General
- Target 2026-08-06_b473d84e53069f06884a0c21d6f37cf7_amadey_elex_icedid_remcos_smoke-loader_stop
- Size 7.7MB
- Sample260806-veljbswcld
- SHA256 aa7fc856164ce40d790f0d92a875e9aa62517ef039e7f980fffb7cae3ce21285
- MD5 b473d84e53069f06884a0c21d6f37cf7
- SHA1 cef493288d7ee1bd0c97df0780f182509c512457
- SHA512 456387e86723401671cefcd6a2a476c40d93d8f481b5df889a10547986f0f10d1aff987ba44135bdafcc67dd611ed4db052fb1f7f4777457b570274b52e40cbd
- SSDEEP 196608:NXvIVtu8Iar02otx2Rrj1IRI03fN5g50NKleXA4BYTCOtmpA:FIVBn02oU1Zb05BYTCG2A
- TLSH T110862300E199BCA5D0B2257238B682634368EF711B2D458BD37477192AF57D2BB33F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-06_b473d84e53069f06884a0c21d6f37cf7_amadey_elex_icedid_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_b473d84e53069f06884a0c21d6f37cf7_amadey_elex_icedid_remcos_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-06_b473d84e53069f06884a0c21d6f37cf7_amadey_elex_icedid_remcos_smoke-loader_stop
- Size 7.7MB
- SHA256 aa7fc856164ce40d790f0d92a875e9aa62517ef039e7f980fffb7cae3ce21285
- MD5 b473d84e53069f06884a0c21d6f37cf7
- SHA1 cef493288d7ee1bd0c97df0780f182509c512457
- SHA512 456387e86723401671cefcd6a2a476c40d93d8f481b5df889a10547986f0f10d1aff987ba44135bdafcc67dd611ed4db052fb1f7f4777457b570274b52e40cbd
- SSDEEP 196608:NXvIVtu8Iar02otx2Rrj1IRI03fN5g50NKleXA4BYTCOtmpA:FIVBn02oU1Zb05BYTCG2A
- TLSH T110862300E199BCA5D0B2257238B682634368EF711B2D458BD37477192AF57D2BB33F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1