2026-10-19_1698f379b865f05ff11efba4c3de54c6_amadey_elex_floxif_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_1698f379b865f05ff11efba4c3de54c6_amadey_elex_floxif_stealc_stop
Size 357KB
Sample261021-dh42eact6k
SHA256 7302fa458cb6d465ba6018dc858bc6305f58b3fe00cbbf57c53dae8c7b88873d
MD5 1698f379b865f05ff11efba4c3de54c6
SHA1 253a69b0bdc9d247b8447b74658341f604117fd3
SHA512 b7014d0788d90489291b5380b2f807d0677da9390aea0687b96d67286dc5ec8d36ea95571d6efe0182d8ccb4be6bc9fbf2d785a6ec209a8ef45011d33928f8a0
SSDEEP 6144:3tjFsL7ZWiPAPdbXNAFlhLoGjxy+eBV+UdvrEFp7hKuhK0:3tjFPRX0lhsYxaBjvrEH780
TLSH
T15974060033E58268F1B31EB2AEBE91616A7ABD791B35C0CF6390951E1DB5A91CD30737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-19_1698f379b865f05ff11efba4c3de54c6_amadey_elex_floxif_stealc_stop

File Explorer

2026-10-19_1698f379b865f05ff11efba4c3de54c6_amadey_elex_floxif_stealc_stop

.exe 357KB

2026-10-19_1698f379b865f05ff11efba4c3de54c6_amadey_elex_floxif_stealc_stop

IMPHASH 67315f4a6ecb9a5d9d5ce82f8a60a611
SHA256 7302fa458cb6d465ba6018dc858bc6305f58b3fe00cbbf57c53dae8c7b88873d
MD5 1698f379b865f05ff11efba4c3de54c6
SHA1 253a69b0bdc9d247b8447b74658341f604117fd3
SHA512 b7014d0788d90489291b5380b2f807d0677da9390aea0687b96d67286dc5ec8d36ea95571d6efe0182d8ccb4be6bc9fbf2d785a6ec209a8ef45011d33928f8a0
SSDEEP 6144:3tjFsL7ZWiPAPdbXNAFlhLoGjxy+eBV+UdvrEFp7hKuhK0:3tjFPRX0lhsYxaBjvrEH780
TLSH
T15974060033E58268F1B31EB2AEBE91616A7ABD791B35C0CF6390951E1DB5A91CD30737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

52:df:04:14:e3:50:1e:e3:89:fd:43:e1:4a:a5:b5:4b:3b:a3:50:f9

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Hewlett-Packard Company,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Hewlett-Packard Company,O=Hewlett-Packard Company,L=Palo Alto,ST=California,C=US

Chains

Nov 11, 2009

CN=Hewlett-Packard Company,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Hewlett-Packard Company,O=Hewlett-Packard Company,L=Palo Alto,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Hewlett-Packard Company,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Hewlett-Packard Company,O=Hewlett-Packard Company,L=Palo Alto,ST=California,C=US

Serial Number

08:99:45:31:fd:f1:b2:eb:b8:c7:82:1b:f6:50:fd:cf

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 18, 2008 - Dec 18, 2011

Minor OS version

Major OS version

Entry point

95137

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\prog\Deliverables\BeyondQLB\BeyondQLB_6_50\Release\QLBCTRL.pdb

kernel32

FreeLibrary GetProcAddress LoadLibraryW OutputDebugStringW GetCurrentThreadId GetCurrentProcessId PulseEvent OpenEventW CreateDirectoryW GetLocalTime OpenSemaphoreW CreateSemaphoreW ReleaseSemaphore FindClose GetWindowsDirectoryW FindFirstFileW lstrcmpW lstrcmpiW GetVersionExW CreateThread GetCommandLineW WaitForSingleObject GetModuleHandleW GetModuleFileNameW MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW RaiseException SetEvent DeleteCriticalSection InitializeCriticalSection InterlockedIncrement GetVersion GetCurrentProcess FormatMessageW VerSetConditionMask GetSystemPowerStatus ResumeThread ExitThread RtlUnwind LeaveCriticalSection CreateFileA ReadFile SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLocaleInfoA FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP WideCharToMultiByte SetFilePointer LoadLibraryA HeapAlloc GetProcessHeap HeapFree InterlockedDecrement GlobalAlloc GlobalFree ExpandEnvironmentStringsW Sleep lstrlenW CreateFileW DeviceIoControl CloseHandle CreateEventW ResetEvent WaitForMultipleObjects VerifyVersionInfoW GetLastError InitializeCriticalSectionAndSpinCount IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleHandleA GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetStartupInfoA EnterCriticalSection GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetStdHandle WriteFile ExitProcess GetStartupInfoW

user32

FindWindowW GetSystemMetrics DispatchMessageW TranslateMessage GetMessageW PostThreadMessageW RegisterWindowMessageW MessageBoxW PostMessageW wsprintfW CharNextW GetCursorPos SetForegroundWindow CreatePopupMenu AppendMenuW SetMenuDefaultItem TrackPopupMenu DestroyMenu GetDoubleClickTime LoadStringW LoadImageW SetTimer KillTimer PostQuitMessage DefWindowProcW GetClassInfoExW LoadCursorW RegisterClassExW CreateWindowExW ShowWindow UpdateWindow DestroyWindow CharUpperW

advapi32

RegEnumKeyExW RegDeleteValueW RegDeleteKeyW DeleteService StartServiceW QueryServiceStatus CreateServiceW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey OpenSCManagerW OpenServiceW CloseServiceHandle RegQueryInfoKeyW

shell32

SHGetFolderPathW FindExecutableW Shell_NotifyIconW ShellExecuteW

ole32

CoInitialize OleRun CoCreateInstance CoUninitialize CoInitializeEx CoTaskMemAlloc CoTaskMemRealloc StringFromGUID2 CoRegisterClassObject CoRevokeClassObject CoTaskMemFree

oleaut32

UnRegisterTypeLi LoadTypeLi SysStringLen RegisterTypeLi VarUI4FromStr SysFreeString SysAllocString SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData VariantInit SafeArrayCreateVector SafeArrayPutElement SafeArrayGetElement SafeArrayDestroy GetErrorInfo

shlwapi

StrStrIW StrStrW StrTrimW StrCatW StrChrW StrCmpW StrCmpNIW StrCpyW

setupapi

SetupDiSetClassInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiCallClassInstaller

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_1698f379b865f05ff11efba4c3de54c6_amadey_elex_floxif_stealc_stop

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

setupapi

generic