2026-08-03_eaae65e3e274eab5925381ca4cf426e7_amadey_elex_emotet_hijackloader_http-browser_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_eaae65e3e274eab5925381ca4cf426e7_amadey_elex_emotet_hijackloader_http-browser_smoke-loader_stop
Size 23.8MB
Sample260804-k3vf2agf33
SHA256 e9022ca6f4893a8e4bd859586bbfac27bcdf29222c85ebde2ffb1a4366c9be03
MD5 eaae65e3e274eab5925381ca4cf426e7
SHA1 30092f9b7859190f8fa8f2001ced28f697b62cda
SHA512 c9bfa74191736d05c95184128172e5e43e9b6dec936cb5d225fb0edd078adaecf6a9f20ec9492f4f5d3e7e513ca1848a15e3e1ed5dbb317520a428e2cfc18f34
SSDEEP 393216:SFBOyUFSlwx8zxuLEJZQGVTtBHjSBojMQ17C8D73pQzJkPBfowvjz0E8rHzICZEB:8BOBKzxCQZ7TXuooQtC8DaV8BfowvczY
TLSH
T13B47330B35E0D436C11318B24DD792E92BA5B85EBB1A668FE7D42F0D29F08D117353BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-03_eaae65e3e274eab5925381ca4cf426e7_amadey_elex_emotet_hijackloader_http-browser_smoke-loader_stop

.exe 23.8MB

2026-08-03_eaae65e3e274eab5925381ca4cf426e7_amadey_elex_emotet_hijackloader_http-browser_smoke-loader_stop

IMPHASH 19608e7968f83998d14938f73ad96db8
SHA256 e9022ca6f4893a8e4bd859586bbfac27bcdf29222c85ebde2ffb1a4366c9be03
MD5 eaae65e3e274eab5925381ca4cf426e7
SHA1 30092f9b7859190f8fa8f2001ced28f697b62cda
SHA512 c9bfa74191736d05c95184128172e5e43e9b6dec936cb5d225fb0edd078adaecf6a9f20ec9492f4f5d3e7e513ca1848a15e3e1ed5dbb317520a428e2cfc18f34
SSDEEP 393216:SFBOyUFSlwx8zxuLEJZQGVTtBHjSBojMQ17C8D73pQzJkPBfowvjz0E8rHzICZEB:8BOBKzxCQZ7TXuooQtC8DaV8BfowvczY
TLSH
T13B47330B35E0D436C11318B24DD792E92BA5B85EBB1A668FE7D42F0D29F08D117353BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

e3:05:e5:b5:d5:31:4b:b7:1b:a8:b8:0a:2d:b5:53:50:5a:f3:f0:5e:30:74:19:a2:f1:e7:11:db:c3:6e:18:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=PASSON,O=PASSON,L=Jongno-gu,ST=Seoul,C=KR

Chains

Jul 1, 2025

CN=PASSON,O=PASSON,L=Jongno-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=PASSON,O=PASSON,L=Jongno-gu,ST=Seoul,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=PASSON,O=PASSON,L=Jongno-gu,ST=Seoul,C=KR

Serial Number

04:1d:df:80:87:72:13:33:07:07:a1:4f:7a:93:f3:20

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2024 - Mar 1, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

207654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\NetFly\Solution\Root\trunk\NetFly_Common\App\Src_Project\NsUpdate\NsInstaller\Release\NsInstaller.pdb

