2026-07-12_c90389b765bbe33ce23fb33262169e17_amadey_elex_emotet_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_c90389b765bbe33ce23fb33262169e17_amadey_elex_emotet_smoke-loader_stealc_stop
Size 1.4MB
Sample260712-tkfdtscy4n
SHA256 826369e39c3976aed5b90f2c9909f9b85b50447da4151b856fe6848deb9e2943
MD5 c90389b765bbe33ce23fb33262169e17
SHA1 09d2a3023b4240c9a238d8a31640c6925c799f31
SHA512 d46f7b1ad9d354fb723df8fe750ec07b3688f5f6adad5e2648adfba6bc8f481ba488b048216a203f323b20bee5bfa0db4a5569badb3e3f905519c1f7c11b0d4f
SSDEEP 12288:e8Nwnk4ydytZ3XnJY7WNbvdkNVK807/sB7qBJmGxClteX+ha6ngpopwS8:G3ydytZJDLiJ07gqB4Gctei1Gd
TLSH
T1C165025336D5C873D65604734DE78A7AA3B2BC620B7185872BC47F1D6EB43D29A3A308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_c90389b765bbe33ce23fb33262169e17_amadey_elex_emotet_smoke-loader_stealc_stop

File Explorer

2026-07-12_c90389b765bbe33ce23fb33262169e17_amadey_elex_emotet_smoke-loader_stealc_stop

.exe 1.4MB

2026-07-12_c90389b765bbe33ce23fb33262169e17_amadey_elex_emotet_smoke-loader_stealc_stop

IMPHASH f0d273e03f5936fb903f41157c666217
SHA256 826369e39c3976aed5b90f2c9909f9b85b50447da4151b856fe6848deb9e2943
MD5 c90389b765bbe33ce23fb33262169e17
SHA1 09d2a3023b4240c9a238d8a31640c6925c799f31
SHA512 d46f7b1ad9d354fb723df8fe750ec07b3688f5f6adad5e2648adfba6bc8f481ba488b048216a203f323b20bee5bfa0db4a5569badb3e3f905519c1f7c11b0d4f
SSDEEP 12288:e8Nwnk4ydytZ3XnJY7WNbvdkNVK807/sB7qBJmGxClteX+ha6ngpopwS8:G3ydytZJDLiJ07gqB4Gctei1Gd
TLSH
T1C165025336D5C873D65604734DE78A7AA3B2BC620B7185872BC47F1D6EB43D29A3A308
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\perforce\cc\oem\iron\mangusta\sw\trunk\win\installer\release\install.pdb

kernel32

GetCurrentProcessId lstrlenW GlobalUnlock GlobalFree InterlockedDecrement LocalAlloc TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree GetVersionExA LoadLibraryA CompareStringW GlobalFindAtomW MoveFileW GetThreadLocale SetFilePointer FlushFileBuffers SetEndOfFile GlobalDeleteAtom WritePrivateProfileStringW GetModuleHandleA GlobalFlags InterlockedIncrement lstrlenA FileTimeToSystemTime SetErrorMode FileTimeToLocalFileTime GetFileAttributesW GetStartupInfoW GetDriveTypeW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind ExitProcess RaiseException HeapReAlloc HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetCurrentDirectoryA GetTimeZoneInformation VirtualAlloc GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetDriveTypeA CreateFileA SetEnvironmentVariableA SetEnvironmentVariableW ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GlobalLock lstrcmpW GlobalAlloc GlobalAddAtomW GetTickCount WriteFile FindClose FindFirstFileW ReadFile CreateFileW SetLastError HeapFree GetProcessHeap HeapAlloc LocalFree FormatMessageW OutputDebugStringW LeaveCriticalSection EnterCriticalSection GetCurrentThreadId GetLocalTime InitializeCriticalSection CreateMutexW GetFullPathNameW GetModuleFileNameW GetVersionExW FreeLibrary GetExitCodeProcess WaitForSingleObject CreateProcessW GetCurrentProcess MultiByteToWideChar WideCharToMultiByte GetCurrentThread GetModuleHandleW LoadLibraryExW GetSystemDefaultLangID GetUserDefaultLangID GetSystemDefaultUILanguage GetUserDefaultUILanguage GetProcAddress LoadLibraryW LoadResource LockResource SizeofResource Sleep GetLastError DeleteFileW GetTempPathW GetWindowsDirectoryW FindResourceW GetSystemDirectoryW CloseHandle ReleaseMutex

user32

DestroyMenu UnregisterClassW ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetDC ReleaseDC GetSysColorBrush ShowWindow SetWindowTextW RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetWindowTextW GetForegroundWindow GetDlgItem DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx CopyRect GetDlgCtrlID DefWindowProcW SystemParametersInfoA IsIconic GetWindowPlacement GetWindow GetMenuItemID GetMenuItemCount GetSubMenu SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem GetWindowThreadProcessId GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow PostQuitMessage SetCursor GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible SendMessageW GetKeyState PeekMessageW GetCursorPos ValidateRect GetTopWindow SetWindowsHookExW CallNextHookEx SetWindowLongW SetWindowPos GetWindowRect GetSystemMetrics CallWindowProcW UnhookWindowsHookEx MessageBoxW LoadStringW PostMessageW PtInRect UnregisterClassA

gdi32

PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject GetStockObject DeleteDC DeleteObject SetMapMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox GetDeviceCaps CreateBitmap ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCloseKey RegCreateKeyExW

shell32

ShellExecuteW SHGetFolderPathW ord680

shlwapi

PathFindFileNameW PathFindExtensionW PathAppendW

oleaut32

VariantInit VariantChangeType VariantClear

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_c90389b765bbe33ce23fb33262169e17_amadey_elex_emotet_smoke-loader_stealc_stop

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

oleacc

generic