2026-09-04_165a3b0cca3ad974fe5e1857cd6f5254_amadey_elex_emotet_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_165a3b0cca3ad974fe5e1857cd6f5254_amadey_elex_emotet_remcos_smoke-loader
Size 969KB
Sample260905-wbd6hsfb29
SHA256 d37835e5b7796112fcb528ffc6b7e58789c638fbaad61666de05ffb4fff5e378
MD5 165a3b0cca3ad974fe5e1857cd6f5254
SHA1 65be28ac6b0faee966f0872da678d6f1e049c173
SHA512 d7ca971f1a41f9d531acc506739087b5484e6d5c1e52a20f27a3cc84492e0805d98dac56bf5ce6073b79c5f6b8c5963d1a061b2ce7b10a7fa575e4fcff574b5f
SSDEEP 24576:0wa/Nhy/9xE+f7+d5YuLeCNx2M29EiKJVVWiTQzEhs99JIh1i3:IG9Q/NxAiiuTQvJIh1q
TLSH
T1D525BE11F6D1803ED5F39072ADFE465EA228FE21072449C3B3846E2F5A766D1793932B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-04_165a3b0cca3ad974fe5e1857cd6f5254_amadey_elex_emotet_remcos_smoke-loader

File Explorer

2026-09-04_165a3b0cca3ad974fe5e1857cd6f5254_amadey_elex_emotet_remcos_smoke-loader

.exe 969KB

2026-09-04_165a3b0cca3ad974fe5e1857cd6f5254_amadey_elex_emotet_remcos_smoke-loader

IMPHASH ef51b2e719ed5dbca0e5ba77201df5e8
SHA256 d37835e5b7796112fcb528ffc6b7e58789c638fbaad61666de05ffb4fff5e378
MD5 165a3b0cca3ad974fe5e1857cd6f5254
SHA1 65be28ac6b0faee966f0872da678d6f1e049c173
SHA512 d7ca971f1a41f9d531acc506739087b5484e6d5c1e52a20f27a3cc84492e0805d98dac56bf5ce6073b79c5f6b8c5963d1a061b2ce7b10a7fa575e4fcff574b5f
SSDEEP 24576:0wa/Nhy/9xE+f7+d5YuLeCNx2M29EiKJVVWiTQzEhs99JIh1i3:IG9Q/NxAiiuTQvJIh1q
TLSH
T1D525BE11F6D1803ED5F39072ADFE465EA228FE21072449C3B3846E2F5A766D1793932B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ef:ae:84:d7:f2:12:7d:d0:8e:11:17:74:37:16:2c:13:2f:6a:44:b5

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=NEXON Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=NEXON Corporation,L=Gangnam,ST=Seoul,C=KR

Chains

Aug 11, 2011

CN=NEXON Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=NEXON Corporation,L=Gangnam,ST=Seoul,C=KR

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=NEXON Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=NEXON Corporation,L=Gangnam,ST=Seoul,C=KR

Serial Number

64:60:f5:48:46:9c:3c:ac:54:42:91:25:62:58:58:11

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 10, 2011 - Mar 26, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

422215

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LockFile UnlockFile GetVolumeInformationA GetFullPathNameA InterlockedIncrement FileTimeToSystemTime GlobalFlags LocalAlloc GlobalReAlloc GlobalHandle TlsGetValue TlsAlloc TlsSetValue LocalReAlloc TlsFree GetOEMCP SetErrorMode FileTimeToLocalFileTime RtlUnwind ExitProcess ExitThread CreateThread VirtualProtect VirtualAlloc VirtualQuery GetTimeFormatA FlushFileBuffers GetStartupInfoA GetCommandLineA HeapReAlloc SetHandleCount GetStdHandle SetStdHandle HeapSize QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter HeapDestroy HeapCreate VirtualFree IsBadWritePtr SetUnhandledExceptionFilter GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW IsBadReadPtr IsBadCodePtr SetEnvironmentVariableA WritePrivateProfileStringA PeekNamedPipe GetCurrentThread lstrcmpA ConvertDefaultLocale EnumResourceLanguagesA lstrcpyA InterlockedDecrement SetLastError MulDiv GlobalAlloc LocalFree GetCurrentThreadId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom LoadLibraryA FreeLibrary lstrcatA lstrcmpW lstrcpynA GetModuleHandleA GetProcAddress GlobalLock GlobalUnlock GlobalFree FreeResource GetStringTypeA LCMapStringA GetCPInfo LCMapStringW GetStringTypeW SetEndOfFile GetFileType Sleep GetCurrentProcess DuplicateHandle FormatMessageA HeapFree GetProcessHeap HeapAlloc FindResourceExA MapViewOfFile GetSystemInfo UnmapViewOfFile CreateFileMappingA GetFileInformationByHandle GetTickCount GetFileTime CompareFileTime SetFilePointer ReadFile GetFileSize WriteFile LeaveCriticalSection EnterCriticalSection FindNextFileA GetTempPathA GetTempFileNameA CreateDirectoryA GetFileAttributesA SetFileAttributesA CreateFileA DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime MoveFileA RemoveDirectoryA RaiseException DeleteCriticalSection InitializeCriticalSection lstrlenA lstrcmpiA CompareStringA CompareStringW GetVersion GetWindowsDirectoryA CreateEventA SetEvent GetCurrentDirectoryA CreateProcessA GetSystemDirectoryA FindFirstFileA FindClose SetCurrentDirectoryA CreateMutexA CloseHandle OpenProcess WaitForSingleObject TerminateProcess LoadResource LockResource SizeofResource FindResourceA GetLastError lstrlenW WideCharToMultiByte MultiByteToWideChar GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange GetVersionExA DeleteFileA GetDateFormatA GetModuleFileNameA

