2026-10-04_bcb90003d60ddb67b9578c2da0d7adbe_amadey_elex_floxif_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-04_bcb90003d60ddb67b9578c2da0d7adbe_amadey_elex_floxif_smoke-loader_stealc_stop
Size 857KB
Sample261005-ext1esshph
SHA256 8d8bc1e7fd3d6f592d557148d97e64d21da44ade96f2c169157a3a987c222c10
MD5 bcb90003d60ddb67b9578c2da0d7adbe
SHA1 adabd4b90d431b8d0beeab568b44dd4fca9970c8
SHA512 0be4d9c9a0312441ac483b00a66c70d810487240d8a6deed5941972c0ca24d7b638ce9f254b6565eae383ce12ae4841a87fa4a5713f8c2326da4f10cc50f8b40
SSDEEP 12288:V5RFL9UjN2MzTeIWLYQ/ohfI6fsJxiFCXYuSbh7nVnBjvrEH72P:ZnUjleIW8Q/oppsJxiF+Yr7nVlrEH7Q
TLSH
T110159F70A093FC7AD6D3007479FDE528D3DB6E14171801CB7A88BD691BB63C135ACA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-04_bcb90003d60ddb67b9578c2da0d7adbe_amadey_elex_floxif_smoke-loader_stealc_stop

File Explorer

2026-10-04_bcb90003d60ddb67b9578c2da0d7adbe_amadey_elex_floxif_smoke-loader_stealc_stop

.exe 857KB

2026-10-04_bcb90003d60ddb67b9578c2da0d7adbe_amadey_elex_floxif_smoke-loader_stealc_stop

IMPHASH 1db8fe56733f7b332eb360cc55a63c0e
SHA256 8d8bc1e7fd3d6f592d557148d97e64d21da44ade96f2c169157a3a987c222c10
MD5 bcb90003d60ddb67b9578c2da0d7adbe
SHA1 adabd4b90d431b8d0beeab568b44dd4fca9970c8
SHA512 0be4d9c9a0312441ac483b00a66c70d810487240d8a6deed5941972c0ca24d7b638ce9f254b6565eae383ce12ae4841a87fa4a5713f8c2326da4f10cc50f8b40
SSDEEP 12288:V5RFL9UjN2MzTeIWLYQ/ohfI6fsJxiFCXYuSbh7nVnBjvrEH72P:ZnUjleIW8Q/oppsJxiF+Yr7nVlrEH7Q
TLSH
T110159F70A093FC7AD6D3007479FDE528D3DB6E14171801CB7A88BD691BB63C135ACA6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

91:37:0e:4f:b5:97:31:46:40:13:4f:d6:e0:ca:68:dd:80:34:da:3e:46:2a:57:b8:bf:0d:10:a9:1f:de:40:da

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=NHN Corporation,O=NHN Corporation,ST=Gyeonggi-do,C=KR

Chains

Jul 30, 2025

CN=NHN Corporation,O=NHN Corporation,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=NHN Corporation,O=NHN Corporation,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=NHN Corporation,O=NHN Corporation,ST=Gyeonggi-do,C=KR

Serial Number

37:ce:36:6f:5f:54:86:21:97:0d:46:21:7e:78:e6:15

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 22, 2022 - Oct 24, 2025

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

272123

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\HangameServerSVN\hgserver\HGLauncher\HGLauncher\HanStart_2008\products\release\korean\Hangame\hgstarter.pdb

