2026-08-09_5cab83a024c4e4132d94d863cb667527_elex_emotet_floxif_icedid_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_5cab83a024c4e4132d94d863cb667527_elex_emotet_floxif_icedid_stop
Size 1.4MB
Sample260809-hlphcasfkf
SHA256 61380a72e071034bbd779a39eeeccc32d84a9b43cf3322ce4d94a7befd58d185
MD5 5cab83a024c4e4132d94d863cb667527
SHA1 927dc23a561a544ffe45e1bd8976a1c71d138977
SHA512 ded9462f37c59eb546ae192ee85baba68b82e08355d99e4d1661909ce8d50e44ffc56ae76770bf50c40638e0bc18aee381f1d15a16a09e40f981f88f84dcfe5f
SSDEEP 24576:ddy90FRUhFuWhe+bvepUH1TuPAYhC0lMlMlhrEH7U0t:60AXu8eyvemk/C0lMlMlx0t
TLSH
T1B5654B0077E29139F9B306B29EBE815D9675BD60073490CFA3C4585E2EB6AD27D31B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_5cab83a024c4e4132d94d863cb667527_elex_emotet_floxif_icedid_stop

File Explorer

2026-08-09_5cab83a024c4e4132d94d863cb667527_elex_emotet_floxif_icedid_stop

.exe 1.4MB

2026-08-09_5cab83a024c4e4132d94d863cb667527_elex_emotet_floxif_icedid_stop

IMPHASH d169925b389c52502340fdb3c50717c0
SHA256 61380a72e071034bbd779a39eeeccc32d84a9b43cf3322ce4d94a7befd58d185
MD5 5cab83a024c4e4132d94d863cb667527
SHA1 927dc23a561a544ffe45e1bd8976a1c71d138977
SHA512 ded9462f37c59eb546ae192ee85baba68b82e08355d99e4d1661909ce8d50e44ffc56ae76770bf50c40638e0bc18aee381f1d15a16a09e40f981f88f84dcfe5f
SSDEEP 24576:ddy90FRUhFuWhe+bvepUH1TuPAYhC0lMlMlhrEH7U0t:60AXu8eyvemk/C0lMlMlx0t
TLSH
T1B5654B0077E29139F9B306B29EBE815D9675BD60073490CFA3C4585E2EB6AD27D31B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4d:43:3e:dc:0e:c4:25:2d:73:16:e0:f0:85:cf:11:0a:4c:f5:40:60

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Logitech,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Logitech,L=Fremont,ST=California,C=US

Chains

Jun 22, 2011

CN=Logitech,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Logitech,L=Fremont,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Logitech,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Logitech,L=Fremont,ST=California,C=US

Serial Number

1e:f0:5f:3f:3c:03:7d:74:39:41:db:75:d7:fb:86:37

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2011 - Apr 27, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

259824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Build\LU\LU_2.22\2.22.6\Sources\LuUpdater\release\LogitechUpdate.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

GlobalFlags InterlockedIncrement TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree SetErrorMode HeapFree HeapAlloc GetProcessHeap GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime RtlUnwind RaiseException ExitThread HeapReAlloc ExitProcess SetStdHandle GetFileType HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetStartupInfoA FreeResource HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW VirtualAlloc GetConsoleCP GetConsoleMode GetTimeZoneInformation GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA LocalAlloc GetFileTime GetFileAttributesW SetFileAttributesW SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile SetFilePointer GetThreadLocale DeleteFileW MoveFileW GlobalAddAtomW GlobalDeleteAtom ConvertDefaultLocale GetVersion EnumResourceLanguagesW SetThreadAffinityMask GetDiskFreeSpaceExW GetSystemPowerStatus CopyFileExW GetSystemDefaultUILanguage EnumSystemLocalesW QueryPerformanceFrequency TerminateThread GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW GetModuleHandleA InterlockedDecrement lstrlenA lstrcmpA WideCharToMultiByte SuspendThread SetThreadPriority MulDiv TerminateProcess GetCurrentProcessId OutputDebugStringW GlobalLock GlobalUnlock CopyFileW VerifyVersionInfoW VerSetConditionMask GetSystemInfo GetModuleHandleW IsBadWritePtr GlobalFree SetEnvironmentVariableW GlobalAlloc GetCurrentProcess GetCurrentThread LocalFree GetVersionExW IsBadCodePtr FreeLibrary GetProcAddress LoadLibraryW GetTickCount lstrlenW CreateThread ReadFile DisconnectNamedPipe ConnectNamedPipe CreateNamedPipeW PeekNamedPipe FlushFileBuffers WriteFile WaitNamedPipeW CreateFileW ResumeThread ReleaseMutex FormatMessageW CreateMutexW SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW GetModuleFileNameW GetTempPathW GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW Sleep EnterCriticalSection LeaveCriticalSection MultiByteToWideChar DeleteCriticalSection InitializeCriticalSection ResetEvent SetLastError GetHandleInformation GetLastError WaitForMultipleObjectsEx SetEvent OpenEventW FindResourceW LoadResource LockResource SizeofResource GetExitCodeProcess CloseHandle WaitForSingleObject WaitForMultipleObjects CreateEventW GetCurrentThreadId HeapDestroy InterlockedCompareExchange

user32

DestroyMenu CreateDialogIndirectParamW GetNextDlgTabItem EndDialog RegisterWindowMessageW SendDlgItemMessageA WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetTopWindow DestroyWindow GetMessageTime MapWindowPoints UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW DefWindowProcW SystemParametersInfoA GetWindowPlacement CharUpperW GetWindowTextLengthW GetWindowTextW SetFocus ShowWindow MoveWindow GetDlgCtrlID SetWindowTextW IsDialogMessageW SendDlgItemMessageW GetDlgItem GetWindow GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled MessageBoxW EndPaint BeginPaint ClientToScreen GrayStringW TabbedTextOutW UnhookWindowsHookEx SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetKeyState PeekMessageW ValidateRect GetMenuItemID UnregisterClassA wsprintfW AttachThreadInput GetMenuItemCount GetSubMenu SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW GetMenuState CheckMenuItem CreatePopupMenu PostQuitMessage SetActiveWindow SetWindowLongW DrawIcon IsIconic TrackPopupMenu SetMenuDefaultItem AppendMenuW CallWindowProcW GetCursorPos ScreenToClient GetMessagePos DestroyCursor LoadCursorW ReleaseDC GetSysColorBrush UnregisterClassW GetDC SetCursor DrawTextExW FrameRect FillRect GetDesktopWindow IsRectEmpty SetForegroundWindow SetWindowPos CopyRect IsWindowVisible InvalidateRect OffsetRect EnableMenuItem EnableWindow GetSystemMenu GetMenu GetWindowLongW AdjustWindowRectEx GetParent GetClientRect LoadIconW InflateRect SystemParametersInfoW GetSystemMetrics MonitorFromPoint SetRect GetWindowRect PtInRect DrawTextW GetForegroundWindow FindWindowW PostThreadMessageW SendMessageW IsWindow SetTimer KillTimer PostMessageW BringWindowToTop GetActiveWindow GetSysColor

gdi32

SetWindowExtEx ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx Escape ExtTextOutW TextOutW RectVisible PtVisible GetTextExtentExPointW GetObjectW CreateFontW GetClipBox SetMapMode RestoreDC SaveDC CreateBitmap SetBkColor CreateBrushIndirect GetTextExtentPoint32W GetStockObject BitBlt SetTextColor SetBkMode SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteObject CreateSolidBrush CombineRgn CreateRectRgnIndirect FillRgn DeleteDC GetDeviceCaps SetViewportExtEx SetViewportOrgEx

msimg32

GradientFill

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

CryptAcquireContextW RegQueryValueW RegEnumKeyW RegOpenKeyW CryptReleaseContext CryptVerifySignatureW CryptHashData CryptDestroyHash CryptCreateHash CryptImportKey SetFileSecurityW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegCloseKey RegFlushKey RegCreateKeyExW OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetFolderPathW ShellExecuteExW ShellExecuteW Shell_NotifyIconW SHCreateDirectoryExW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW PathStripToRootW PathIsUNCW UrlUnescapeW PathFindExtensionW PathCanonicalizeW

ole32

CoTaskMemFree CreateStreamOnHGlobal CoUninitialize StringFromGUID2 CoCreateGuid CoInitialize CoTaskMemAlloc

oleaut32

VariantClear VariantChangeType VariantInit

gdiplus

GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipFree GdipGetImageHeight GdipGetImageWidth GdiplusStartup GdipCreateBitmapFromStreamICM GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageI GdipAlloc

wininet

InternetOpenUrlW InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallbackW InternetOpenW InternetGetLastResponseInfoW InternetCloseHandle InternetGetConnectedState InternetCheckConnectionW InternetCrackUrlW InternetCanonicalizeUrlW InternetQueryOptionW InternetSetOptionExW InternetQueryDataAvailable HttpQueryInfoW

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW

msi

ord8 ord96 ord72 ord232

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_5cab83a024c4e4132d94d863cb667527_elex_emotet_floxif_icedid_stop

PE Signature issue

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

wininet

setupapi

msi

generic