2026-10-11_91a837c797993f3e1c1de74923236d39_amadey_elex_floxif_hijackloader_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_91a837c797993f3e1c1de74923236d39_amadey_elex_floxif_hijackloader_rhadamanthys_stop
Size 461KB
Sample261012-te9eqagv7j
SHA256 21f765f448299befb220788caecd0eb291d75a3d40fbcd97742e57d7f43bd8e4
MD5 91a837c797993f3e1c1de74923236d39
SHA1 5e3edf5dccd38cee7db075407175ff11442234e1
SHA512 bb6b246490780cfa1033a8392c7cf155bcd547791f1ebb996afec5409f8834be99bf2a9a188344f17c8eb376681070802cc3527c59c6f4914d56af68cee16b91
SSDEEP 12288:/vNEeSp6VrIdTlKVRmX5HpKIi7r/UthtBjvrEH7FG:/60rYlaRW5HpKI5rEH7FG
TLSH
T1AFA4BF1177D0C7B6D65225323869D73966FAAD384F2542C7A3406A6DEE3C3C29A7830F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-11_91a837c797993f3e1c1de74923236d39_amadey_elex_floxif_hijackloader_rhadamanthys_stop

File Explorer

2026-10-11_91a837c797993f3e1c1de74923236d39_amadey_elex_floxif_hijackloader_rhadamanthys_stop

.exe 461KB

2026-10-11_91a837c797993f3e1c1de74923236d39_amadey_elex_floxif_hijackloader_rhadamanthys_stop

IMPHASH 15469153035a2484976c6d5285cd5b5b
SHA256 21f765f448299befb220788caecd0eb291d75a3d40fbcd97742e57d7f43bd8e4
MD5 91a837c797993f3e1c1de74923236d39
SHA1 5e3edf5dccd38cee7db075407175ff11442234e1
SHA512 bb6b246490780cfa1033a8392c7cf155bcd547791f1ebb996afec5409f8834be99bf2a9a188344f17c8eb376681070802cc3527c59c6f4914d56af68cee16b91
SSDEEP 12288:/vNEeSp6VrIdTlKVRmX5HpKIi7r/UthtBjvrEH7FG:/60rYlaRW5HpKI5rEH7FG
TLSH
T1AFA4BF1177D0C7B6D65225323869D73966FAAD384F2542C7A3406A6DEE3C3C29A7830F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

40:e0:34:5c:d1:96:64:8e:cf:8d:d8:fc:c7:91:67:1a:e5:69:08:83:3e:cc:11:55:e3:2d:09:e1:9e:d9:35:99

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Feb 3, 2023

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

56:46:8f:b3:60:ee:d5:57:b9:07:37:ec:8d:a1:66:6c:53:04:6a:71

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Feb 3, 2023

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Serial Number

0f:f5:03:34:76:03:fb:03:4b:12:c6:db:62:fe:6c:3f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 14, 2022 - Apr 16, 2024

Minor OS version

Major OS version

Entry point

114827

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Data\src\_apluspoint\alupdate-windows\Bin\Release\DebugInfo\eausvc.pdb

kernel32

RtlUnwind ExitProcess RaiseException HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualFree VirtualAlloc HeapCreate GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetStartupInfoW GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode SetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileAttributesW CreateFileW SetEndOfFile SetFilePointer GlobalFindAtomW LoadLibraryA GetVersionExA lstrlenA GlobalAddAtomW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GlobalFlags GetModuleHandleA InterlockedDecrement WritePrivateProfileStringW SetLastError GlobalFree GlobalUnlock FormatMessageW LocalFree lstrlenW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW InterlockedExchange GlobalLock lstrcmpW GlobalAlloc GetModuleHandleW GetVersionExW TerminateProcess OpenProcess Process32NextW ProcessIdToSessionId lstrcmpiW Process32FirstW CreateToolhelp32Snapshot FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcess HeapFree DisconnectNamedPipe FlushFileBuffers WriteFile ReadFile HeapAlloc GetProcessHeap CreateThread ConnectNamedPipe CreateNamedPipeW MultiByteToWideChar WideCharToMultiByte Sleep GetCurrentProcessId GetLocalTime DeleteFileW FindClose FindFirstFileW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CloseHandle TerminateThread WaitForSingleObject GetLastError GetModuleFileNameW GetSystemDefaultLCID FindResourceW LoadResource LockResource GetTickCount SizeofResource

user32

GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics GetSysColorBrush GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW GetWindow GetCapture GetWindowRect GetWindowLongW GetClassNameW PtInRect GetWindowTextW SetWindowTextW GetSysColor ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW UnhookWindowsHookEx SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible SendMessageW GetKeyState PeekMessageW GetCursorPos ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu PostQuitMessage PostMessageW LoadCursorW SetCursor WinHelpW LoadIconW RegisterWindowMessageW GetDlgCtrlID DestroyMenu ShowWindow

gdi32

PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap GetStockObject GetDeviceCaps

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW CreateProcessAsUserW DuplicateTokenEx GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryValueExW RegOpenKeyExW DeleteService ControlService QueryServiceStatus StartServiceW OpenServiceW ChangeServiceConfig2W CreateServiceW OpenSCManagerW CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

shlwapi

PathQuoteSpacesW PathFindExtensionW

oleaut32

VariantChangeType VariantInit VariantClear

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_91a837c797993f3e1c1de74923236d39_amadey_elex_floxif_hijackloader_rhadamanthys_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

userenv

generic