2026-08-25_e9a6caabd740ee4ce6a64809c0ceed7f_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_e9a6caabd740ee4ce6a64809c0ceed7f_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop
Size 3.6MB
Sample260826-epbtwasblh
SHA256 95a7f153be9224a99950aa6ab1a44ae86eed7f779ec91a3adb24416bf099858a
MD5 e9a6caabd740ee4ce6a64809c0ceed7f
SHA1 905ba3ff309ec808a6e0a7e145d326db69194774
SHA512 5f3ac484b22b7dc6f706535055f4998726e4effd7d35665dc82c46c9bc78dc2e890cbcf61070ef3754125c07f527312ffbe7e68d89565c59fc89081a54f6ed9a
SSDEEP 49152:cAYMFp1RaHdSMZqNDWfRr10H6hRMaYcVRZTJUD4U:cAYGp1RKdSUqNDWfRr1yajVq
TLSH
T14306C081BBC680F5C4920DB0007A9239E6365F0EAB2555C3F7947EA7ED726E1263E1CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-25_e9a6caabd740ee4ce6a64809c0ceed7f_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop

File Explorer

2026-08-25_e9a6caabd740ee4ce6a64809c0ceed7f_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop

.exe 3.6MB

2026-08-25_e9a6caabd740ee4ce6a64809c0ceed7f_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop

IMPHASH 971f9838f6a41accfe3de30f56aba225
SHA256 95a7f153be9224a99950aa6ab1a44ae86eed7f779ec91a3adb24416bf099858a
MD5 e9a6caabd740ee4ce6a64809c0ceed7f
SHA1 905ba3ff309ec808a6e0a7e145d326db69194774
SHA512 5f3ac484b22b7dc6f706535055f4998726e4effd7d35665dc82c46c9bc78dc2e890cbcf61070ef3754125c07f527312ffbe7e68d89565c59fc89081a54f6ed9a
SSDEEP 49152:cAYMFp1RaHdSMZqNDWfRr10H6hRMaYcVRZTJUD4U:cAYGp1RKdSUqNDWfRr1yajVq
TLSH
T14306C081BBC680F5C4920DB0007A9239E6365F0EAB2555C3F7947EA7ED726E1263E1CD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

03:a9:3c:5e:31:ac:1f:08:41:e0:09:ac:5a:cb:4a:b9:0c:1a:83:73

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing+OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Jul 31, 2014

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing+OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing+OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

29:12:c7:0c:9a:2b:8a:3e:f6:f6:07:46:62:d6:8b:8d

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 29, 2014 - Jan 29, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

2659222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\p\agents\hpac1.eem\recipes\527001005\base\googleclient\picasa39-stable\build\Google+ Auto Backup.pdb

mpr

WNetGetConnectionA

wininet

InternetQueryOptionA InternetGoOnline InternetOpenA InternetCloseHandle InternetGetConnectedState InternetGetCookieExA InternetCrackUrlA HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpQueryInfoA InternetErrorDlg InternetWriteFile InternetReadFile HttpEndRequestA HttpOpenRequestA InternetSetStatusCallback InternetConnectA InternetSetOptionA InternetGetConnectedStateEx

