2026-07-08_2a3ce5cf555638daaf74601d01a75970_amadey_elex_icedid_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_2a3ce5cf555638daaf74601d01a75970_amadey_elex_icedid_remcos_smoke-loader_stop
Size 19.2MB
Sample260708-2jnb2sa13s
SHA256 4df3bf652e00b52153b3ad2acee5fb82a62168c4c7cc736ca3a7c5d951f4d4bb
MD5 2a3ce5cf555638daaf74601d01a75970
SHA1 3c507e4325f9981d405c3509cb3880f09ceb01cc
SHA512 adf2ae162eddb844a943940862d819d75c94105b9d8c98d39594effbeba75baad76a778ba558f52cd3d43b649570203b3f272444f9cd3c66ba5f66427bbc2ec9
SSDEEP 393216:CYs8jH8hsybqw8DPqpnO2qe4L1YY+uWwye24Sz4/zSKeN6sGb/n3v:NscRgq72d46Jw724Sz4uMv3
TLSH
T145173315EB98BC60E1FA6432B53582225735FF506A6D42CBE375352809F93C2AB33F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-08_2a3ce5cf555638daaf74601d01a75970_amadey_elex_icedid_remcos_smoke-loader_stop

.exe 19.2MB

2026-07-08_2a3ce5cf555638daaf74601d01a75970_amadey_elex_icedid_remcos_smoke-loader_stop

IMPHASH 67ae5c7b77ed3563acdaa8e440808d86
SHA256 4df3bf652e00b52153b3ad2acee5fb82a62168c4c7cc736ca3a7c5d951f4d4bb
MD5 2a3ce5cf555638daaf74601d01a75970
SHA1 3c507e4325f9981d405c3509cb3880f09ceb01cc
SHA512 adf2ae162eddb844a943940862d819d75c94105b9d8c98d39594effbeba75baad76a778ba558f52cd3d43b649570203b3f272444f9cd3c66ba5f66427bbc2ec9
SSDEEP 393216:CYs8jH8hsybqw8DPqpnO2qe4L1YY+uWwye24Sz4/zSKeN6sGb/n3v:NscRgq72d46Jw724Sz4uMv3
TLSH
T145173315EB98BC60E1FA6432B53582225735FF506A6D42CBE375352809F93C2AB33F16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

64:ca:88:59:32:13:10:38:a0:70:66:cc:f4:a2:a2:94:b3:ac:d2:1d:82:cc:b5:85:a3:79:2c:bb:5c:4b:9a:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4169881,CN=Splashtop Inc.,O=Splashtop Inc.,L=Cupertino,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 22, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

06:d2:3a:70:6a:b8:5c:32:49:08:37:95:4b:9e:41:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2025 - May 19, 2028

Minor OS version

Major OS version

Entry point

82099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\slave\workspace\GIT_WIN_SRS_Formal\Source\irisserver\Release\SRUnPackSOS.pdb

kernel32

GetStartupInfoW HeapAlloc HeapFree ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree GetTickCount GetCPInfo GetACP GlobalFlags IsValidCodePage VirtualAlloc InitializeCriticalSectionAndSpinCount LCMapStringW GetTimeFormatA GetDateFormatA GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap CreateFileA SetEnvironmentVariableA SetErrorMode lstrlenA TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement InterlockedDecrement GetModuleHandleA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GlobalAddAtomW GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime FileTimeToSystemTime GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer MoveFileW FormatMessageW FreeResource GlobalUnlock GlobalLock DeleteFileW DeviceIoControl FindClose QueryPerformanceCounter GlobalFree GlobalAlloc FindNextFileW GetFileAttributesW FindFirstFileW GetSystemTimeAsFileTime GetVersionExW Process32NextW Process32FirstW CreateToolhelp32Snapshot WriteFile CreateProcessW GetCurrentProcess LocalFree SetLastError ReadFile CreateFileW GetModuleFileNameW GetModuleHandleW WritePrivateProfileStringW GetExitCodeProcess GetProcessId GetSystemWindowsDirectoryW TerminateProcess OpenProcess GetCurrentThreadId GetCommandLineW GetSystemDirectoryW SetDllDirectoryW GetLastError CreateMutexW MultiByteToWideChar GetDiskFreeSpaceExW RemoveDirectoryW SetCurrentDirectoryW Sleep GetTempPathW CreateThread WaitForSingleObject GetWindowsDirectoryW CreateDirectoryW WideCharToMultiByte GetCurrentProcessId ProcessIdToSessionId lstrlenW OutputDebugStringW FreeLibrary GetProcAddress LoadLibraryW CloseHandle FindResourceW LoadResource LockResource SizeofResource GetOEMCP GetPrivateProfileStringW

user32

UnregisterClassW DestroyMenu GetSysColorBrush MoveWindow SetWindowTextW GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW RegisterWindowMessageW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetMenu CreateWindowExW GetClassInfoExW RegisterClassW GetSysColor AdjustWindowRectEx ScreenToClient GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowLongW GetLastActivePopup IsWindowEnabled SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow GetKeyState PeekMessageW ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem PostQuitMessage CharUpperW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EnableWindow GetCursorPos SetLayeredWindowAttributes RedrawWindow ReleaseDC SetWindowRgn GetClientRect SetTimer PostMessageW KillTimer DisableProcessWindowsGhosting SendMessageW LoadIconW SystemParametersInfoW PtInRect GetWindowRect GetWindowPlacement GetWindow LoadCursorW SetCursor GetClassNameW IsWindowVisible GetWindowTextW SetForegroundWindow AttachThreadInput GetWindowThreadProcessId GetForegroundWindow SwitchToThisWindow ShowWindow IsWindow FindWindowW GetSystemMetrics MessageBoxW GetClassInfoW

gdi32

GetStockObject DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible CreateRoundRectRgn DeleteObject SetMapMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateBitmap GetDeviceCaps BitBlt CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetFileTitleW

advapi32

RegQueryValueW RegOpenKeyW CreateWellKnownSid CreateProcessAsUserW OpenProcessToken DuplicateTokenEx DuplicateToken CheckTokenMembership GetTokenInformation RegSetValueExW RegEnumKeyW RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegDeleteKeyW RegFlushKey RegCreateKeyExW RegCloseKey RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser

shell32

SHCreateDirectoryExW ShellExecuteExW SHFileOperationW SHGetFolderPathW

shlwapi

PathFileExistsW PathAppendW PathStripToRootW PathIsUNCW PathFindExtensionW PathFindFileNameW

ole32

CreateStreamOnHGlobal

oleaut32

VariantInit VariantClear VariantChangeType

gdiplus

GdipDeleteFontFamily GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipDisposeImage GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipDrawImageRectI GdipDeleteGraphics GdipCreateFromHDC GdiplusShutdown GdipFree GdipAlloc GdiplusStartup

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_2a3ce5cf555638daaf74601d01a75970_amadey_elex_icedid_remcos_smoke-loader_stop

kernel32

user32

gdi32

comdlg32

advapi32

shell32

shlwapi

ole32

oleaut32

gdiplus

generic