2026-08-10_f7122ddedcf6a51b15d64ff1e6c2341e_elex_emotet_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_f7122ddedcf6a51b15d64ff1e6c2341e_elex_emotet_stop
Size 605KB
Sample260810-d953sadh46
SHA256 6ecd965b40a2383b5e75444ff5f1f8ab89a3648fd9d4997bb5d474dc3cd95d24
MD5 f7122ddedcf6a51b15d64ff1e6c2341e
SHA1 f16c23871c4811fd268f6f34adbaf08daada0b87
SHA512 05cb0e4606c94aa556cb15ecb43008e511b017f280f51401cbec05e00b8c09359267c2897e96215e123be036b77db7892204170587fe09c4f768ea215da70286
SSDEEP 6144:02xTZumduU00ZU56Gisc9s6ZmeTuBBww1bLpgEZaSsaJoEyRh95F:J00y56UC3BcBxiEYSsuoEihfF
TLSH
T1C0D48C923BD59972C0A974360A13828A17FB7C505F6E8553B7A53F2D8E34BC2CF26316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-10_f7122ddedcf6a51b15d64ff1e6c2341e_elex_emotet_stop

File Explorer

2026-08-10_f7122ddedcf6a51b15d64ff1e6c2341e_elex_emotet_stop

.exe 605KB

2026-08-10_f7122ddedcf6a51b15d64ff1e6c2341e_elex_emotet_stop

IMPHASH 7abb69c0c057bbdc2831e7a671d42f71
SHA256 6ecd965b40a2383b5e75444ff5f1f8ab89a3648fd9d4997bb5d474dc3cd95d24
MD5 f7122ddedcf6a51b15d64ff1e6c2341e
SHA1 f16c23871c4811fd268f6f34adbaf08daada0b87
SHA512 05cb0e4606c94aa556cb15ecb43008e511b017f280f51401cbec05e00b8c09359267c2897e96215e123be036b77db7892204170587fe09c4f768ea215da70286
SSDEEP 6144:02xTZumduU00ZU56Gisc9s6ZmeTuBBww1bLpgEZaSsaJoEyRh95F:J00y56UC3BcBxiEYSsuoEihfF
TLSH
T1C0D48C923BD59972C0A974360A13828A17FB7C505F6E8553B7A53F2D8E34BC2CF26316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

84:9d:85:f9:58:43:f3:9f:b2:40:09:c5:6e:35:50:9e:cb:a9:69:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=iAnywhere Solutions\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Advantage Database Server,O=iAnywhere Solutions\, Inc.,ST=Idaho,C=US

Chains

Dec 4, 2012

CN=iAnywhere Solutions\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Advantage Database Server,O=iAnywhere Solutions\, Inc.,ST=Idaho,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=iAnywhere Solutions\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Advantage Database Server,O=iAnywhere Solutions\, Inc.,ST=Idaho,C=US

Serial Number

4e:f5:8b:be:34:b4:4a:cc:de:f7:8c:7c:3f:0c:40:70

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2012 - Oct 25, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

138148

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

h:\build_dir\other\vsiinstall\bootstrap2\release\setup.pdb

msi

ord91 ord31 ord117 ord48 ord18 ord185 ord23 ord20 ord170 ord160 ord159 ord67 ord8 ord122 ord17 ord124

rpcrt4

UuidCreate

kernel32

DeleteCriticalSection TlsFree InterlockedIncrement GetThreadLocale ReadFile WriteFile SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle FindClose FindFirstFileA GetVolumeInformationA GetFullPathNameA FileTimeToSystemTime GetCPInfo GetOEMCP SetErrorMode GetTickCount FileTimeToLocalFileTime GetFileTime VirtualProtect LocalReAlloc GetSystemInfo VirtualQuery HeapFree HeapAlloc HeapReAlloc GetCommandLineA GetProcessHeap GetStartupInfoA RtlUnwind ExitProcess RaiseException HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapDestroy HeapCreate VirtualFree GetStdHandle SetHandleCount GetFileType GetACP IsValidCodePage GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime GetTimeZoneInformation GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection GlobalFlags InterlockedDecrement GetModuleFileNameW WritePrivateProfileStringA GlobalGetAtomNameA GlobalFindAtomA LoadLibraryA lstrcmpW GlobalAddAtomA FreeResource GlobalFree GlobalUnlock MulDiv GetCurrentProcessId SetLastError GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryExA GlobalLock GlobalAlloc FreeLibrary CopyFileA GetTempFileNameA DeleteFileA GetTempPathA CreateFileA LoadResource SizeofResource GetVersionExA GetCurrentProcess CreateMutexA CreateProcessA GetExitCodeProcess LockResource LocalAlloc FindResourceA GetFileAttributesA CloseHandle WaitForSingleObject GetModuleHandleA GetProcAddress lstrcmpA GetModuleFileNameA GetPrivateProfileStringA GetPrivateProfileIntA GetPrivateProfileSectionA LocalFree FormatMessageA GetLastError lstrlenA MultiByteToWideChar WideCharToMultiByte CompareStringW GetVersion InterlockedExchange CompareStringA VirtualAlloc

user32

EndPaint GetSysColorBrush LoadCursorA SetCapture ReleaseCapture CharNextA CopyAcceleratorTableA IsRectEmpty SetRect InvalidateRect InvalidateRgn GetNextDlgGroupItem MessageBeep DestroyMenu UnregisterClassA RegisterClipboardFormatA PostThreadMessageA BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA RegisterWindowMessageA LoadIconA SendDlgItemMessageA WinHelpA IsChild GetCapture GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA SetFocus GetWindowTextLengthA GetWindowTextA GetForegroundWindow GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow UpdateWindow GetClientRect GetMenu CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcA CallWindowProcA SetWindowLongA IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetDesktopWindow SetActiveWindow GetSystemMetrics CreateDialogIndirectParamA DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem EndDialog GetWindow SetWindowContextHelpId MapDialogRect SetWindowPos SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA GetCursorPos ValidateRect GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId GetWindowLongA GetLastActivePopup IsWindowEnabled SetCursor SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA GetFocus GetParent SendMessageA ModifyMenuA GetMenuState EnableMenuItem CheckMenuItem PostMessageA PostQuitMessage EnableWindow ExitWindowsEx MessageBoxA LoadStringA CharUpperA OffsetRect

gdi32

SetMapMode ExtSelectClipRgn DeleteDC GetStockObject GetBkColor ScaleWindowExtEx GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx RestoreDC SaveDC GetObjectA SetBkColor SetTextColor GetClipBox GetDeviceCaps CreateBitmap SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegQueryValueExA RegOpenKeyExA RegOpenKeyA OpenProcessToken AdjustTokenPrivileges RegCloseKey LookupPrivilegeValueA

oledlg

ord8

ole32

CoTaskMemFree CreateILockBytesOnHGlobal CoTaskMemAlloc CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject OleInitialize CoFreeUnusedLibraries OleUninitialize StgCreateDocfileOnILockBytes

oleaut32

VariantCopy SysAllocString SafeArrayDestroy SystemTimeToVariantTime VariantTimeToSystemTime OleCreateFontIndirect VariantInit VariantChangeType VariantClear SysFreeString SysAllocStringByteLen SysStringLen SysAllocStringLen

shlwapi

PathFindExtensionA PathStripToRootA PathIsUNCA PathFindFileNameA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_f7122ddedcf6a51b15d64ff1e6c2341e_elex_emotet_stop

PE Signature issue

msi

rpcrt4

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

oledlg

ole32

oleaut32

shlwapi

generic