kernel32

IsDebuggerPresent FlushFileBuffers GetCurrentProcessId CreateThread SetUnhandledExceptionFilter GetTempPathA SetLastError GlobalAlloc GetModuleFileNameA DeleteCriticalSection InitializeCriticalSection MulDiv lstrcmpA GlobalUnlock GlobalLock lstrlenA GetModuleHandleA GetCurrentProcess FlushInstructionCache IsDBCSLeadByte RaiseException DisableThreadLibraryCalls lstrlenW WideCharToMultiByte MultiByteToWideChar LoadLibraryExA lstrcmpiA CreateMutexA InterlockedExchange GetCommandLineW GetLogicalDrives GetFileAttributesExW DeleteFileW WaitForSingleObject GetOverlappedResult GetSystemDefaultLCID CreateToolhelp32Snapshot GetProcessTimes Module32Next Module32First DebugBreak GetNumberFormatA LocalFileTimeToFileTime GetSystemTime CopyFileW FindNextFileA RemoveDirectoryW FindNextFileW GetTimeFormatW GetDateFormatW FindFirstFileExA CreateDirectoryExA FindFirstFileExW SetFileAttributesW CreateDirectoryA FindFirstFileA FindFirstFileW DeleteFileA GetShortPathNameA GetFileAttributesA CreateProcessA GetFileAttributesW GetFileAttributesExA SetFileAttributesA GetProcAddress LoadLibraryA FreeLibrary SizeofResource LockResource LoadResource UnhandledExceptionFilter FindResourceA CompareFileTime GetLongPathNameA FindCloseChangeNotification ResetEvent CreateEventA ExitProcess GetCurrentThread Sleep GetVolumeInformationA GetLongPathNameW FindNextChangeNotification WaitForMultipleObjects GetLastError SystemTimeToFileTime GetDriveTypeA GetWindowsDirectoryA FindClose InterlockedIncrement InterlockedDecrement CloseHandle InterlockedCompareExchange CreateDirectoryExW CreateDirectoryW RemoveDirectoryA LoadLibraryExW LoadLibraryW MoveFileWithProgressA GetModuleHandleW CopyFileExA MoveFileWithProgressW CopyFileExW MoveFileExA MoveFileA FindFirstChangeNotificationA FindFirstChangeNotificationW CopyFileA CreateProcessW MoveFileExW MoveFileW UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSizeEx SetEndOfFile SetFilePointerEx GetVersion SearchPathA GetSystemDirectoryA GetModuleFileNameW SetFileTime SetErrorMode GetTempPathW CreateFileW GetShortPathNameW QueryPerformanceFrequency SetPriorityClass GetCurrentThreadId LeaveCriticalSection EnterCriticalSection SetEvent ExitThread HeapDestroy GetThreadPriority SetThreadPriority TerminateThread GetFileSize FormatMessageA LocalFree OutputDebugStringA GlobalFree TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime SetEnvironmentVariableA CompareStringW CompareStringA CreateFileA GetUserDefaultLCID GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RtlUnwind GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetTimeZoneInformation IsValidCodePage GetOEMCP GetCPInfo GetConsoleMode GetConsoleCP SetFilePointer ReadFile GetFileType SetHandleCount HeapSize TlsFree TlsSetValue TlsAlloc TlsGetValue GetStdHandle WriteFile GetACP GetLocaleInfoA GetThreadLocale GetVersionExA HeapFree GetProcessHeap HeapAlloc IsProcessorFeaturePresent VirtualFree VirtualAlloc HeapReAlloc VirtualProtect GetSystemInfo VirtualQuery GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime TerminateProcess GetCommandLineA GetStartupInfoA HeapCreate

user32

DefWindowProcA GetWindowLongA SetWindowLongA DestroyIcon DestroyMenu DestroyWindow CreateWindowExA RegisterClassA LoadIconA PostMessageA ShowWindow PostQuitMessage SetForegroundWindow EnumWindows FindWindowA GetClassNameA ShowOwnedPopups TrackPopupMenu CreatePopupMenu SetMenuInfo SetTimer KillTimer GetKeyState CallWindowProcA EnumChildWindows MoveWindow UpdateWindow SetFocus CharNextA LoadCursorA SetWindowPos ClientToScreen GetDlgItem SendMessageA GetCursorPos GetClassInfoExA SetCapture ReleaseCapture GetParent IsChild CreateAcceleratorTableA RedrawWindow GetWindowTextLengthA GetWindow GetWindowTextA SetWindowTextA GetDesktopWindow GetSysColor InvalidateRgn InvalidateRect ReleaseDC RegisterWindowMessageA GetDC RemovePropA EndPaint SetPropA BeginPaint FillRect GetFocus DestroyAcceleratorTable IsWindow GetClientRect ScreenToClient RegisterClassExA UnregisterClassA DrawTextW IsIconic GetScrollBarInfo CreateDialogIndirectParamA GetSystemMetrics GetForegroundWindow SystemParametersInfoA EnableWindow DialogBoxIndirectParamW GetWindowRect IsWindowEnabled EndDialog IsWindowVisible DialogBoxIndirectParamA GetPropA GetWindowTextLengthW GetWindowTextW PeekMessageA IsDialogMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects SetActiveWindow GetAsyncKeyState SetCursor FlashWindowEx GetCursor UnhookWindowsHookEx CallNextHookEx SetWindowsHookExA EnumThreadWindows GetClassInfoA AppendMenuA SetClassLongW SetWindowTextW MessageBoxA DialogBoxParamA DialogBoxParamW SendMessageW GetMenuItemInfoA SetDlgItemTextW SetDlgItemTextA DefWindowProcW CreateDialogParamW CreateDialogParamA CreateWindowExW SetMenuItemInfoW GetMenuItemInfoW InsertMenuItemW AppendMenuW MessageBoxW SetWindowLongW SetMenuItemInfoA GetWindowLongW CallWindowProcW RegisterClassW InsertMenuItemA UnregisterClassW SetClassLongA GetClassLongA BringWindowToTop GetActiveWindow MessageBeep

