RegOpenKeyA InitializeSecurityDescriptor SetSecurityDescriptorDacl QueryServiceConfigW RegCloseKey RegisterEventSourceW ReportEventW DeregisterEventSource CreateServiceW StartServiceW OpenSCManagerW OpenServiceW CloseServiceHandle SetServiceStatus

shell32

DragAcceptFiles ord16 DragQueryPoint DragFinish SHGetDesktopFolder SHGetSpecialFolderLocation

ole32

CoTaskMemFree OleUninitialize OleInitialize CoCreateInstance CoInitializeEx CoUninitialize CLSIDFromString CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop DoDragDrop CreateBindCtx ReleaseStgMedium RegisterDragDrop

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_f47c4361fd052f4c2c250109b24aec29_amadey_elex_floxif_pay2key_smoke-loader_stop

PE Signature issue

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic