soulclose | 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop

General

Target
2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop
Size 1.7MB
Sample260523-1qqv3set4x
SHA256 35f45f01031f86eec654f5879efd01005e494d16c934f5135876e8d2b2fe9507
MD5 a3a40634b6c0c538bcf6bcf732a07c9e
SHA1 50df523d74f97489ec47ad3cd878e00898cebdb2
SHA512 6ea9b49199461bb299871f93939827dab47dcef67993e41d95d4ed2e41b71543a95184579ef22aa15171767d1b88c0d9f48f362865fea8eaa4a3a29c4f3733b6
SSDEEP 24576:sGPibzfkBlSNziKwA5xfPi1dJU43I98U7nYYJ2tHhADSANLHgZpJEMLu:xowSN2Za/4MnYYJ2ZhqSGLHkJEMy
TLSH
T1DA858C15F2F08437D6B6163159BB66E0F66ABC218B20C3CF138E3A6D6DF16815D2436E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm soulclose

Family: Soulclose
Soulclose is a Windows worm written in VisualBasic.
worm soulclose

Detects Soulclose 1 IoCs

resource	yara_rule
sample	family_soulclose

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop

2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop

.exe 1.7MB

SHA256 35f45f01031f86eec654f5879efd01005e494d16c934f5135876e8d2b2fe9507
MD5 a3a40634b6c0c538bcf6bcf732a07c9e
SHA1 50df523d74f97489ec47ad3cd878e00898cebdb2
SHA512 6ea9b49199461bb299871f93939827dab47dcef67993e41d95d4ed2e41b71543a95184579ef22aa15171767d1b88c0d9f48f362865fea8eaa4a3a29c4f3733b6
SSDEEP 24576:sGPibzfkBlSNziKwA5xfPi1dJU43I98U7nYYJ2tHhADSANLHgZpJEMLu:xowSN2Za/4MnYYJ2ZhqSGLHkJEMy
TLSH
T1DA858C15F2F08437D6B6163159BB66E0F66ABC218B20C3CF138E3A6D6DF16815D2436E
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

6352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths