2026-05-28_f7a2cd5066c92fe61bf044d7bffb12eb_amadey_elex_emotet_floxif_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_f7a2cd5066c92fe61bf044d7bffb12eb_amadey_elex_emotet_floxif_remcos_smoke-loader_stop
Size 1.8MB
Sample260528-tbqs7se16w
SHA256 7d27f5724f73156daf54fba2c8799fc8b7c01b0877c7dd223571b0fcc27fcf95
MD5 f7a2cd5066c92fe61bf044d7bffb12eb
SHA1 3165f16fc8675c322bd2ba8dcbbafc761fa9be8d
SHA512 9e5a29b5a0da7b769294a6150075b1da2d3e018300189f403bd4cedbf3c8a5e9e71620dda2e8cb74172ddf41bc597f794333919194e3a45b2f8a9363c1053358
SSDEEP 49152:PGXBMaaHgNYdFuDDNsz3LquRD/sLTRE7Y22:PGXBR0dYDDNszJRD/sLT0C
TLSH
T15995DF61FAD2C7B6D2EB8336DBB2965858F2B818D4B4811F72C44A4DD9F6700A53CB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-28_f7a2cd5066c92fe61bf044d7bffb12eb_amadey_elex_emotet_floxif_remcos_smoke-loader_stop

File Explorer

2026-05-28_f7a2cd5066c92fe61bf044d7bffb12eb_amadey_elex_emotet_floxif_remcos_smoke-loader_stop

.exe 1.8MB

2026-05-28_f7a2cd5066c92fe61bf044d7bffb12eb_amadey_elex_emotet_floxif_remcos_smoke-loader_stop

IMPHASH c1c338a7b1823b54556cd3182d55b8df
SHA256 7d27f5724f73156daf54fba2c8799fc8b7c01b0877c7dd223571b0fcc27fcf95
MD5 f7a2cd5066c92fe61bf044d7bffb12eb
SHA1 3165f16fc8675c322bd2ba8dcbbafc761fa9be8d
SHA512 9e5a29b5a0da7b769294a6150075b1da2d3e018300189f403bd4cedbf3c8a5e9e71620dda2e8cb74172ddf41bc597f794333919194e3a45b2f8a9363c1053358
SSDEEP 49152:PGXBMaaHgNYdFuDDNsz3LquRD/sLTRE7Y22:PGXBR0dYDDNszJRD/sLT0C
TLSH
T15995DF61FAD2C7B6D2EB8336DBB2965858F2B818D4B4811F72C44A4DD9F6700A53CB13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

dc:3c:11:d7:ae:32:e6:bf:e8:e4:43:1c:e9:82:60:ed:9a:cc:8d:0f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Chains

Nov 3, 2010

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Serial Number

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 21, 2010 - Jun 11, 2013

Minor OS version

Major OS version

Entry point

151162

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Project\SkyTel_VC_NORECOG\release\SkyTel.pdb

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

winmm

waveOutMessage PlaySoundW waveOutGetNumDevs waveOutGetDevCapsW

dsound

ord8 ord3

kernel32

SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetCurrentProcess FindClose FindFirstFileW GetVolumeInformationW GetFullPathNameW SetErrorMode FileTimeToLocalFileTime GetFileTime HeapFree HeapAlloc GetProcessHeap GetStartupInfoW HeapReAlloc RaiseException RtlUnwind ExitThread ExitProcess HeapSize WriteFile VirtualAlloc GetSystemInfo VirtualQuery SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetTimeZoneInformation GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA ReadFile GlobalFlags InterlockedIncrement FileTimeToSystemTime GetThreadLocale lstrlenA TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection GetModuleHandleA GetCurrentProcessId GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange ResumeThread FreeResource GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA lstrcmpW GetVersionExA InterlockedDecrement GetModuleHandleW WritePrivateProfileStringW GetPrivateProfileIntW GlobalLock GlobalUnlock MulDiv SetLastError GetModuleFileNameW FreeLibrary LoadLibraryW GetProcAddress SuspendThread GetPrivateProfileStringW GetFileAttributesW lstrcatW GlobalAlloc WideCharToMultiByte lstrlenW WinExec GetTickCount FormatMessageW GlobalFree GlobalSize FindResourceExW GetVersionExW GetUserDefaultUILanguage Sleep GetCurrentThreadId FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar WaitForMultipleObjects DeviceIoControl CreateFileW CloseHandle WaitForSingleObject SetEvent CreateThread CreateEventW GetLastError LocalAlloc LocalFree VirtualProtect

user32

SetCapture ReleaseCapture CharNextW CopyAcceleratorTableW IsRectEmpty SetRect InvalidateRgn GetNextDlgGroupItem MessageBeep RegisterClipboardFormatW GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetWindowContextHelpId MapDialogRect PostQuitMessage SetCursor CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem GetMessageW GetActiveWindow GetCursorPos ValidateRect IsWindowEnabled MoveWindow SetWindowTextW IsDialogMessageW SendDlgItemMessageW WinHelpW GetCapture CallNextHookEx GetClassLongW SetPropW GetPropW RemovePropW GetFocus SetFocus GetWindowTextLengthW GetLastActivePopup SetActiveWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints GetKeyState GetMenu CreateWindowExW GetClassInfoExW RegisterClassW GetSysColor AdjustWindowRectEx EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW SetWindowLongW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement UnregisterClassA CharUpperW PostMessageW GetWindowLongW UnhookWindowsHookEx GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetSystemMenu SendMessageTimeoutW DrawIcon GetClientRect UnregisterClassW LoadCursorW GetSysColorBrush LoadIconW IsIconic DestroyMenu EndPaint SendDlgItemMessageA BeginPaint ShowWindow UpdateWindow GetWindowThreadProcessId AttachThreadInput InvalidateRect GetForegroundWindow SetForegroundWindow SendInput IsWindow GetWindow GetDesktopWindow GetParent FindWindowExW SendMessageW IsWindowVisible MessageBoxW SetTimer KillTimer EnableWindow FindWindowW GetWindowRect GetSystemMetrics GetClassInfoW PeekMessageW TranslateMessage AppendMenuW GetWindowTextW DispatchMessageW IsChild GetClassNameW PostThreadMessageW RegisterWindowMessageW SetWindowsHookExW

gdi32

ScaleWindowExtEx ExtSelectClipRgn SetWindowExtEx GetStockObject DeleteDC GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode RestoreDC SaveDC CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox GetDeviceCaps ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegQueryValueW RegEnumKeyW RegDeleteKeyW RegCreateKeyExW RegOpenKeyW RegOpenKeyExW RegDeleteValueW RegSetValueExW RegCreateKeyW RegCloseKey RegQueryValueExW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW PathFindExtensionW PathStripToRootW PathIsUNCW

oledlg

OleUIBusyW

ole32

CoGetClassObject CLSIDFromProgID CoTaskMemAlloc StgOpenStorageOnILockBytes CoFreeUnusedLibraries PropVariantClear CoTaskMemFree CLSIDFromString CoInitialize OleRun CoCreateInstance StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize OleInitialize CoRevokeClassObject CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard

oleaut32

SysStringLen SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_f7a2cd5066c92fe61bf044d7bffb12eb_amadey_elex_emotet_floxif_remcos_smoke-loader_stop

PE Signature issue

setupapi

winmm

dsound

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic