2026-08-04_f425d57f0200b10cf14d87c7ef4fc897_amadey_elex_emotet_glassworm_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_f425d57f0200b10cf14d87c7ef4fc897_amadey_elex_emotet_glassworm_remcos_smoke-loader_stop
Size 20.2MB
Sample260804-1ylw4a1eph
SHA256 e14bb430c4222b28ca7b32a9dfe40723ef74f9bb6d557e83b287af7759911fe5
MD5 f425d57f0200b10cf14d87c7ef4fc897
SHA1 142b52b57ee74db222d85f2708475164875abd15
SHA512 7cba7b0d163d5bcf9a051c66084685cd563163d1ad3d5200aa09061ec3940dd7c6278522676f3201a094b3265471c8cbbc9ee7500e70cbdc27b5ce90cabcd5c9
SSDEEP 393216:VW3HSbR4jZKMCCEA26N4CR94xuBivgF1VUO0BpZkroMDq3iEji/6:4gRcRCCToxuyM1V5y2oAqSe
TLSH
T13B272223F2418162D1664A7056376F3876B59F655F7188B3FBE0FEF92C321A1DB2210A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_f425d57f0200b10cf14d87c7ef4fc897_amadey_elex_emotet_glassworm_remcos_smoke-loader_stop

File Explorer

2026-08-04_f425d57f0200b10cf14d87c7ef4fc897_amadey_elex_emotet_glassworm_remcos_smoke-loader_stop

.exe 20.2MB

2026-08-04_f425d57f0200b10cf14d87c7ef4fc897_amadey_elex_emotet_glassworm_remcos_smoke-loader_stop

IMPHASH be08764d0b136d376a4373774522034b
SHA256 e14bb430c4222b28ca7b32a9dfe40723ef74f9bb6d557e83b287af7759911fe5
MD5 f425d57f0200b10cf14d87c7ef4fc897
SHA1 142b52b57ee74db222d85f2708475164875abd15
SHA512 7cba7b0d163d5bcf9a051c66084685cd563163d1ad3d5200aa09061ec3940dd7c6278522676f3201a094b3265471c8cbbc9ee7500e70cbdc27b5ce90cabcd5c9
SSDEEP 393216:VW3HSbR4jZKMCCEA26N4CR94xuBivgF1VUO0BpZkroMDq3iEji/6:4gRcRCCToxuyM1V5y2oAqSe
TLSH
T13B272223F2418162D1664A7056376F3876B59F655F7188B3FBE0FEF92C321A1DB2210A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13064040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

iphlpapi

GetAdaptersInfo

winmm

midiStreamStop midiOutReset midiStreamRestart waveOutRestart midiStreamClose midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader

ws2_32

accept WSACleanup closesocket inet_ntoa ntohl WSAAsyncSelect getpeername recv ioctlsocket recvfrom

kernel32

SetLastError QueryPerformanceFrequency QueryPerformanceCounter GetTimeZoneInformation GetVersion TerminateThread CreateMutexA ReleaseMutex SuspendThread InterlockedIncrement InterlockedDecrement GetWindowsDirectoryA GetSystemInfo IsProcessorFeaturePresent lstrcmpiA LocalFree FormatMessageA FileTimeToSystemTime FileTimeToLocalFileTime lstrcpynA DuplicateHandle FlushFileBuffers LockFile UnlockFile SetEndOfFile GetThreadLocale GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA lstrcmpA LocalAlloc TlsAlloc GlobalHandle TlsFree TlsSetValue LocalReAlloc TlsGetValue GetFileTime GetCurrentThread GlobalFlags SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind GetSystemTime GetLocalTime RaiseException HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle TerminateProcess GetCurrentProcess GetFileSize SetFilePointer GetSystemDirectoryA GetTempFileNameA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA DeviceIoControl SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW RemoveDirectoryA GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GetDriveTypeA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle InterlockedExchange VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetMenuCheckMarkDimensions CharNextA SetWindowContextHelpId MapDialogRect LoadStringA GetSysColorBrush GetNextDlgGroupItem PostThreadMessageA IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx ScrollWindow GetScrollInfo SetScrollInfo ShowScrollBar GetScrollPos RegisterClassA GetMenuItemCount GetMenuItemID CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement GetNextDlgTabItem EndDialog CreateDialogIndirectParamA DestroyWindow GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC CharUpperA GetWindowTextLengthA GetForegroundWindow GetWindowTextA GetDlgItem FindWindowA UnregisterClassA GetClassNameA GetDesktopWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx GetMenuState DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBeep MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle SetMenuItemBitmaps CheckMenuItem MoveWindow CreateIconFromResource SetWindowTextA GetScrollRange GetProcessWindowStation GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetUserObjectInformationW

gdi32

CreateRectRgn CombineRgn PatBlt CreatePen SelectObject CreateBitmap CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect FillRgn MoveToEx LineTo CreateSolidBrush ExtSelectClipRgn GetViewportExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA GetMapMode CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SetBkColor

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseColorA

advapi32

RegCreateKeyExA RegOpenKeyA RegQueryValueA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA SHEmptyRecycleBinA

ole32

CoRevokeClassObject CoRegisterMessageFilter CoFreeUnusedLibraries CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes OleFlushClipboard CoDisconnectObject OleIsCurrentClipboard CoGetClassObject CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID OleInitialize OleUninitialize CLSIDFromString CoCreateInstance OleRun

oleaut32

SafeArrayGetDim SafeArrayGetLBound SafeArrayUnaccessData VariantChangeType VariantClear VariantCopy SafeArrayAccessData SafeArrayGetElement VariantCopyInd VariantInit SafeArrayGetUBound VariantTimeToSystemTime SysStringLen SysAllocString SafeArrayDestroy SafeArrayCreate SafeArrayPutElement RegisterTypeLi LHashValOfNameSys LoadTypeLi OleCreateFontIndirect UnRegisterTypeLi SysAllocStringLen SafeArrayGetElemsize SysAllocStringByteLen SysFreeString

comctl32

ImageList_Duplicate ImageList_Read ImageList_Destroy ord17 ImageList_SetBkColor ImageList_GetImageCount

oledlg

ord8

wininet

FindNextUrlCacheEntryA FindFirstUrlCacheEntryA DeleteUrlCacheEntry

wtsapi32

WTSSendMessageW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

148KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.svmp0

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.svmp1

Size

10.2MB

Virtual Size

10.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_f425d57f0200b10cf14d87c7ef4fc897_amadey_elex_emotet_glassworm_remcos_smoke-loader_stop

iphlpapi

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet

wtsapi32

generic