2026-08-05_23552013cdf9c125e736601336adc994_amadey_elex_icedid_ransomhub_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_23552013cdf9c125e736601336adc994_amadey_elex_icedid_ransomhub_remcos_smoke-loader_stop
Size 19.2MB
Sample260805-jsfz8axyht
SHA256 c9e44467545903535ec4643f3bf7248c7f5a1929ac84c78da2b1a856ff914aa9
MD5 23552013cdf9c125e736601336adc994
SHA1 5d7070c8a6d63b646aba9b6c777308957e68fb01
SHA512 636e2d68620488a950b33fd4d217bf448c1ad03a640f5f2b9002eaf29bf85eb018f727b0aca580244c8864d911d6f70fca795c29bc24dafc4517624b6c5ae81d
SSDEEP 393216:cBs8jH8hsybqw8DPqpnO2qe4L1YY+uWwye24Sz4/zSKeN6sGb/n39:qscRgq72d46Jw724Sz4uMv1
TLSH
T109173355EB9CBC60E1FA5032B23592225735FF906A6D41CBE375352809F93C2AB23F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-05_23552013cdf9c125e736601336adc994_amadey_elex_icedid_ransomhub_remcos_smoke-loader_stop

.exe 19.2MB

2026-08-05_23552013cdf9c125e736601336adc994_amadey_elex_icedid_ransomhub_remcos_smoke-loader_stop

IMPHASH 67ae5c7b77ed3563acdaa8e440808d86
SHA256 c9e44467545903535ec4643f3bf7248c7f5a1929ac84c78da2b1a856ff914aa9
MD5 23552013cdf9c125e736601336adc994
SHA1 5d7070c8a6d63b646aba9b6c777308957e68fb01
SHA512 636e2d68620488a950b33fd4d217bf448c1ad03a640f5f2b9002eaf29bf85eb018f727b0aca580244c8864d911d6f70fca795c29bc24dafc4517624b6c5ae81d
SSDEEP 393216:cBs8jH8hsybqw8DPqpnO2qe4L1YY+uWwye24Sz4/zSKeN6sGb/n39:qscRgq72d46Jw724Sz4uMv1
TLSH
T109173355EB9CBC60E1FA5032B23592225735FF906A6D41CBE375352809F93C2AB23F16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

55:af:5b:34:63:d4:b1:8e:0f:b9:63:93:86:3c:35:ca:8d:af:c9:f2:d7:1e:4b:85:87:0f:4d:45:61:8d:52:f4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4169881,CN=Splashtop Inc.,O=Splashtop Inc.,L=Cupertino,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 30, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:d2:3a:70:6a:b8:5c:32:49:08:37:95:4b:9e:41:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2025 - May 19, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

82099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\slave\workspace\GIT_WIN_SRS_Formal\Source\irisserver\Release\SRUnPackSOS.pdb

kernel32

GetStartupInfoW HeapAlloc HeapFree ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree GetTickCount GetCPInfo GetACP GlobalFlags IsValidCodePage VirtualAlloc InitializeCriticalSectionAndSpinCount LCMapStringW GetTimeFormatA GetDateFormatA GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap CreateFileA SetEnvironmentVariableA SetErrorMode lstrlenA TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement InterlockedDecrement GetModuleHandleA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GlobalAddAtomW GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime FileTimeToSystemTime GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer MoveFileW FormatMessageW FreeResource GlobalUnlock GlobalLock DeleteFileW DeviceIoControl FindClose QueryPerformanceCounter GlobalFree GlobalAlloc FindNextFileW GetFileAttributesW FindFirstFileW GetSystemTimeAsFileTime GetVersionExW Process32NextW Process32FirstW CreateToolhelp32Snapshot WriteFile CreateProcessW GetCurrentProcess LocalFree SetLastError ReadFile CreateFileW GetModuleFileNameW GetModuleHandleW WritePrivateProfileStringW GetExitCodeProcess GetProcessId GetSystemWindowsDirectoryW TerminateProcess OpenProcess GetCurrentThreadId GetCommandLineW GetSystemDirectoryW SetDllDirectoryW GetLastError CreateMutexW MultiByteToWideChar GetDiskFreeSpaceExW RemoveDirectoryW SetCurrentDirectoryW Sleep GetTempPathW CreateThread WaitForSingleObject GetWindowsDirectoryW CreateDirectoryW WideCharToMultiByte GetCurrentProcessId ProcessIdToSessionId lstrlenW OutputDebugStringW FreeLibrary GetProcAddress LoadLibraryW CloseHandle FindResourceW LoadResource LockResource SizeofResource GetOEMCP GetPrivateProfileStringW

user32

UnregisterClassW DestroyMenu GetSysColorBrush MoveWindow SetWindowTextW GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW RegisterWindowMessageW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetMenu CreateWindowExW GetClassInfoExW RegisterClassW GetSysColor AdjustWindowRectEx ScreenToClient GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowLongW GetLastActivePopup IsWindowEnabled SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow GetKeyState PeekMessageW ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem PostQuitMessage CharUpperW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EnableWindow GetCursorPos SetLayeredWindowAttributes RedrawWindow ReleaseDC SetWindowRgn GetClientRect SetTimer PostMessageW KillTimer DisableProcessWindowsGhosting SendMessageW LoadIconW SystemParametersInfoW PtInRect GetWindowRect GetWindowPlacement GetWindow LoadCursorW SetCursor GetClassNameW IsWindowVisible GetWindowTextW SetForegroundWindow AttachThreadInput GetWindowThreadProcessId GetForegroundWindow SwitchToThisWindow ShowWindow IsWindow FindWindowW GetSystemMetrics MessageBoxW GetClassInfoW

gdi32

GetStockObject DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible CreateRoundRectRgn DeleteObject SetMapMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateBitmap GetDeviceCaps BitBlt CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetFileTitleW

advapi32

RegQueryValueW RegOpenKeyW CreateWellKnownSid CreateProcessAsUserW OpenProcessToken DuplicateTokenEx DuplicateToken CheckTokenMembership GetTokenInformation RegSetValueExW RegEnumKeyW RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegDeleteKeyW RegFlushKey RegCreateKeyExW RegCloseKey RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser

shell32

SHCreateDirectoryExW ShellExecuteExW SHFileOperationW SHGetFolderPathW

shlwapi

PathFileExistsW PathAppendW PathStripToRootW PathIsUNCW PathFindExtensionW PathFindFileNameW

ole32

CreateStreamOnHGlobal

oleaut32

VariantInit VariantClear VariantChangeType

gdiplus

GdipDeleteFontFamily GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipDisposeImage GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipDrawImageRectI GdipDeleteGraphics GdipCreateFromHDC GdiplusShutdown GdipFree GdipAlloc GdiplusStartup

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_23552013cdf9c125e736601336adc994_amadey_elex_icedid_ransomhub_remcos_smoke-loader_stop

kernel32

user32

gdi32

comdlg32

advapi32

shell32

shlwapi

ole32

oleaut32

gdiplus

generic