2026-05-11_add69005a575e37d9e0c67e1c39a6bfb_amadey_elex_emotet_floxif_icedid_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-11_add69005a575e37d9e0c67e1c39a6bfb_amadey_elex_emotet_floxif_icedid_remcos_smoke-loader_stop
Size 11.5MB
Sample260511-pezhasht5x
SHA256 e306d30615962c1dd66b1cc69bd0219191ad58d836e29dd0eecba28ed85612ec
MD5 add69005a575e37d9e0c67e1c39a6bfb
SHA1 7c3640ded8d0326824fabe556b3cf6637fbbcc95
SHA512 58a8db0e7786cf67f6f3b9b7dd5012df4e584aaf41620a144e60092f973dff8c85e6ac714b18aba8988bdac072ebf3086220f0b1168202a8999e5a1eea716e88
SSDEEP 98304:PNhCtWVSQBWfueVA8LsKv2ZwmIRrWmtslQ7OMCToaLGJxBRPIp2zocB9IwfCcaZc:PXbVSQBWfueFT3Ymt2yOHTHaxRWcUSay
TLSH
T1B3C64911A3FA4259F2F36F70A9B952564E77BDA2AF38D18F0244351E1C34AD09AB4733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-11_add69005a575e37d9e0c67e1c39a6bfb_amadey_elex_emotet_floxif_icedid_remcos_smoke-loader_stop

File Explorer

2026-05-11_add69005a575e37d9e0c67e1c39a6bfb_amadey_elex_emotet_floxif_icedid_remcos_smoke-loader_stop

.exe 11.5MB

2026-05-11_add69005a575e37d9e0c67e1c39a6bfb_amadey_elex_emotet_floxif_icedid_remcos_smoke-loader_stop

IMPHASH 76cc87d8014f63550e2e8f565d39b2da
SHA256 e306d30615962c1dd66b1cc69bd0219191ad58d836e29dd0eecba28ed85612ec
MD5 add69005a575e37d9e0c67e1c39a6bfb
SHA1 7c3640ded8d0326824fabe556b3cf6637fbbcc95
SHA512 58a8db0e7786cf67f6f3b9b7dd5012df4e584aaf41620a144e60092f973dff8c85e6ac714b18aba8988bdac072ebf3086220f0b1168202a8999e5a1eea716e88
SSDEEP 98304:PNhCtWVSQBWfueVA8LsKv2ZwmIRrWmtslQ7OMCToaLGJxBRPIp2zocB9IwfCcaZc:PXbVSQBWfueFT3Ymt2yOHTHaxRWcUSay
TLSH
T1B3C64911A3FA4259F2F36F70A9B952564E77BDA2AF38D18F0244351E1C34AD09AB4733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b6:b2:50:ba:0f:7a:28:ea:e0:5a:6b:70:02:92:92:01:02:c0:81:15

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Chains

Oct 24, 2013

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Serial Number

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 13, 2013 - Jul 11, 2016

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

1152134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\Chunyung\Documents\Visual Studio 2005\Projects\RtHDVCpl - Copy\_ma4_release\win32\RtHDVCpl.pdb

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

winmm

mmioRead mmioCreateChunk mmioGetInfo mmioSeek mmioSetInfo mmioWrite mmioAscend mmioDescend mmioClose mmioOpenW mmioAdvance

dsound

ord6 ord3 ord1

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

propsys

PropVariantToUInt32 PropVariantCompareEx PropVariantToString

uxtheme

CloseThemeData DrawThemeBackground OpenThemeData

gdiplus

GdipGetImageGraphicsContext GdipGetImagePixelFormat GdiplusShutdown GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipGetImagePaletteSize GdipDisposeImage GdipGetImagePalette GdipBitmapLockBits GdipDrawImageRectI GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipFillPath GdipDeleteGraphics GdipDeleteBrush GdipFree GdipAlloc GdipCloneBrush GdipCreatePath GdipDeletePath GdipCreateFromHDC GdipAddPathPie GdipAddPathEllipse GdipCreatePathGradientFromPath GdipSetPathGradientCenterColor GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipDrawImageI GdipCreateBitmapFromScan0 GdipCreateBitmapFromHBITMAP GdipSetInterpolationMode GdiplusStartup

imm32

ImmDisableIME

kernel32

GetSystemDirectoryA WideCharToMultiByte ResetEvent DeleteFileW AllocConsole WriteConsoleW GetStdHandle CreateMutexW LocalAlloc LocalFree ReleaseMutex lstrcpyW TerminateThread OpenMutexW GetSystemPowerStatus GetPrivateProfileStringW GetModuleFileNameW GetFileSize GetPrivateProfileIntW GetLocalTime GetDateFormatW GetTimeFormatW SetFilePointer SetThreadPriority LoadLibraryA RaiseException GetVersionExA lstrcmpW CompareStringW FindResourceExW GlobalFindAtomW GlobalAddAtomW InterlockedDecrement GetModuleHandleA GetCurrentProcessId FormatMessageW VirtualProtect WritePrivateProfileStringW lstrcmpA SuspendThread CompareStringA GetLocaleInfoW EnumResourceLanguagesW ConvertDefaultLocale GetCurrentThread GetThreadLocale ReadFile FlushFileBuffers LockFile UnlockFile SetEndOfFile FindClose FindFirstFileW GetVolumeInformationW GetFullPathNameW GetTickCount InterlockedIncrement TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GlobalFlags FileTimeToSystemTime SetErrorMode FileTimeToLocalFileTime GetFileTime HeapFree HeapAlloc GetProcessHeap GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualQuery GetSystemTimeAsFileTime ExitThread RtlUnwind HeapReAlloc IsBadReadPtr HeapSize GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate QueryPerformanceCounter GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetLocaleInfoA GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP CreateFileA SetEnvironmentVariableA GlobalLock GlobalAlloc GlobalFree GlobalUnlock GetSystemDirectoryW VirtualFree VirtualAlloc FreeLibrary CompareFileTime SystemTimeToFileTime CreateDirectoryW GetTempPathW GetSystemInfo MulDiv WriteFile DeviceIoControl CreateFileW CreateProcessW GetWindowsDirectoryW GetSystemTime GetTimeZoneInformation SetThreadExecutionState GetFileAttributesW GetCurrentThreadId CreateThread GetCPInfo MultiByteToWideChar lstrlenA FreeResource GetVersionExW GetVersion lstrcmpiW CloseHandle lstrlenW WaitForSingleObject GetExitCodeThread SetEvent EnterCriticalSection ResumeThread GetCurrentProcess IsWow64Process DuplicateHandle CreateEventW SearchPathW InitializeCriticalSection Sleep WaitForMultipleObjects LeaveCriticalSection DeleteCriticalSection InterlockedExchange GetProcAddress GetModuleHandleW LoadLibraryW GetLastError SetLastError FindResourceW LoadResource LockResource SizeofResource ExitProcess GetUserDefaultUILanguage GlobalDeleteAtom

