General
- Target 2026-07-31_3f8d1f7641940f1334ce9a965dee693b_amadey_elex_icedid_remcos_smoke-loader_stop_wannacry
- Size 586KB
- Sample260731-drl7ysak91
- SHA256 6ee6f835a844639917c0f5d903857d952e7f461fa07da726eb193cdb4a9f2f4b
- MD5 3f8d1f7641940f1334ce9a965dee693b
- SHA1 db1ca764e558b757513a705337d156a6efd4e64a
- SHA512 a9d2f883a4861dcd17c9fe03e0689a0c53d8f67eb0271c3c6e3d4f30f1a838b4a6c51ce1d5f854197a7b59cf3306c8936406e7d144ab8401f4f98e2a520bad7b
- SSDEEP 6144:6sJFPaMesSmRhA5q+qpogB3U2gt3t1h+67DTcaBbm3opTGwGrzSSmO5TCchGHLUm:RFPTRoUp5gtfh+6Ya4L6ddgfFP
- TLSH T1D3D47D027B85C4B2F6592031481A9776937ABD715F5C93C36780BF7EAE312D29E3831A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_3f8d1f7641940f1334ce9a965dee693b_amadey_elex_icedid_remcos_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_3f8d1f7641940f1334ce9a965dee693b_amadey_elex_icedid_remcos_smoke-loader_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_3f8d1f7641940f1334ce9a965dee693b_amadey_elex_icedid_remcos_smoke-loader_stop_wannacry
- Size 586KB
- SHA256 6ee6f835a844639917c0f5d903857d952e7f461fa07da726eb193cdb4a9f2f4b
- MD5 3f8d1f7641940f1334ce9a965dee693b
- SHA1 db1ca764e558b757513a705337d156a6efd4e64a
- SHA512 a9d2f883a4861dcd17c9fe03e0689a0c53d8f67eb0271c3c6e3d4f30f1a838b4a6c51ce1d5f854197a7b59cf3306c8936406e7d144ab8401f4f98e2a520bad7b
- SSDEEP 6144:6sJFPaMesSmRhA5q+qpogB3U2gt3t1h+67DTcaBbm3opTGwGrzSSmO5TCchGHLUm:RFPTRoUp5gtfh+6Ya4L6ddgfFP
- TLSH T1D3D47D027B85C4B2F6592031481A9776937ABD715F5C93C36780BF7EAE312D29E3831A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Drops file in System32 directory