2026-08-08_f8d0cfda335d96f3101ce02e8dd023d3_amadey_elex_icedid_ransomhub_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_f8d0cfda335d96f3101ce02e8dd023d3_amadey_elex_icedid_ransomhub_remcos_smoke-loader_stop
Size 19.4MB
Sample260808-hsrlaasdkd
SHA256 a042c4e28448b6b7159638f3855db008d79bf31be1338065956137b04671ab38
MD5 f8d0cfda335d96f3101ce02e8dd023d3
SHA1 8193190ed79e74db744d48fb1c4388da9d4ec0e6
SHA512 456df055f01349dec9f336d8bfd943f93ebc323f4e74d94ed6d4b51e23bfbff16b6aaa7b8a8485c26aa920622db0e0aadafc9701208b3df7b305737620bc07f3
SSDEEP 393216:fys8jH8hsybqw8DPqpnO2qe4L1YY+uWwye24Sz4/zSKeN6sGb/n3y:qscRgq72d46Jw724Sz4uMvK
TLSH
T128273375AA949322FAAAF3329227822456357CD46E7591CF5381395B7B73EC18F33302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_f8d0cfda335d96f3101ce02e8dd023d3_amadey_elex_icedid_ransomhub_remcos_smoke-loader_stop

.exe 19.4MB

2026-08-08_f8d0cfda335d96f3101ce02e8dd023d3_amadey_elex_icedid_ransomhub_remcos_smoke-loader_stop

IMPHASH 67ae5c7b77ed3563acdaa8e440808d86
SHA256 a042c4e28448b6b7159638f3855db008d79bf31be1338065956137b04671ab38
MD5 f8d0cfda335d96f3101ce02e8dd023d3
SHA1 8193190ed79e74db744d48fb1c4388da9d4ec0e6
SHA512 456df055f01349dec9f336d8bfd943f93ebc323f4e74d94ed6d4b51e23bfbff16b6aaa7b8a8485c26aa920622db0e0aadafc9701208b3df7b305737620bc07f3
SSDEEP 393216:fys8jH8hsybqw8DPqpnO2qe4L1YY+uWwye24Sz4/zSKeN6sGb/n3y:qscRgq72d46Jw724Sz4uMvK
TLSH
T128273375AA949322FAAAF3329227822456357CD46E7591CF5381395B7B73EC18F33302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

1b:7d:21:d7:ec:c4:e6:fb:b4:79:26:1e:4d:10:82:f4:d5:1f:67:17:79:57:7a:e2:9f:f0:b3:09:9e:a2:04:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4169881,CN=Splashtop Inc.,O=Splashtop Inc.,L=Cupertino,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Aug 7, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:d2:3a:70:6a:b8:5c:32:49:08:37:95:4b:9e:41:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2025 - May 19, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

82099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\slave\workspace\GIT_WIN_SRS_Formal\Source\irisserver\Release\SRUnPackSOS.pdb

kernel32

GetStartupInfoW HeapAlloc HeapFree ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree GetTickCount GetCPInfo GetACP GlobalFlags IsValidCodePage VirtualAlloc InitializeCriticalSectionAndSpinCount LCMapStringW GetTimeFormatA GetDateFormatA GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap CreateFileA SetEnvironmentVariableA SetErrorMode lstrlenA TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement InterlockedDecrement GetModuleHandleA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GlobalAddAtomW GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime FileTimeToSystemTime GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer MoveFileW FormatMessageW FreeResource GlobalUnlock GlobalLock DeleteFileW DeviceIoControl FindClose QueryPerformanceCounter GlobalFree GlobalAlloc FindNextFileW GetFileAttributesW FindFirstFileW GetSystemTimeAsFileTime GetVersionExW Process32NextW Process32FirstW CreateToolhelp32Snapshot WriteFile CreateProcessW GetCurrentProcess LocalFree SetLastError ReadFile CreateFileW GetModuleFileNameW GetModuleHandleW WritePrivateProfileStringW GetExitCodeProcess GetProcessId GetSystemWindowsDirectoryW TerminateProcess OpenProcess GetCurrentThreadId GetCommandLineW GetSystemDirectoryW SetDllDirectoryW GetLastError CreateMutexW MultiByteToWideChar GetDiskFreeSpaceExW RemoveDirectoryW SetCurrentDirectoryW Sleep GetTempPathW CreateThread WaitForSingleObject GetWindowsDirectoryW CreateDirectoryW WideCharToMultiByte GetCurrentProcessId ProcessIdToSessionId lstrlenW OutputDebugStringW FreeLibrary GetProcAddress LoadLibraryW CloseHandle FindResourceW LoadResource LockResource SizeofResource GetOEMCP GetPrivateProfileStringW

user32

UnregisterClassW DestroyMenu GetSysColorBrush MoveWindow SetWindowTextW GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW RegisterWindowMessageW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetMenu CreateWindowExW GetClassInfoExW RegisterClassW GetSysColor AdjustWindowRectEx ScreenToClient GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowLongW GetLastActivePopup IsWindowEnabled SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow GetKeyState PeekMessageW ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem PostQuitMessage CharUpperW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EnableWindow GetCursorPos SetLayeredWindowAttributes RedrawWindow ReleaseDC SetWindowRgn GetClientRect SetTimer PostMessageW KillTimer DisableProcessWindowsGhosting SendMessageW LoadIconW SystemParametersInfoW PtInRect GetWindowRect GetWindowPlacement GetWindow LoadCursorW SetCursor GetClassNameW IsWindowVisible GetWindowTextW SetForegroundWindow AttachThreadInput GetWindowThreadProcessId GetForegroundWindow SwitchToThisWindow ShowWindow IsWindow FindWindowW GetSystemMetrics MessageBoxW GetClassInfoW

gdi32

GetStockObject DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible CreateRoundRectRgn DeleteObject SetMapMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateBitmap GetDeviceCaps BitBlt CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetFileTitleW

advapi32

RegQueryValueW RegOpenKeyW CreateWellKnownSid CreateProcessAsUserW OpenProcessToken DuplicateTokenEx DuplicateToken CheckTokenMembership GetTokenInformation RegSetValueExW RegEnumKeyW RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegDeleteKeyW RegFlushKey RegCreateKeyExW RegCloseKey RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser

shell32

SHCreateDirectoryExW ShellExecuteExW SHFileOperationW SHGetFolderPathW

shlwapi

PathFileExistsW PathAppendW PathStripToRootW PathIsUNCW PathFindExtensionW PathFindFileNameW

ole32

CreateStreamOnHGlobal

oleaut32

VariantInit VariantClear VariantChangeType

gdiplus

GdipDeleteFontFamily GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipDisposeImage GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipDrawImageRectI GdipDeleteGraphics GdipCreateFromHDC GdiplusShutdown GdipFree GdipAlloc GdiplusStartup

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_f8d0cfda335d96f3101ce02e8dd023d3_amadey_elex_icedid_ransomhub_remcos_smoke-loader_stop

kernel32

user32

gdi32

comdlg32

advapi32

shell32

shlwapi

ole32

oleaut32

gdiplus

generic