kernel32

FlushFileBuffers LockFile UnlockFile SetEndOfFile DuplicateHandle GetVolumeInformationW GetFullPathNameW SetErrorMode GetTickCount HeapFree HeapAlloc GetProcessHeap GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException GetSystemTimeAsFileTime GetDriveTypeW GetConsoleCP GetConsoleMode ExitProcess HeapReAlloc HeapSize VirtualProtect VirtualAlloc VirtualQuery GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW SetStdHandle CreateFileA GetTimeZoneInformation GetCurrentDirectoryA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetStringTypeA GetStringTypeW GetLocaleInfoA GetDriveTypeA SetEnvironmentVariableA GetThreadLocale lstrlenA InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GlobalFlags EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection GetModuleHandleA FormatMessageW LocalFree MulDiv InterlockedDecrement WritePrivateProfileStringW GetCurrentProcessId GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA SetLastError lstrcmpW GetVersionExA GetEnvironmentVariableW GetCurrentProcess VerSetConditionMask VerifyVersionInfoW OutputDebugStringW GetLocalTime GetModuleHandleW GetVersionExW GetSystemInfo SetFileAttributesW DeleteFileW RemoveDirectoryW GetFileTime GetFileSize FileTimeToLocalFileTime FileTimeToSystemTime WriteFile SetFileTime GetFileAttributesW LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime ReadFile CreateFileW SetFilePointer lstrlenW lstrcpyW MoveFileW WaitForSingleObject TerminateProcess CreateProcessW GetExitCodeProcess Process32NextW FreeLibrary MultiByteToWideChar GetProcAddress WideCharToMultiByte LoadLibraryW GetPriorityClass OpenProcess FindClose Process32FirstW FindNextFileW CloseHandle CreateToolhelp32Snapshot FindFirstFileW GetModuleFileNameW CreateDirectoryW SizeofResource LockResource LoadResource FindResourceW Sleep FreeResource GetWindowsDirectoryW GetSystemDirectoryW GetLastError CopyFileW GetEnvironmentStringsW

user32

RegisterClipboardFormatW PostThreadMessageW MessageBeep GetNextDlgGroupItem InvalidateRgn SetRect IsRectEmpty CopyAcceleratorTableW CharNextW ReleaseCapture SetCapture LoadCursorW GetSysColorBrush DestroyMenu EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetMessageW TranslateMessage GetCursorPos ValidateRect SetWindowContextHelpId MapDialogRect GetWindowThreadProcessId PostQuitMessage SetCursor ShowWindow MoveWindow SetWindowTextW IsDialogMessageW UnregisterClassA GetDesktopWindow CreateDialogIndirectParamW IsWindowEnabled GetNextDlgTabItem EndDialog RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow SetActiveWindow DispatchMessageW GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetForegroundWindow IsWindowVisible GetMenu GetSubMenu GetMenuItemID GetMenuItemCount MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx ScreenToClient EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcW UnregisterClassW CharUpperW GetActiveWindow CallWindowProcW GetWindowLongW SetWindowLongW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem wsprintfW InvalidateRect ReleaseDC GetDC GetParent GetWindowRect UpdateWindow GetClientRect GetSystemMetrics GetSystemMenu IsIconic PostMessageW SetTimer KillTimer SendMessageW LoadIconW AppendMenuW DrawIcon EnableWindow GetLastActivePopup

gdi32

ExtSelectClipRgn DeleteDC GetBkColor GetTextColor GetRgnBox GetMapMode ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible GetWindowExtEx GetStockObject DeleteObject SetMapMode SetBkMode RestoreDC SaveDC GetDeviceCaps CreateRectRgnIndirect GetObjectW SetBkColor SetTextColor GetClipBox CreateBitmap BitBlt CreateCompatibleBitmap CreateCompatibleDC GetViewportExtEx

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegCloseKey RegQueryValueExW RegSetValueExW RegOpenKeyExW RegEnumValueW RegCreateKeyExW

shell32

ShellExecuteW SHGetFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW PathStripToRootW PathFindFileNameW PathIsUNCW

oledlg

OleUIBusyW

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CoTaskMemAlloc OleFlushClipboard OleUninitialize CoTaskMemFree CLSIDFromString CLSIDFromProgID CoRegisterMessageFilter CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard

oleaut32

VariantChangeType VariantCopy SysAllocString SafeArrayDestroy SystemTimeToVariantTime VariantTimeToSystemTime OleCreateFontIndirect SysStringLen SysFreeString SysAllocStringLen VariantInit VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_eaae65e3e274eab5925381ca4cf426e7_amadey_elex_emotet_hijackloader_http-browser_smoke-loader_stop

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic