2026-08-13_91e705c4bcc7c878e1aa1c2d3bcf098a_amadey_emotet_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_91e705c4bcc7c878e1aa1c2d3bcf098a_amadey_emotet_smoke-loader_stop
Size 8.8MB
Sample260813-kpsqaaej2t
SHA256 b57cd8f2dae5dfc079754fb1b11b4226f7ebf3cde832b91534ff0d536a59d658
MD5 91e705c4bcc7c878e1aa1c2d3bcf098a
SHA1 210f9b55828dd4b32be6d45a88382537f38fc19b
SHA512 527fbda2001bd723fe5484e0b531e3d32829088404d6e1cda2f400970e474e8c2393afb28e166db54fc095237ea1d73172c5fad61228d97a2a1f6db24b9dcb61
SSDEEP 98304:xtpLyQ5iQRcH+VjafTtagxDgJhtBlRGQix:35ZVjaf5agxCm
TLSH
T13B961D16E2F9425FFAF3ABF0E9B483754D767C56AB3481CE2B1431690931F908868727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-13_91e705c4bcc7c878e1aa1c2d3bcf098a_amadey_emotet_smoke-loader_stop

.exe 8.8MB

2026-08-13_91e705c4bcc7c878e1aa1c2d3bcf098a_amadey_emotet_smoke-loader_stop

IMPHASH 680b000b678490e537f3aff6ce23e5de
SHA256 b57cd8f2dae5dfc079754fb1b11b4226f7ebf3cde832b91534ff0d536a59d658
MD5 91e705c4bcc7c878e1aa1c2d3bcf098a
SHA1 210f9b55828dd4b32be6d45a88382537f38fc19b
SHA512 527fbda2001bd723fe5484e0b531e3d32829088404d6e1cda2f400970e474e8c2393afb28e166db54fc095237ea1d73172c5fad61228d97a2a1f6db24b9dcb61
SSDEEP 98304:xtpLyQ5iQRcH+VjafTtagxDgJhtBlRGQix:35ZVjaf5agxCm
TLSH
T13B961D16E2F9425FFAF3ABF0E9B483754D767C56AB3481CE2B1431690931F908868727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Digest

b0:ae:22:be:66:5e:c7:58:1d:3b:b4:21:56:67:9a:68:1c:4e:c7:44:bb:df:a8:d5:98:dd:e8:64:4d:26:04:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 10, 2018

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

bb:4c:cb:c4:1a:55:f1:ec:8a:f1:87:59:bd:ac:d8:46:f6:ce:75:03

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,POSTALCODE=300,STREET=No. 2\, Innovation Road II\, Hsinchu Science Park,L=Hsinchu,ST=Taiwan,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 9, 2018

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

Serial Number

03:20:be:3e:b8:66:52:69:27:f9:99:b9:7b:04:34:6e

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 13, 2016 - Jan 24, 2019

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 1, 2017 - Nov 1, 2018

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

Major OS version

Entry point

1448928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\chunyung.RTDOMAIN\Documents\Visual Studio 2005\Projects\RtkNGui\x64\release\RtkNGUI64.pdb

dwmapi

DwmExtendFrameIntoClientArea

winmm

mmioClose timeGetTime mmioOpenW mmioWrite mmioSetInfo mmioAdvance mmioGetInfo mmioCreateChunk mciSendStringW mmioRead mmioSeek mmioAscend mmioDescend

imm32

ImmDisableIME

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiEnumDeviceInfo

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

dsound

ord3 ord6 ord1

rpcrt4

UuidToStringW RpcStringFreeW

bcrypt

BCryptCloseAlgorithmProvider BCryptEncrypt BCryptOpenAlgorithmProvider BCryptImportKeyPair BCryptDestroyKey

