2026-05-31_bac25830f1ffc2ed864e62ed9e6a7060_amadey_elex_emotet_maze_rhadamanthys_smoke-loader_stop_vidar

General

Target
2026-05-31_bac25830f1ffc2ed864e62ed9e6a7060_amadey_elex_emotet_maze_rhadamanthys_smoke-loader_stop_vidar
Size 1.8MB
Sample260531-zmn2msfz21
SHA256 85ec5a406a18db48f76c97f00f27320a79f5e8edfedcceee6b146df51b4f931d
MD5 bac25830f1ffc2ed864e62ed9e6a7060
SHA1 590ec4b36c55ff6da0af9c856fee8ecee6232282
SHA512 f0ca832db25c742e617614700ee8fefa5dcd661613fa8a65480acb34757a059e4f89b7f9b79dda7bcb3383b2700c1be95a90a6ea934d86fe5232c870a748c626
SSDEEP 24576:05v3H67p4x4rH54GXtA5EYTqMi8CtBd2QHCHmTBW5uq85CUoM3UXoIHDBv:8H676x4DHteqJtb2I685qHDp
TLSH
T119955B11F6E48676E073C176CAE29656EB3178424B30C69F7384872E2F736D19A37722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-31_bac25830f1ffc2ed864e62ed9e6a7060_amadey_elex_emotet_maze_rhadamanthys_smoke-loader_stop_vidar

File Explorer

2026-05-31_bac25830f1ffc2ed864e62ed9e6a7060_amadey_elex_emotet_maze_rhadamanthys_smoke-loader_stop_vidar

.exe 1.8MB

2026-05-31_bac25830f1ffc2ed864e62ed9e6a7060_amadey_elex_emotet_maze_rhadamanthys_smoke-loader_stop_vidar

IMPHASH 29f658e321d3823f0a9ce796dfebf315
SHA256 85ec5a406a18db48f76c97f00f27320a79f5e8edfedcceee6b146df51b4f931d
MD5 bac25830f1ffc2ed864e62ed9e6a7060
SHA1 590ec4b36c55ff6da0af9c856fee8ecee6232282
SHA512 f0ca832db25c742e617614700ee8fefa5dcd661613fa8a65480acb34757a059e4f89b7f9b79dda7bcb3383b2700c1be95a90a6ea934d86fe5232c870a748c626
SSDEEP 24576:05v3H67p4x4rH54GXtA5EYTqMi8CtBd2QHCHmTBW5uq85CUoM3UXoIHDBv:8H676x4DHteqJtb2I685qHDp
TLSH
T119955B11F6E48676E073C176CAE29656EB3178424B30C69F7384872E2F736D19A37722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

57284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\ipc\app\plugin-container.pdb

kernel32

LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject Sleep RaiseException IsDebuggerPresent GetCurrentThreadId CloseHandle TlsGetValue TlsSetValue TlsAlloc TlsFree QueryPerformanceCounter GetSystemTimeAsFileTime GetNativeSystemInfo GetVersionExW GetModuleFileNameW InitializeCriticalSectionAndSpinCount SetHandleInformation VirtualFree GetProcessHandleCount GetCurrentProcessId FreeLibrary HeapSetInformation GetCurrentDirectoryW TerminateProcess GetFileType SignalObjectAndWait CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetLastError GetModuleHandleExW GetVolumeInformationW LocalFree GetLastError GetSystemDirectoryW GetComputerNameW ExpandEnvironmentStringsW LoadLibraryExA GetModuleHandleA VirtualAllocEx VirtualProtectEx GetProcAddress VerifyVersionInfoW FlushInstructionCache GetModuleHandleW SetEnvironmentVariableW GetCurrentProcess VerSetConditionMask SetDllDirectoryW GetEnvironmentVariableW ReleaseActCtx MultiByteToWideChar CreateActCtxW VirtualQuery GetCommandLineW EncodePointer DecodePointer IsProcessorFeaturePresent HeapFree HeapAlloc LoadLibraryExW ExitProcess WideCharToMultiByte GetProcessHeap GetStdHandle GetStartupInfoW WriteFile GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW RtlUnwind OutputDebugStringW HeapReAlloc

winmm

timeGetTime

advapi32

RegCloseKey RegOpenKeyExW RevertToSelf RegDisablePredefinedCache GetLengthSid OpenProcessToken ConvertStringSidToSidW SetTokenInformation ConvertSidToStringSidW LookupAccountNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-31_bac25830f1ffc2ed864e62ed9e6a7060_amadey_elex_emotet_maze_rhadamanthys_smoke-loader_stop_vidar

kernel32

winmm

advapi32

generic