gdi32

GetTextExtentPoint32A GetTextExtentPoint32W GetTextMetricsA CreateDIBSection GetICMProfileA SetDIBits TextOutW ExtTextOutW TextOutA ExtTextOutA GetKerningPairsA SetBkMode GetGlyphOutlineW GetGlyphOutlineA CreateSolidBrush CreateCompatibleBitmap CreateCompatibleDC BitBlt DeleteDC GetObjectA GetDeviceCaps SelectObject DeleteObject CreateFontIndirectA GetStockObject

advapi32

RegQueryValueExW ReportEventA DeregisterEventSource CryptGenRandom RegQueryValueExA RegEnumValueW CryptDeriveKey CryptEncrypt CryptReleaseContext CryptDecrypt FreeSid CheckTokenMembership AllocateAndInitializeSid RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyA RegEnumValueA CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextA RegSetValueExW RegEnumKeyExW RegOpenKeyExW RegCreateKeyExW RegisterEventSourceA

shell32

ord2 ord4 ShellExecuteA SHGetMalloc SHGetPathFromIDListW SHGetPathFromIDListA Shell_NotifyIconW SHFileOperationA SHGetFileInfoA SHGetSpecialFolderPathA SHBrowseForFolderW DragQueryFileW ShellExecuteExA Shell_NotifyIconA DragQueryFileA SHFileOperationW SHGetFileInfoW SHGetSpecialFolderPathW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteExW SHBrowseForFolderA

ole32

FreePropVariantArray CoTaskMemFree CreateStreamOnHGlobal StringFromGUID2 CoCreateInstance PropVariantClear CoRegisterClassObject OleLockRunning CLSIDFromString CoTaskMemRealloc CoTaskMemAlloc CoGetClassObject CoUninitialize CLSIDFromProgID CoResumeClassObjects OleUninitialize OleInitialize CoInitializeEx

oleaut32

VarBstrFromDate SystemTimeToVariantTime VarBstrCat OleCreateFontIndirect LoadTypeLi LoadRegTypeLi VariantClear VariantInit VarUI4FromStr SysStringByteLen SysAllocStringLen SysStringLen SysAllocString VariantTimeToSystemTime SysFreeString

comctl32

CreatePropertySheetPageW PropertySheetA CreatePropertySheetPageA PropertySheetW InitCommonControlsEx

mscms

GetColorDirectoryA

shlwapi

SHDeleteValueA SHDeleteKeyA

urlmon

FindMimeFromData CoInternetGetSession

version

GetFileVersionInfoW VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoSizeW

ws2_32

htons htonl gethostbyname ntohl ntohs

comdlg32

GetSaveFileNameW GetOpenFileNameW GetSaveFileNameA GetOpenFileNameA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_e9a6caabd740ee4ce6a64809c0ceed7f_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop

PE Signature issue

mpr

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

mscms

shlwapi

urlmon

version

ws2_32

comdlg32

generic