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

kernel32

CreateEventA GetDiskFreeSpaceExA GetFileAttributesExA GetPrivateProfileStringA lstrlenA GetLocalTime GetSystemTime SetCurrentDirectoryA GetVersionExA FileTimeToSystemTime FileTimeToLocalFileTime CreateThread GlobalFree GlobalAlloc GetModuleHandleA RemoveDirectoryA FindNextFileA FindClose FindFirstFileA lstrcatA lstrcpyA CreateDirectoryA LocalFree LocalAlloc GetCurrentProcess FormatMessageA WinExec CreateProcessA WideCharToMultiByte WaitForMultipleObjects GetTempFileNameA ResumeThread SuspendThread SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetFileTime FreeLibrary GetProcAddress LoadLibraryA MapViewOfFile CreateFileMappingA SetFilePointer UnmapViewOfFile GetPrivateProfileIntA GetPrivateProfileSectionA OutputDebugStringA SetEvent SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCurrentDirectoryA GetLocaleInfoW FlushFileBuffers SetStdHandle IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP ReadFile GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetDriveTypeA GetTimeZoneInformation InitializeCriticalSectionAndSpinCount InterlockedExchange VirtualAlloc VirtualFree HeapCreate DeleteCriticalSection GetFileType GetStdHandle SetHandleCount LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP MultiByteToWideChar GetWindowsDirectoryA Sleep GetCommandLineA GetModuleFileNameA GetTempPathA GetFileAttributesA SetFileAttributesA OpenMutexA WaitForSingleObject ReleaseMutex CreateMutexA GetSystemDirectoryA CopyFileA GetLastError CreateFileA WriteFile CloseHandle DeleteFileA GetTickCount GetCurrentThreadId GlobalGetAtomNameA lstrcmpiA SetEndOfFile GetProcessHeap InitializeCriticalSection GetCPInfo HeapSize InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue LeaveCriticalSection EnterCriticalSection GetStartupInfoA ExitThread GetFullPathNameA ExitProcess GetModuleHandleW HeapFree HeapAlloc HeapReAlloc RtlUnwind RaiseException IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess

user32

DefWindowProcA IsWindow GetWindowLongA CallWindowProcA GetSystemMetrics CallNextHookEx SetWindowsHookExA RegisterClassExA LoadIconA LoadCursorA SetWindowPos EnableWindow UnhookWindowsHookEx GetClassLongA CreateWindowExA ShowWindow DestroyWindow wsprintfA TrackMouseEvent InvalidateRect PostMessageA SetTimer MessageBoxA SendMessageA SetRect LoadImageA GetDC ReleaseDC SetWindowLongA LoadAcceleratorsA TranslateAcceleratorA GetMessageA TranslateMessage DispatchMessageA IsWindowVisible PostQuitMessage UpdateWindow FillRect KillTimer SetForegroundWindow SetFocus ValidateRect OffsetRect DrawTextA LoadStringA GetClientRect

gdi32

SetBkColor Rectangle SetTextColor DPtoLP CreateFontIndirectA CreateSolidBrush CreatePen GetDeviceCaps CreateCompatibleDC GetObjectA SelectObject BitBlt DeleteDC DeleteObject SetBkMode

advapi32

RegSetValueExA RegCreateKeyExA OpenProcessToken GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority RegOpenKeyExA RegQueryValueA RegCloseKey RegQueryValueExA

shell32

SHGetSpecialFolderLocation SHGetMalloc SHBrowseForFolderA SHChangeNotify ShellExecuteA SHGetPathFromIDListA

ole32

CoUninitialize OleSetContainedObject CoInitialize CoCreateInstance OleUninitialize OleInitialize OleCreate

oleaut32

VariantClear SysAllocString VariantInit

urlmon

URLDownloadToFileA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

wininet

InternetCanonicalizeUrlA InternetOpenA InternetOpenUrlA FindFirstUrlCacheEntryExA FindNextUrlCacheEntryExA DeleteUrlCacheEntry HttpQueryInfoA InternetCloseHandle InternetSetOptionA InternetOpenUrlW InternetGetLastResponseInfoA InternetReadFile HttpAddRequestHeadersA InternetConnectA HttpOpenRequestA HttpSendRequestA InternetQueryDataAvailable FindCloseUrlCache

shlwapi

SHDeleteValueA PathFileExistsA StrFormatByteSizeA PathIsDirectoryA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-04_bcb90003d60ddb67b9578c2da0d7adbe_amadey_elex_floxif_smoke-loader_stealc_stop

PE Signature issue

rpcrt4

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

version

wininet

shlwapi

generic