2026-08-17_4de937da4c9bc044ab2f3dc9ac99acf7_amadey_elex_emotet_glassworm_icedid_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-17_4de937da4c9bc044ab2f3dc9ac99acf7_amadey_elex_emotet_glassworm_icedid_remcos_smoke-loader_stop
Size 2.5MB
Sample260817-x31n9syshs
SHA256 8dae71f569ff48982cd769ddda1e99c10173c0cecf5c0d0011c357b6955a8602
MD5 4de937da4c9bc044ab2f3dc9ac99acf7
SHA1 489683d6a5992062f64cdb19adee3247b7b904b8
SHA512 a869298d35233e15de99383c95a4de631f5bb6faa975dd50c94598184217107f4020c1d8b929b71b3e2cfca2c13b2e5dbe087bd44ff86b3c540a02d20a5493ec
SSDEEP 49152:sxYks3zOPELbzT/9YLMQ0EHudMBa15pN3+BeAp/8T66Zk:sxYksKPA3ToiyuicfpNWyk
TLSH
T192C5BE02B7C180B2D9A70BB58877537E5A3AFE114339C6D7C7D02E298D316D19A3E399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-17_4de937da4c9bc044ab2f3dc9ac99acf7_amadey_elex_emotet_glassworm_icedid_remcos_smoke-loader_stop

.exe 2.5MB

2026-08-17_4de937da4c9bc044ab2f3dc9ac99acf7_amadey_elex_emotet_glassworm_icedid_remcos_smoke-loader_stop

IMPHASH 76c3ec48cf1e7d532d7cf7f31145f47c
SHA256 8dae71f569ff48982cd769ddda1e99c10173c0cecf5c0d0011c357b6955a8602
MD5 4de937da4c9bc044ab2f3dc9ac99acf7
SHA1 489683d6a5992062f64cdb19adee3247b7b904b8
SHA512 a869298d35233e15de99383c95a4de631f5bb6faa975dd50c94598184217107f4020c1d8b929b71b3e2cfca2c13b2e5dbe087bd44ff86b3c540a02d20a5493ec
SSDEEP 49152:sxYks3zOPELbzT/9YLMQ0EHudMBa15pN3+BeAp/8T66Zk:sxYksKPA3ToiyuicfpNWyk
TLSH
T192C5BE02B7C180B2D9A70BB58877537E5A3AFE114339C6D7C7D02E298D316D19A3E399
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

bc:c9:06:d8:97:7e:de:2e:a2:6b:41:eb:17:f7:d7:71:87:5e:6d:56:f6:69:e2:e1:36:eb:14:8d:67:54:b1:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Chains

Jan 12, 2018

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

5a:2d:41:d4:5d:bb:78:20:d2:27:8e:9c:dc:9a:03:0e:54:39:ee:e0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Chains

Jan 12, 2018

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Subject

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Serial Number

5b:32:d2:7a:2e:b6:b4:cf:47:4f:83:97:38:12:9c:46

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 11, 2017 - Oct 10, 2019

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Serial Number

17:7b:68:fb:e4:74:c7:69:f8:4e:87:90:2a:7a:f2:85

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2017 - Oct 10, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

414972

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\jenkins\workspace\srf_develop\ShuRuFa\程序\Trunk\Bin\pdbmap\SmartCloud\Mutual32.pdb

gdiplus

GdiplusShutdown GdiplusStartup GdipCloneImage GdipDrawImageRectI GdipCreateFromHDC GdipDisposeImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipDeleteGraphics GdipAlloc GdipFree

shlwapi

PathFindFileNameW PathFindExtensionW PathIsUNCW PathStripToRootW PathAppendW SHDeleteKeyW PathFileExistsW SHGetValueW

kernel32

InterlockedExchange CompareStringA GetLocaleInfoW lstrcmpA EnumResourceLanguagesW ConvertDefaultLocale TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree InterlockedIncrement GlobalFlags lstrlenA GetStartupInfoW GetConsoleCP GetConsoleMode DeleteFileA RtlUnwind TerminateProcess UnhandledExceptionFilter IsDebuggerPresent RaiseException GetSystemTimeAsFileTime HeapReAlloc ExitThread ExitProcess VirtualQuery HeapSize GetStdHandle FreeEnvironmentStringsA GetFullPathNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetTimeZoneInformation GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetConsoleCtrlHandler GetCurrentDirectoryA GetDriveTypeA GetFullPathNameA SetEnvironmentVariableA DuplicateHandle SetEndOfFile UnlockFile LockFile GetThreadLocale GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW lstrcmpW GetVersionExA FreeResource SetLastError OpenFileMappingW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetVersion VirtualAllocEx VirtualFreeEx lstrcpynW GetFileAttributesW GetFileSizeEx WaitForMultipleObjects LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection MulDiv ReleaseMutex CreateMutexW SetPriorityClass OutputDebugStringA VerSetConditionMask VerifyVersionInfoW SleepEx GetSystemDirectoryA PeekNamedPipe ExpandEnvironmentStringsW FindFirstFileA GlobalMemoryStatus FlushConsoleInputBuffer ReadConsoleInputA SetConsoleMode FormatMessageW GetLogicalDriveStringsW QueryDosDeviceW lstrlenW InterlockedDecrement lstrcmpiW SetFileAttributesW GetCommandLineW ReadProcessMemory GetExitCodeProcess QueryPerformanceFrequency GetEnvironmentVariableW QueryPerformanceCounter SetUnhandledExceptionFilter GetCurrentThreadId GetCurrentProcessId SetErrorMode WriteProcessMemory GlobalLock GlobalUnlock GetVolumeInformationW GlobalAlloc GlobalFree OutputDebugStringW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetModuleFileNameA FlushFileBuffers WideCharToMultiByte GetSystemInfo OpenProcess GetFileTime DeviceIoControl CreateProcessW WaitForSingleObject FindNextFileW GetLocalTime GetWindowsDirectoryW CreateDirectoryW CopyFileW RemoveDirectoryW GetCurrentThread GetVersionExW GetModuleHandleW GetModuleHandleA GetSystemWow64DirectoryW MoveFileExW HeapAlloc GetProcessHeap HeapFree IsBadReadPtr LoadLibraryA VirtualFree VirtualProtect VirtualAlloc GetCurrentProcess LoadLibraryW GetProcAddress FreeLibrary GetSystemDirectoryW LocalAlloc LocalFree MoveFileW Sleep SystemTimeToFileTime FileTimeToSystemTime GetLastError FindFirstFileW FindClose CreateThread GetExitCodeThread TerminateThread GetTempPathW GetTickCount GetPrivateProfileStringW FindResourceW LoadResource LockResource SizeofResource GetModuleFileNameW MultiByteToWideChar DeleteFileW CreateFileW GetFileSize ReadFile SetFilePointer WriteFile WritePrivateProfileStringW GetPrivateProfileIntW DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime SetFileAttributesA CreateFileA GetFileInformationByHandle CloseHandle FileTimeToLocalFileTime FileTimeToDosDateTime GetFileAttributesA AreFileApisANSI LockFileEx GetTempPathA FormatMessageA GetEnvironmentStrings GetSystemTime

user32

LoadCursorW GetSysColorBrush DestroyMenu EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetWindowContextHelpId MapDialogRect SetCursor GetMessageW TranslateMessage ValidateRect PostQuitMessage CharUpperW ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW SetPropW GetPropW RemovePropW SetFocus UnregisterClassA MessageBoxA GetProcessWindowStation GetUserObjectInformationW GetLastActivePopup DispatchMessageW GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints GetKeyState IsWindowVisible UpdateWindow GetMenu MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx EqualRect SetCapture CopyRect GetDlgCtrlID DefWindowProcW CallWindowProcW IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindow CreateDialogIndirectParamW DestroyWindow GetDlgItem IsWindowEnabled GetNextDlgTabItem EndDialog GetMenuState GetMenuItemID GetMenuItemCount OffsetRect GetActiveWindow ReleaseCapture UnregisterClassW CharNextW CopyAcceleratorTableW IsRectEmpty SetRect InvalidateRgn GetNextDlgGroupItem MessageBeep SetActiveWindow GetShellWindow PeekMessageW PtInRect EnumDisplayMonitors SystemParametersInfoW GetMonitorInfoW wsprintfW GetFocus GetClassNameW FindWindowExW RegisterClipboardFormatW GetWindowTextW GetForegroundWindow GetWindowThreadProcessId GetParent FillRect FrameRect InvalidateRect GetClientRect GetWindowLongW SetWindowLongW FindWindowW RegisterWindowMessageW LoadIconW GetCursorPos SetForegroundWindow IsWindow GetDesktopWindow ReleaseDC GetDC GetSubMenu GetSystemMetrics UnloadKeyboardLayout PostMessageW GetWindowRect SetWindowPos SendMessageW EnableWindow KillTimer SetTimer PostThreadMessageW

gdi32

GetMapMode GetRgnBox CreateRectRgnIndirect GetTextColor GetBkColor GetStockObject DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateFontW TextOutW SelectObject SetBkMode SetTextColor Escape ExtTextOutW RectVisible PtVisible CreateSolidBrush GetWindowExtEx GetViewportExtEx SetMapMode RestoreDC SaveDC GetObjectW SetBkColor GetClipBox GetDeviceCaps BitBlt DeleteObject

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegCreateKeyExW SetFileSecurityW RegDeleteValueW RegDeleteKeyW RegSetValueExW RegOpenKeyExW RegOpenKeyW RegEnumValueW RegisterEventSourceA ReportEventA DeregisterEventSource RegQueryValueExW RegCloseKey SetSecurityDescriptorDacl RegQueryValueW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetNamedSecurityInfoW RegCreateKeyExA ChangeServiceConfig2W RegEnumKeyW ControlService DeleteService OpenServiceW StartServiceW OpenSCManagerW CloseServiceHandle CreateServiceW RegCreateKeyW RegSetValueW LookupAccountNameW GetFileSecurityW InitializeSecurityDescriptor GetSecurityDescriptorDacl GetAclInformation GetLengthSid InitializeAcl GetAce EqualSid AddAce AddAccessAllowedAce GetSecurityDescriptorControl

shell32

SHChangeNotify SHGetSpecialFolderPathW ShellExecuteExW SHGetFolderPathW ord155 SHGetFileInfoW SHGetFolderLocation ShellExecuteW SHGetDesktopFolder SHGetDataFromIDListW

comctl32

ord17

oledlg

OleUIBusyW

ole32

CLSIDFromProgID CoTaskMemAlloc CoTaskMemFree CLSIDFromString CreateStreamOnHGlobal CoCreateInstance CoInitialize CoUninitialize CoRegisterMessageFilter OleFlushClipboard CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard

oleaut32

OleCreateFontIndirect SysAllocString SysFreeString VariantInit VariantCopy VariantChangeType VariantClear SysAllocStringLen SysStringLen SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime GetErrorInfo

urlmon

URLDownloadToFileW

cabinet

ord20 ord23 ord10 ord22 ord13 ord11 ord14 ord21

wininet

InternetCloseHandle InternetOpenW HttpQueryInfoW InternetSetFilePointer InternetReadFile InternetOpenUrlW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

EnumProcesses GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

ws2_32

ioctlsocket shutdown select closesocket getpeername getsockname htonl ntohs recvfrom WSASetLastError gethostname setsockopt getservbyname send __WSAFDIsSet getservbyport inet_ntoa gethostbyname htons inet_addr WSAGetLastError WSACleanup WSAStartup socket bind connect listen accept getsockopt sendto recv gethostbyaddr

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-17_4de937da4c9bc044ab2f3dc9ac99acf7_amadey_elex_emotet_glassworm_icedid_remcos_smoke-loader_stop

PE Signature issue

gdiplus

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

oleaut32

urlmon

cabinet

wininet

version

psapi

iphlpapi

ws2_32

generic