2026-08-08_da79e7aefe987cbdb79f76ff81915398_amadey_elex_emotet_floxif_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_da79e7aefe987cbdb79f76ff81915398_amadey_elex_emotet_floxif_remcos_smoke-loader_stop
Size 686KB
Sample260808-c3npgsydlc
SHA256 83bf7e8e49d9d69fe1fb5ce3990a071e2c7498fe03bbc1398465a86b6b86afa5
MD5 da79e7aefe987cbdb79f76ff81915398
SHA1 32c83b4f06544918e0baeaf8d919e238ef3c7b83
SHA512 85c9298c50e90a05ae45e2cce14547c69f89812b24a6592d9b8c5b79acdae984851f4697ae960d15f2cc38de184bcdc82ab97a743439e26e4d7cef4f90910d68
SSDEEP 12288:dSfAnpKpaMYISQa9r5OiWZQrU7lBjvrEH7JR:bQaMKQ/7LrEH7T
TLSH
T126E41A82739A8FB4EE7BC33711092D0F15427DAD942204AA6FCDBA1D8DF9601572E736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_da79e7aefe987cbdb79f76ff81915398_amadey_elex_emotet_floxif_remcos_smoke-loader_stop

File Explorer

2026-08-08_da79e7aefe987cbdb79f76ff81915398_amadey_elex_emotet_floxif_remcos_smoke-loader_stop

.exe 686KB

2026-08-08_da79e7aefe987cbdb79f76ff81915398_amadey_elex_emotet_floxif_remcos_smoke-loader_stop

IMPHASH b0db1b7e4a1c9870aa729a26ecafaabb
SHA256 83bf7e8e49d9d69fe1fb5ce3990a071e2c7498fe03bbc1398465a86b6b86afa5
MD5 da79e7aefe987cbdb79f76ff81915398
SHA1 32c83b4f06544918e0baeaf8d919e238ef3c7b83
SHA512 85c9298c50e90a05ae45e2cce14547c69f89812b24a6592d9b8c5b79acdae984851f4697ae960d15f2cc38de184bcdc82ab97a743439e26e4d7cef4f90910d68
SSDEEP 12288:dSfAnpKpaMYISQa9r5OiWZQrU7lBjvrEH7JR:bQaMKQ/7LrEH7T
TLSH
T126E41A82739A8FB4EE7BC33711092D0F15427DAD942204AA6FCDBA1D8DF9601572E736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

38:79:20:f7:04:be:35:03:1a:ba:fe:86:5e:a9:5c:44:3a:36:3a:24

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Chains

Jul 25, 2013

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Serial Number

29:66:2a:74:5c:40:15:70:38:f2:78:9d:69:05:e9:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 21, 2012 - Aug 23, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

141858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcessHeap GetStartupInfoW RtlUnwind RaiseException HeapReAlloc ExitProcess HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter HeapAlloc TerminateProcess UnhandledExceptionFilter IsDebuggerPresent Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA HeapFree GetFileTime FileTimeToLocalFileTime GetTickCount SetErrorMode GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers ReadFile WritePrivateProfileStringW FileTimeToSystemTime GetThreadLocale InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange InterlockedDecrement GetCurrentProcessId GetModuleHandleA GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree MulDiv FreeResource GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom FreeLibrary CompareStringW LoadLibraryA lstrcmpW MultiByteToWideChar GetVersionExA SetLastError LoadLibraryW lstrcpynW GetCurrentProcess GetTempPathW CreateMutexW GetLocalTime WideCharToMultiByte GetSystemDefaultLangID GetExitCodeProcess GetModuleHandleW GetProcAddress CreateFileW lstrlenA FindFirstFileW FindClose lstrlenW GetModuleFileNameW GetFileAttributesW WaitForSingleObject GetVersionExW GetLastError CloseHandle SetFilePointer WriteFile CreateDirectoryW LoadResource SizeofResource LockResource FindResourceW GetPrivateProfileStringW lstrcmpiW GetSystemTimeAsFileTime GetPrivateProfileSectionW

user32

RegisterClipboardFormatW PostThreadMessageW CopyAcceleratorTableW CharNextW ReleaseCapture SetCapture UnregisterClassW LoadCursorW GetSysColorBrush DestroyMenu SetWindowContextHelpId MapDialogRect SetCursor GetMessageW GetCursorPos ValidateRect PostQuitMessage GetDesktopWindow GetActiveWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem IsWindowEnabled ShowWindow MoveWindow IsDialogMessageW RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus SetFocus GetWindowTextLengthW GetWindowTextW GetLastActivePopup GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints GetKeyState IsWindowVisible GetMenu PostMessageW GetSubMenu GetMenuItemID GetMenuItemCount CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx GetParent EqualRect PtInRect GetDlgCtrlID CharUpperW MessageBeep DefWindowProcW CallWindowProcW GetNextDlgGroupItem InvalidateRgn InvalidateRect SetRect SetWindowTextW IsRectEmpty GetWindowLongW SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow ReleaseDC GetDC CopyRect IsWindow SetForegroundWindow GetForegroundWindow DispatchMessageW MessageBoxW SetWindowPos GetWindowThreadProcessId PeekMessageW wsprintfW SetActiveWindow TranslateMessage GetSystemMetrics ExitWindowsEx AttachThreadInput UpdateWindow SendMessageW EnableWindow GetClientRect GetCapture UnregisterClassA

gdi32

DeleteDC GetWindowExtEx GetStockObject ExtSelectClipRgn GetMapMode GetBkColor GetTextColor GetRgnBox GetViewportExtEx DeleteObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible SetMapMode RestoreDC SaveDC GetDeviceCaps CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox CreateRectRgnIndirect

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegOpenKeyW AllocateAndInitializeSid RegCloseKey AdjustTokenPrivileges OpenProcessToken RegCreateKeyExW EqualSid LookupPrivilegeValueW GetTokenInformation FreeSid RegSetValueExW

shell32

ShellExecuteExW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW PathStripToRootW PathFindExtensionW PathIsUNCW

oledlg

OleUIBusyW

ole32

OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CoRevokeClassObject CoTaskMemAlloc CoTaskMemFree OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter CLSIDFromProgID

oleaut32

SysAllocString OleCreateFontIndirect SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy SysFreeString SysStringLen VariantInit VariantChangeType VariantClear SysAllocStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_da79e7aefe987cbdb79f76ff81915398_amadey_elex_emotet_floxif_remcos_smoke-loader_stop

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic