2026-09-15_b262d5dade19c364c61cf7447502a6d5_amadey_elex_emotet_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-15_b262d5dade19c364c61cf7447502a6d5_amadey_elex_emotet_smoke-loader_stealc_stop
Size 1.4MB
Sample260915-1pljzadq5v
SHA256 4670cedd7a2c76ea5092b14888c068be5b06744383837e40c8b4cb234c979434
MD5 b262d5dade19c364c61cf7447502a6d5
SHA1 072263bc170f092084482157035d6d2f8969d36d
SHA512 8fc87b9c577954fd8dbb9f3d82e0b996b437405e45f3419ae8e20148de3392a596afb06c968d20dccf09bbfc715821a3adadd7974e2a2f6a1e08166d5ac0ffdb
SSDEEP 24576:E3ydytZ9m4GgSZK4vboJitekGZeU2wxSX0R+9CX9E1SA:PKZ9micjjib1h2mSA+9CtE1S
TLSH
T1FA65022236C1C873D65201724CD78A7AA373BC505F2549C7BB947B5E9EB07D3AA3630A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-15_b262d5dade19c364c61cf7447502a6d5_amadey_elex_emotet_smoke-loader_stealc_stop

File Explorer

2026-09-15_b262d5dade19c364c61cf7447502a6d5_amadey_elex_emotet_smoke-loader_stealc_stop

.exe 1.4MB

2026-09-15_b262d5dade19c364c61cf7447502a6d5_amadey_elex_emotet_smoke-loader_stealc_stop

IMPHASH f0d273e03f5936fb903f41157c666217
SHA256 4670cedd7a2c76ea5092b14888c068be5b06744383837e40c8b4cb234c979434
MD5 b262d5dade19c364c61cf7447502a6d5
SHA1 072263bc170f092084482157035d6d2f8969d36d
SHA512 8fc87b9c577954fd8dbb9f3d82e0b996b437405e45f3419ae8e20148de3392a596afb06c968d20dccf09bbfc715821a3adadd7974e2a2f6a1e08166d5ac0ffdb
SSDEEP 24576:E3ydytZ9m4GgSZK4vboJitekGZeU2wxSX0R+9CX9E1SA:PKZ9micjjib1h2mSA+9CtE1S
TLSH
T1FA65022236C1C873D65201724CD78A7AA373BC505F2549C7BB947B5E9EB07D3AA3630A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\perforce\cc\oem\iron\mangusta\sw\trunk\win\installer\release\install.pdb

kernel32

GetCurrentProcessId lstrlenW GlobalUnlock GlobalFree InterlockedDecrement LocalAlloc TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree GetVersionExA LoadLibraryA CompareStringW GlobalFindAtomW MoveFileW GetThreadLocale SetFilePointer FlushFileBuffers SetEndOfFile GlobalDeleteAtom WritePrivateProfileStringW GetModuleHandleA GlobalFlags InterlockedIncrement lstrlenA FileTimeToSystemTime SetErrorMode FileTimeToLocalFileTime GetFileAttributesW GetStartupInfoW GetDriveTypeW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind ExitProcess RaiseException HeapReAlloc HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetCurrentDirectoryA GetTimeZoneInformation VirtualAlloc GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetDriveTypeA CreateFileA SetEnvironmentVariableA SetEnvironmentVariableW ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GlobalLock lstrcmpW GlobalAlloc GlobalAddAtomW GetTickCount WriteFile FindClose FindFirstFileW ReadFile CreateFileW SetLastError HeapFree GetProcessHeap HeapAlloc LocalFree FormatMessageW OutputDebugStringW LeaveCriticalSection EnterCriticalSection GetCurrentThreadId GetLocalTime InitializeCriticalSection CreateMutexW GetFullPathNameW GetModuleFileNameW GetVersionExW FreeLibrary GetExitCodeProcess WaitForSingleObject CreateProcessW GetCurrentProcess MultiByteToWideChar WideCharToMultiByte GetCurrentThread GetModuleHandleW LoadLibraryExW GetSystemDefaultLangID GetUserDefaultLangID GetSystemDefaultUILanguage GetUserDefaultUILanguage GetProcAddress LoadLibraryW LoadResource LockResource SizeofResource Sleep GetLastError DeleteFileW GetTempPathW GetWindowsDirectoryW FindResourceW GetSystemDirectoryW CloseHandle ReleaseMutex

user32

DestroyMenu UnregisterClassW ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetDC ReleaseDC GetSysColorBrush ShowWindow SetWindowTextW RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetWindowTextW GetForegroundWindow GetDlgItem DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx CopyRect GetDlgCtrlID DefWindowProcW SystemParametersInfoA IsIconic GetWindowPlacement GetWindow GetMenuItemID GetMenuItemCount GetSubMenu SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem GetWindowThreadProcessId GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow PostQuitMessage SetCursor GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible SendMessageW GetKeyState PeekMessageW GetCursorPos ValidateRect GetTopWindow SetWindowsHookExW CallNextHookEx SetWindowLongW SetWindowPos GetWindowRect GetSystemMetrics CallWindowProcW UnhookWindowsHookEx MessageBoxW LoadStringW PostMessageW PtInRect UnregisterClassA

gdi32

PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject GetStockObject DeleteDC DeleteObject SetMapMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox GetDeviceCaps CreateBitmap ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCloseKey RegCreateKeyExW

shell32

ShellExecuteW SHGetFolderPathW ord680

shlwapi

PathFindFileNameW PathFindExtensionW PathAppendW

oleaut32

VariantInit VariantChangeType VariantClear

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-15_b262d5dade19c364c61cf7447502a6d5_amadey_elex_emotet_smoke-loader_stealc_stop

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

oleacc

generic