user32

RegisterClipboardFormatA MessageBeep GetNextDlgGroupItem DestroyMenu LoadCursorA GetSysColorBrush CharNextA InvalidateRgn InvalidateRect CopyAcceleratorTableA SetRect IsRectEmpty SetWindowContextHelpId MapDialogRect wsprintfA GetMessageA TranslateMessage ValidateRect SetCursor PostQuitMessage EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextA TabbedTextOutA SetMenuItemBitmaps ModifyMenuA GetMenuState EnableMenuItem CheckMenuItem GetMenuCheckMarkDimensions LoadBitmapA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA WinHelpA CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA GetClassInfoExA GetClassNameA SetPropA GetPropA RemovePropA SendDlgItemMessageA GetFocus SetFocus IsChild GetWindowTextA GetForegroundWindow GetLastActivePopup DispatchMessageA GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos SystemParametersInfoA GetCursorPos ReleaseCapture SetWindowRgn GetWindowRect SetTimer KillTimer GetCapture SetCapture SendMessageA EnableWindow LoadIconA SetWindowPos PeekMessageA MapWindowPoints MessageBoxA GetKeyState SetForegroundWindow IsWindowVisible UpdateWindow GetMenu GetSubMenu GetMenuItemID GetMenuItemCount GetSysColor AdjustWindowRectEx EqualRect GetClassInfoA PostThreadMessageA CharUpperA UnregisterClassA PostMessageA GetClientRect RegisterWindowMessageA EndDialog GetNextDlgTabItem GetParent IsWindowEnabled GetDlgItem GetWindowLongA IsWindow DestroyWindow CreateDialogIndirectParamA GetSystemMetrics SetActiveWindow GetActiveWindow GetDesktopWindow GetWindow PtInRect CopyRect GetWindowPlacement IsIconic IntersectRect OffsetRect SetWindowLongA CallWindowProcA DefWindowProcA GetDlgCtrlID RegisterClassA DrawTextExA

gdi32

GetBkColor GetTextColor GetMapMode GetRgnBox CreateRectRgnIndirect GetStockObject DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx CreateRectRgn SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC GetDeviceCaps CreateBitmap GetObjectA SetBkColor SetTextColor GetClipBox CombineRgn ScaleViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegOpenKeyA RegEnumKeyA RegQueryValueA RegCloseKey

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetSpecialFolderPathA

comctl32

ord17

shlwapi

PathFindExtensionA PathFindFileNameA PathStripToRootA PathFileExistsA PathIsUNCA

oledlg

ord8

ole32

CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize CoTaskMemAlloc CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject CoRegisterMessageFilter OleFlushClipboard OleRun OleIsCurrentClipboard

oleaut32

SysAllocStringLen VariantInit VariantClear SysStringLen SysAllocString VariantCopy VariantChangeType DispCallFunc LoadRegTypeLi SysAllocStringByteLen SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElemsize SafeArrayCreate SafeArrayDestroy SystemTimeToVariantTime OleCreateFontIndirect GetErrorInfo SysFreeString

wininet

FtpGetFileSize FtpCommandA FtpOpenFileA FtpSetCurrentDirectoryA HttpQueryInfoA HttpOpenRequestA HttpSendRequestA InternetQueryDataAvailable InternetGetLastResponseInfoA InternetSetFilePointer InternetReadFile InternetConnectA InternetCloseHandle InternetOpenA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_165a3b0cca3ad974fe5e1857cd6f5254_amadey_elex_emotet_remcos_smoke-loader

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

generic