kernel32

DeviceIoControl DuplicateHandle ResumeThread HeapFree GetProcessHeap GetSystemDirectoryA ResetEvent GetTempPathW DeleteFileW GetSystemPowerStatus HeapAlloc ReleaseMutex OpenFileMappingW MapViewOfFile UnmapViewOfFile CreateDirectoryW OpenMutexW IsBadReadPtr GetSystemInfo RaiseException lstrcmpA GetVersionExA lstrcmpW CompareStringW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW CompareStringA GetLocaleInfoW EnumResourceLanguagesW ConvertDefaultLocale GetCurrentThread SetThreadPriority SuspendThread WritePrivateProfileStringW GetCurrentProcessId GetThreadLocale ReadFile GetPrivateProfileStringW FlushFileBuffers LockFile UnlockFile SetEndOfFile GetVolumeInformationW GetFullPathNameW FileTimeToSystemTime FileTimeToLocalFileTime TlsGetValue TlsAlloc GlobalHandle TlsSetValue LocalReAlloc TlsFree GlobalFlags SetErrorMode GetFileTime GetStartupInfoW RtlPcToFileHeader VirtualProtect VirtualAlloc VirtualQuery HeapReAlloc GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlCaptureContext ExitThread RtlLookupFunctionEntry RtlUnwindEx ExitProcess HeapSize SetStdHandle GetFileType GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetStartupInfoA FlsGetValue FlsSetValue FlsFree FlsAlloc HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetConsoleCP GetConsoleMode GetPrivateProfileIntW RtlVirtualUnwind GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW WriteConsoleA GetConsoleOutputCP GetStringTypeA GetStringTypeW GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA CreateFileA SetEnvironmentVariableA CompareFileTime SystemTimeToFileTime WriteConsoleW GetStdHandle AllocConsole Process32NextW Process32FirstW CreateToolhelp32Snapshot SetThreadExecutionState GetFileAttributesW GetSystemTime GetTimeZoneInformation GetWindowsDirectoryW WaitForMultipleObjects GetExitCodeThread GetModuleHandleA WriteFile CreateFileW Sleep LoadLibraryA SearchPathW GetSystemDirectoryW FindResourceExW GetUserDefaultUILanguage MulDiv FreeLibrary CreateThread CreateEventW TerminateThread lstrcmpiW GetVersionExW GetVersion GetCPInfo FreeResource lstrlenA GetTickCount FormatMessageW SetEvent GetModuleHandleW SetLastError WideCharToMultiByte GlobalFree GlobalReAlloc GlobalUnlock GlobalLock GlobalAlloc WaitForSingleObject CreateProcessW GetCurrentProcess IsWow64Process SetThreadUILanguage GetCurrentThreadId GetUserGeoID MultiByteToWideChar lstrcpynW FindClose FindNextFileW FindFirstFileW GetProcAddress LoadLibraryW LocalFree LocalAlloc CloseHandle GetLastError CreateMutexW lstrlenW InitializeCriticalSection OutputDebugStringW FindResourceW LeaveCriticalSection LoadResource LockResource GetLocalTime SizeofResource GetModuleFileNameW EnterCriticalSection DeleteCriticalSection GetFileSize SetFilePointer

user32

GetCapture WinHelpW SendDlgItemMessageW SendDlgItemMessageA IsDialogMessageW MoveWindow IsWindowEnabled ClientToScreen BeginPaint EndPaint CheckMenuItem EnableMenuItem GetMenuCheckMarkDimensions SetMenuItemBitmaps GetActiveWindow GetMessageW CharUpperW EndDialog GetNextDlgTabItem CreateDialogIndirectParamW WindowFromPoint DestroyMenu UnregisterClassW SystemParametersInfoA IsIconic GetWindowPlacement GetMenuStringW FindWindowW UnregisterDeviceNotification RegisterDeviceNotificationW UnhookWindowsHookEx GetMonitorInfoW MonitorFromWindow GetShellWindow ExitWindowsEx RegisterWindowMessageW GetClassInfoW SetMenuDefaultItem SetWindowTextW LoadIconW IsWindow DrawIconEx GrayStringW LoadBitmapW DrawTextExW DrawTextW CreatePopupMenu DrawEdge TabbedTextOutW CreateMenu GetSubMenu ModifyMenuW DeleteMenu GetMenuItemInfoW GetMenuItemID InsertMenuW GetMenuItemCount GetMenuState DestroyIcon UpdateLayeredWindow GetScrollRange LoadImageW GetClassLongPtrW SetClassLongW GetClassLongW TranslateAcceleratorW GetSysColorBrush SetWindowLongPtrW GetScrollInfo CallWindowProcW GetWindowLongPtrW GetCursorPos KillTimer SetTimer GetClassNameW GetDlgCtrlID SetWindowLongW ValidateRect ScreenToClient AppendMenuW FillRect SystemParametersInfoW EqualRect GetComboBoxInfo SetCursor LoadCursorW IntersectRect SetCapture ReleaseDC GetDC PtInRect InflateRect GetMessagePos SetRect SetRectEmpty ReleaseCapture FrameRect GetWindowLongW DispatchMessageW TranslateMessage PostQuitMessage PeekMessageW SetForegroundWindow SetClassLongPtrW SetWindowPos AttachThreadInput GetWindowThreadProcessId ShowWindow SetWindowRgn GetWindowRgn LockWindowUpdate SetParent IsWindowVisible GetDesktopWindow CallNextHookEx MessageBoxW GetForegroundWindow SetWindowsHookExW GetAncestor SetActiveWindow UnionRect ChildWindowFromPointEx WindowFromDC ShowScrollBar SetScrollPos SetScrollRange CopyRect OffsetRect GetSystemMetrics GetParent GetWindow GetWindowRect RedrawWindow PostMessageW FindWindowExW SetProcessDPIAware UpdateWindow SendMessageW InvalidateRect SetCaretPos GetCaretPos EnableWindow GetClientRect GetSysColor GetFocus UnregisterClassA GetMenu SetPropW GetPropW RemovePropW SetFocus GetWindowTextLengthW GetWindowTextW GetLastActivePopup GetDlgItem GetTopWindow CreateWindowExW GetClassInfoExW RegisterClassW AdjustWindowRectEx DestroyWindow GetMessageTime MapWindowPoints TrackPopupMenuEx TrackPopupMenu DestroyCursor GetKeyState SetScrollInfo DefWindowProcW IsRectEmpty GetScrollPos

gdi32

Escape PatBlt GetDeviceCaps GetCurrentObject ExtTextOutW Ellipse PtVisible GetBkMode RectVisible TextOutW GetPixel SetPixel SetBkMode SetMapMode LineTo MoveToEx SetTextAlign CreateFontIndirectW SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx SetTextColor CreateBitmap DPtoLP GetClipBox CreatePen CreateFontW EnumFontFamiliesExW RestoreDC SaveDC CreateSolidBrush SetDIBColorTable GetMapMode CreateCompatibleBitmap CombineRgn ExtCreateRegion CreateDIBSection GetObjectW DeleteObject CreateRectRgn CreateCompatibleDC SelectObject DeleteDC BitBlt GetStockObject GetTextExtentPoint32W SetBkColor

msimg32

AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegEnumKeyW RegOpenKeyW RegNotifyChangeKeyValue RegEnumKeyExW RegQueryInfoKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegCloseKey RegQueryValueW RegOpenKeyExW RegDeleteKeyW

shell32

Shell_NotifyIconW ShellExecuteExW SHGetFolderPathW SHGetKnownFolderPath SHGetSpecialFolderPathW

comctl32

ord380 _TrackMouseEvent InitCommonControlsEx

shlwapi

PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW SHStrDupW

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoCreateGuid CreateStreamOnHGlobal PropVariantClear CoTaskMemAlloc PropVariantCopy FreePropVariantArray CoInitializeSecurity CoFreeUnusedLibrariesEx CoInitialize CLSIDFromString StringFromGUID2 CoTaskMemFree CLSIDFromProgID

oleaut32

SafeArrayCreate VariantChangeType VariantInit SysFreeString SysAllocString VariantClear

gdiplus

GdipCreateBitmapFromScan0 GdipGetImagePaletteSize GdipGetImagePixelFormat GdipDrawImageI GdipCreateFromHDC GdipBitmapUnlockBits GdipSetInterpolationMode GdipBitmapLockBits GdipCreateBitmapFromStream GdipGetImagePalette GdipCreateBitmapFromHBITMAP GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipImageRotateFlip GdipDrawImageRectRectI GdipDrawImageRectRect GdipCreateBitmapFromHICON GdipSetSmoothingMode GdipDrawImageRect GdipDrawLineI GdipCreatePen1 GdipDeletePen GdipDeleteFontFamily GdipGetFamily GdipCreateFont GdipGetFontUnit GdipGetFontStyle GdipGetFontSize GdipGetLogFontW GdipCreateFontFromDC GdipCreateFontFromLogfontW GdipDeleteFont GdipMeasureString GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipCloneBrush GdipSetTextRenderingHint GdipDrawString GdipCreateSolidFill GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipDeleteBrush GdipDrawImage GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdipDrawImageRectI GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateHBITMAPFromBitmap GdiplusStartup GdiplusShutdown GdipDeleteGraphics

wininet

InternetConnectW HttpSendRequestW InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallbackW InternetOpenW InternetGetLastResponseInfoW InternetQueryDataAvailable HttpOpenRequestW InternetCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_91e705c4bcc7c878e1aa1c2d3bcf098a_amadey_emotet_smoke-loader_stop

PE Signature issue

dwmapi

winmm

imm32

setupapi

version

dsound

rpcrt4

bcrypt

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

wininet

generic