2026-09-29_97473ca6da20c95979cc8c396a2bf4d2_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_97473ca6da20c95979cc8c396a2bf4d2_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop
Size 408KB
Sample260930-wyncpsvv5k
SHA256 288c416d6844cf615456b2bac663a1815569177cc6d2b149e8d97dc40fe9f3d6
MD5 97473ca6da20c95979cc8c396a2bf4d2
SHA1 9716b4a57df47b651f7ba445518c8445064994e4
SHA512 5c79495e9536800a33cc599e074425dc3b20df287d2e86eea4bf5c8213466515d5cfcd28deff8989c0829f69c8290d7c0d635a096aadfc772e42aed998f50a79
SSDEEP 12288:Sx7YF8wKFKjJwhCnSZ8WnSqg4FLR3APJBjvrEH7w86:uR+lwknSZLw4lR3APXrEH7G
TLSH
T1E894BF10F482D3F7E8A614F4B1BD4F3609EA6939136A80E3B39547E94F6C2C1967970E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-29_97473ca6da20c95979cc8c396a2bf4d2_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop

File Explorer

2026-09-29_97473ca6da20c95979cc8c396a2bf4d2_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop

.exe 408KB

2026-09-29_97473ca6da20c95979cc8c396a2bf4d2_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop

IMPHASH 889dbb7bb88d5e7620e82f445d69dde5
SHA256 288c416d6844cf615456b2bac663a1815569177cc6d2b149e8d97dc40fe9f3d6
MD5 97473ca6da20c95979cc8c396a2bf4d2
SHA1 9716b4a57df47b651f7ba445518c8445064994e4
SHA512 5c79495e9536800a33cc599e074425dc3b20df287d2e86eea4bf5c8213466515d5cfcd28deff8989c0829f69c8290d7c0d635a096aadfc772e42aed998f50a79
SSDEEP 12288:Sx7YF8wKFKjJwhCnSZ8WnSqg4FLR3APJBjvrEH7w86:uR+lwknSZLw4lR3APXrEH7G
TLSH
T1E894BF10F482D3F7E8A614F4B1BD4F3609EA6939136A80E3B39547E94F6C2C1967970E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1c:73:bb:07:05:69:e8:29:e3:0d:ec:31:89:3c:cf:e0:d5:dd:d9:b3:de:32:a1:cd:54:f0:e9:a1:4a:56:0e:3f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=KOSCOM CORP.,O=KOSCOM CORP.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Chains

Oct 4, 2022

CN=KOSCOM CORP.,O=KOSCOM CORP.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=KOSCOM CORP.,O=KOSCOM CORP.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

28:2b:21:f4:78:fb:c4:fa:49:58:98:dc:b2:c3:22:51:5b:a9:20:76

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=KOSCOM CORP.,O=KOSCOM CORP.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Chains

Oct 4, 2022

CN=KOSCOM CORP.,O=KOSCOM CORP.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=KOSCOM CORP.,O=KOSCOM CORP.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=KOSCOM CORP.,O=KOSCOM CORP.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Serial Number

0b:cb:d9:62:f6:b9:99:f4:ee:06:2a:3c:a0:d4:3c:42

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 21, 2022 - Aug 25, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

83717

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\Goji_Release\SignKoreaWD\Release\SignKoreaWD.pdb

kernel32

ReadProcessMemory TerminateProcess GetProcAddress LoadLibraryA WideCharToMultiByte SetEnvironmentVariableA GetTimeZoneInformation OpenProcess WaitForSingleObject GetCurrentProcess CreateThread Sleep CloseHandle CreateToolhelp32Snapshot GetCurrentDirectoryW GetFullPathNameW GetProcessHeap SetEndOfFile CompareStringW FindNextFileW FindFirstFileExW GetDriveTypeW FindClose CreateFileA PeekNamedPipe GetFileInformationByHandle FileTimeToLocalFileTime FileTimeToSystemTime ResumeThread ExitThread DeleteFileA Process32NextW WaitForMultipleObjects Process32FirstW ResetEvent CreateNamedPipeA GetLastError DisconnectNamedPipe GetOverlappedResult ReadFile CreateEventA ConnectNamedPipe OutputDebugStringA GetCurrentThreadId IsDebuggerPresent GetModuleFileNameA HeapFree DecodePointer EncodePointer CreateDirectoryW GetFileAttributesW GetCommandLineA HeapSetInformation GetConsoleWindow ExitProcess EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter HeapAlloc IsProcessorFeaturePresent HeapCreate RaiseException WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetConsoleCtrlHandler FreeLibrary LoadLibraryW SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar RtlUnwind HeapSize HeapReAlloc FlushFileBuffers SetStdHandle WriteConsoleW LCMapStringW GetStringTypeW CreateFileW SetEvent CreateMutexA ReleaseMutex SuspendThread GetCurrentDirectoryA UnmapViewOfFile MapViewOfFileEx CreateSemaphoreA ReleaseSemaphore CreateFileMappingA OpenFileMappingA GetLocalTime SetErrorMode FormatMessageA GetModuleHandleA LoadLibraryExA MapViewOfFile GetModuleHandleW OutputDebugStringW

user32

WaitForInputIdle

advapi32

CloseServiceHandle OpenServiceA StartServiceCtrlDispatcherA DeleteService RegSetValueExA RegisterServiceCtrlHandlerA RegQueryValueExA CreateServiceA RegDeleteKeyA RegCreateKeyA StartServiceA RegOpenKeyExA SetServiceStatus OpenSCManagerA ControlService RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken CreateProcessAsUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHGetSpecialFolderPathA SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

userenv

CreateEnvironmentBlock

ws2_32

getaddrinfo setsockopt sendto recv socket freeaddrinfo closesocket send inet_addr accept WSAStartup WSAGetLastError WSACleanup ntohl htonl htons ntohs inet_ntoa recvfrom getsockopt __WSAFDIsSet bind select connect ioctlsocket listen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_97473ca6da20c95979cc8c396a2bf4d2_amadey_elex_floxif_hijackloader_redline-stealer_remcos_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

shlwapi

userenv

ws2_32

generic