user32

GetPropW SetPropW GetClassNameW GetClassLongW IsChild WinHelpW SendDlgItemMessageA SendDlgItemMessageW EndDialog GetNextDlgTabItem IsWindowEnabled CreateDialogIndirectParamW GetActiveWindow IsDialogMessageW SetWindowTextW MoveWindow GetMenuCheckMarkDimensions ClientToScreen GetWindowDC BeginPaint EndPaint GetMenuStringW GetAsyncKeyState DestroyMenu ValidateRect GetMessageW SetRectEmpty WindowFromPoint CharUpperW RegisterClipboardFormatW SetWindowContextHelpId UnregisterClassW ReleaseCapture PostThreadMessageW CharNextW CopyAcceleratorTableW IsRectEmpty InvalidateRgn SetCapture GetNextDlgGroupItem MessageBeep SetParent GetDCEx LockWindowUpdate GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints ScrollWindow TrackPopupMenuEx GetKeyState GetScrollRange SetScrollPos GetScrollPos GetMenu MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DeferWindowPos GetScrollInfo SetScrollInfo DefWindowProcW CallWindowProcW RemovePropW IntersectRect SystemParametersInfoA GetWindowPlacement GetDlgCtrlID FindWindowW SetProcessDPIAware SetCursor PtInRect FrameRect TrackMouseEvent EnableMenuItem CheckMenuItem AdjustWindowRect ShowScrollBar GetFocus LoadCursorW WindowFromDC OffsetRect ScreenToClient SetMenuItemBitmaps DrawFocusRect InflateRect GetMonitorInfoW MonitorFromWindow GetShellWindow EqualRect UnionRect MapDialogRect GetWindow FindWindowExW DispatchMessageW UnhookWindowsHookEx TranslateMessage SetWindowsHookExW PostQuitMessage CallNextHookEx PeekMessageW EnumThreadWindows AttachThreadInput GetWindowThreadProcessId ShowWindow ExitWindowsEx GetWindowRect UpdateWindow TabbedTextOutW GetSysColorBrush FillRect ModifyMenuW InsertMenuW GetMenuItemCount AppendMenuW GetSubMenu DrawEdge SystemParametersInfoW ReleaseDC GetDC GetMenuItemInfoW GetDesktopWindow CreateMenu DestroyIcon GetMenuItemID LoadBitmapW GrayStringW DrawTextExW GetMenuState DrawTextW SetForegroundWindow GetForegroundWindow UnregisterDeviceNotification RegisterWindowMessageW SetMenuDefaultItem CreatePopupMenu GetCursorPos RegisterDeviceNotificationW InvalidateRect CopyRect RedrawWindow KillTimer SetTimer GetParent PostMessageW GetCapture SetWindowLongW GetWindowLongW IsWindowVisible DrawIcon SendMessageW IsIconic LoadIconW GetSystemMetrics GetClientRect SetRect EnableWindow GetSysColor IsWindow SetFocus GetWindowTextLengthW GetWindowTextW GetLastActivePopup SetWindowPos SetActiveWindow DrawIconEx UnregisterClassA

gdi32

GetMapMode SetDIBColorTable StretchBlt GetClipBox SetTextColor SetBkColor CreateRectRgn CreateRectRgnIndirect SetRectRgn CombineRgn CreatePatternBrush CreateBitmap ExtFloodFill SaveDC RestoreDC SetBkMode SetMapMode ExtTextOutW TextOutW CreateFontW GetStockObject GetObjectW CreateDIBSection RectVisible ExcludeClipRect DeleteObject SelectClipRgn SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn GetCharWidthW StretchDIBits GetTextMetricsW EnumFontFamiliesExW GetBkColor GetTextColor GetRgnBox IntersectClipRect CreateSolidBrush MoveToEx LineTo PtVisible Ellipse CreateFontIndirectW GetTextExtentPoint32W GetBkMode PatBlt Escape GetDeviceCaps SetPixel GetPixel CreatePen BitBlt CreateCompatibleDC SelectObject DeleteDC GetViewportExtEx GetWindowExtEx CreateCompatibleBitmap

msimg32

AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegOpenKeyW RegEnumKeyExW StartServiceW CloseServiceHandle OpenServiceW OpenSCManagerW RegNotifyChangeKeyValue AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey RegQueryValueW RegEnumKeyW RegDeleteKeyW

shell32

SHGetFolderPathW ShellExecuteExW Shell_NotifyIconW SHGetKnownFolderPath

comctl32

_TrackMouseEvent ImageList_GetIconSize InitCommonControlsEx

shlwapi

PathIsUNCW PathStripToRootW PathFindExtensionW SHStrDupW PathFindFileNameW

oledlg

OleUIBusyW

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CLSIDFromString CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard PropVariantClear CoGetClassObject CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize CoUninitialize CoInitialize CoCreateInstance CoTaskMemFree FreePropVariantArray PropVariantCopy CoFreeUnusedLibrariesEx CreateStreamOnHGlobal StringFromGUID2 CoTaskMemAlloc CoInitializeEx CoRevokeClassObject

oleaut32

SysAllocString OleCreateFontIndirect SafeArrayCreate VariantInit VariantClear SysStringLen SysAllocStringLen VariantChangeType SysFreeString VariantCopy SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_add69005a575e37d9e0c67e1c39a6bfb_amadey_elex_emotet_floxif_icedid_remcos_smoke-loader_stop

PE Signature issue

setupapi

winmm

dsound

version

propsys

uxtheme

gdiplus

imm32

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic