2026-10-13_28dd5d0bc0a1e6b69e0ea03b4dacdade_amadey_elex_floxif_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_28dd5d0bc0a1e6b69e0ea03b4dacdade_amadey_elex_floxif_rhadamanthys_stop
Size 486KB
Sample261015-vze72sty6r
SHA256 4e8cf3f033cba98f092adc950e916c845b1400824200c03c174559b25dad53e7
MD5 28dd5d0bc0a1e6b69e0ea03b4dacdade
SHA1 ef0a8e948a51f4795c8736f4198a74206c0a6cb1
SHA512 726c55219b7b9bdd5feb4ad8c2cc68afc4f510595d93c0fef8a53db218e6636da5881ff31e807c097b4f7a0afc127cb470cac8d75f70c481f9e24aeff78cca3e
SSDEEP 12288:dL3mXfkE0JRIyDCEdHpKIi7rLBBcBjvrEH7LR:sGRvDCEdHpKIMBYrEH7LR
TLSH
T1D6B4BF0177E1D3B5C55215356569933B6AFEBD390F2582C7A7806A3DAF383C29A3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-13_28dd5d0bc0a1e6b69e0ea03b4dacdade_amadey_elex_floxif_rhadamanthys_stop

File Explorer

2026-10-13_28dd5d0bc0a1e6b69e0ea03b4dacdade_amadey_elex_floxif_rhadamanthys_stop

.exe 486KB

2026-10-13_28dd5d0bc0a1e6b69e0ea03b4dacdade_amadey_elex_floxif_rhadamanthys_stop

IMPHASH a0ff5bb1bef7815309a43e745705d196
SHA256 4e8cf3f033cba98f092adc950e916c845b1400824200c03c174559b25dad53e7
MD5 28dd5d0bc0a1e6b69e0ea03b4dacdade
SHA1 ef0a8e948a51f4795c8736f4198a74206c0a6cb1
SHA512 726c55219b7b9bdd5feb4ad8c2cc68afc4f510595d93c0fef8a53db218e6636da5881ff31e807c097b4f7a0afc127cb470cac8d75f70c481f9e24aeff78cca3e
SSDEEP 12288:dL3mXfkE0JRIyDCEdHpKIi7rLBBcBjvrEH7LR:sGRvDCEdHpKIMBYrEH7LR
TLSH
T1D6B4BF0177E1D3B5C55215356569933B6AFEBD390F2582C7A7806A3DAF383C29A3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0f:09:47:b7:85:ea:7b:60:58:c8:61:17:bf:66:97:c0:16:33:be:3e:e1:4e:1f:1a:54:24:11:aa:b0:64:e9:f9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Sep 16, 2026

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

a6:5e:98:41:2c:52:81:53:f4:05:5f:bb:9c:94:bb:8a:6c:da:bf:e2

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Sep 16, 2026

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Serial Number

08:44:7b:d5:c2:a3:2b:3e:8d:6b:e6:88:1e:ea:2c:9c

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2026 - Apr 19, 2027

Minor OS version

Major OS version

Entry point

133686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Data\src\alupdate-windows\Bin\Release\DebugInfo\eausvc.pdb

kernel32

HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode VirtualAlloc LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA VirtualFree GetModuleFileNameA GetStdHandle IsValidCodePage GetOEMCP GetACP GetCPInfo HeapSize HeapReAlloc RaiseException ExitProcess RtlUnwind GetStartupInfoW ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter SetEndOfFile SetFilePointer GlobalFindAtomW LoadLibraryA GetVersionExA lstrlenA GlobalAddAtomW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GlobalFlags GetModuleHandleA InterlockedDecrement WritePrivateProfileStringW SetLastError GlobalFree GlobalUnlock FormatMessageW lstrlenW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW InterlockedExchange GlobalLock lstrcmpW GlobalAlloc GetVersionExW TerminateProcess FreeLibrary LoadLibraryW Process32NextW lstrcmpiW Process32FirstW CreateToolhelp32Snapshot GetCurrentProcess FlushFileBuffers WriteFile ReadFile DisconnectNamedPipe HeapFree HeapAlloc GetProcessHeap CreateThread ConnectNamedPipe CreateNamedPipeW MultiByteToWideChar WideCharToMultiByte Sleep FindNextFileW ProcessIdToSessionId GetProcAddress GetFileAttributesW OpenProcess GetModuleHandleW GetDriveTypeW LocalFree LocalAlloc CreateFileW lstrcmpA GetCurrentProcessId GetLocalTime DeleteFileW FindClose FindFirstFileW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection TerminateThread WaitForSingleObject GetLastError CloseHandle GetModuleFileNameW GetSystemDefaultLCID FindResourceW LoadResource LockResource SetStdHandle SizeofResource

user32

SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics GetSysColorBrush GetWindowThreadProcessId GetLastActivePopup GetClassLongW EnableWindow MessageBoxW GetWindow GetDlgCtrlID GetWindowRect GetWindowLongW SetCursor LoadCursorW PostMessageW GetClassNameW PtInRect GetWindowTextW SetWindowTextW GetSysColor ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW UnhookWindowsHookEx SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible SendMessageW GetKeyState PeekMessageW GetCursorPos ValidateRect GetMenuState WinHelpW LoadIconW RegisterWindowMessageW IsWindowEnabled PostQuitMessage GetSubMenu GetMenuItemCount GetMenuItemID ShowWindow DestroyMenu GetCapture

gdi32

DeleteDC GetStockObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap GetDeviceCaps

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

GetNamedSecurityInfoW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus GetAclInformation EqualSid ConvertStringSidToSidW SetNamedSecurityInfoW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW CreateProcessAsUserW DuplicateTokenEx GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW SetEntriesInAclW RegCloseKey RegQueryValueExW RegOpenKeyExW DeleteService ControlService QueryServiceStatus StartServiceW OpenServiceW ChangeServiceConfig2W CreateServiceW OpenSCManagerW CloseServiceHandle CreateWellKnownSid GetAce

shlwapi

PathQuoteSpacesW PathFindExtensionW

oleaut32

VariantChangeType VariantClear VariantInit

crypt32

CertGetNameStringW CertOpenStore CertFindCertificateInStore CertCloseStore

wintrust

WinVerifyTrustEx

imagehlp

ImageEnumerateCertificates ImageGetCertificateData

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

221KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_28dd5d0bc0a1e6b69e0ea03b4dacdade_amadey_elex_floxif_rhadamanthys_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

crypt32

wintrust

imagehlp

userenv

generic