2026-09-16_1a2fb49e324575e12ebdcc6e4fd3b9a8_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_1a2fb49e324575e12ebdcc6e4fd3b9a8_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop
Size 3.6MB
Sample260916-3kft2afe37
SHA256 0625b175991d712f67d013afec5fd094dccaaa8eb268904800f6ed49f2d62758
MD5 1a2fb49e324575e12ebdcc6e4fd3b9a8
SHA1 5f0e6b39637eb7cad48568349175fbf0057a2fe6
SHA512 0bdaa07f23c430fa8d9ce1ca43f56cc66efcbc1ed01e0c51316ecd875b5589c9966441f176b6072ecb67dacc21db2b2cd113148b0ef7f6d05b41d7ddf11db3c2
SSDEEP 49152:B+YMFp1RaHdSMZqNDWfRr10H6hRMGYcVRZTJUD:B+YGp1RKdSUqNDWfRr1yGjV+
TLSH
T1DC06C081BBC680F5C4920DB0047A9239E6365F0EAB2555C3F7947EA7EC726E1263E1CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_1a2fb49e324575e12ebdcc6e4fd3b9a8_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop

File Explorer

2026-09-16_1a2fb49e324575e12ebdcc6e4fd3b9a8_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop

.exe 3.6MB

2026-09-16_1a2fb49e324575e12ebdcc6e4fd3b9a8_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop

IMPHASH 971f9838f6a41accfe3de30f56aba225
SHA256 0625b175991d712f67d013afec5fd094dccaaa8eb268904800f6ed49f2d62758
MD5 1a2fb49e324575e12ebdcc6e4fd3b9a8
SHA1 5f0e6b39637eb7cad48568349175fbf0057a2fe6
SHA512 0bdaa07f23c430fa8d9ce1ca43f56cc66efcbc1ed01e0c51316ecd875b5589c9966441f176b6072ecb67dacc21db2b2cd113148b0ef7f6d05b41d7ddf11db3c2
SSDEEP 49152:B+YMFp1RaHdSMZqNDWfRr10H6hRMGYcVRZTJUD:B+YGp1RKdSUqNDWfRr1yGjV+
TLSH
T1DC06C081BBC680F5C4920DB0047A9239E6365F0EAB2555C3F7947EA7EC726E1263E1CD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

44:04:ff:e6:17:3a:74:b3:3a:1b:d1:3c:ae:4a:30:ff:9a:25:ea:86

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing+OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Jul 31, 2014

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing+OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing+OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

29:12:c7:0c:9a:2b:8a:3e:f6:f6:07:46:62:d6:8b:8d

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 29, 2014 - Jan 29, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

2659222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\p\agents\hpac1.eem\recipes\527001005\base\googleclient\picasa39-stable\build\Google+ Auto Backup.pdb

mpr

WNetGetConnectionA

wininet

InternetQueryOptionA InternetGoOnline InternetOpenA InternetCloseHandle InternetGetConnectedState InternetGetCookieExA InternetCrackUrlA HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpQueryInfoA InternetErrorDlg InternetWriteFile InternetReadFile HttpEndRequestA HttpOpenRequestA InternetSetStatusCallback InternetConnectA InternetSetOptionA InternetGetConnectedStateEx

kernel32

IsDebuggerPresent FlushFileBuffers GetCurrentProcessId CreateThread SetUnhandledExceptionFilter GetTempPathA SetLastError GlobalAlloc GetModuleFileNameA DeleteCriticalSection InitializeCriticalSection MulDiv lstrcmpA GlobalUnlock GlobalLock lstrlenA GetModuleHandleA GetCurrentProcess FlushInstructionCache IsDBCSLeadByte RaiseException DisableThreadLibraryCalls lstrlenW WideCharToMultiByte MultiByteToWideChar LoadLibraryExA lstrcmpiA CreateMutexA InterlockedExchange GetCommandLineW GetLogicalDrives GetFileAttributesExW DeleteFileW WaitForSingleObject GetOverlappedResult GetSystemDefaultLCID CreateToolhelp32Snapshot GetProcessTimes Module32Next Module32First DebugBreak GetNumberFormatA LocalFileTimeToFileTime GetSystemTime CopyFileW FindNextFileA RemoveDirectoryW FindNextFileW GetTimeFormatW GetDateFormatW FindFirstFileExA CreateDirectoryExA FindFirstFileExW SetFileAttributesW CreateDirectoryA FindFirstFileA FindFirstFileW DeleteFileA GetShortPathNameA GetFileAttributesA CreateProcessA GetFileAttributesW GetFileAttributesExA SetFileAttributesA GetProcAddress LoadLibraryA FreeLibrary SizeofResource LockResource LoadResource UnhandledExceptionFilter FindResourceA CompareFileTime GetLongPathNameA FindCloseChangeNotification ResetEvent CreateEventA ExitProcess GetCurrentThread Sleep GetVolumeInformationA GetLongPathNameW FindNextChangeNotification WaitForMultipleObjects GetLastError SystemTimeToFileTime GetDriveTypeA GetWindowsDirectoryA FindClose InterlockedIncrement InterlockedDecrement CloseHandle InterlockedCompareExchange CreateDirectoryExW CreateDirectoryW RemoveDirectoryA LoadLibraryExW LoadLibraryW MoveFileWithProgressA GetModuleHandleW CopyFileExA MoveFileWithProgressW CopyFileExW MoveFileExA MoveFileA FindFirstChangeNotificationA FindFirstChangeNotificationW CopyFileA CreateProcessW MoveFileExW MoveFileW UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSizeEx SetEndOfFile SetFilePointerEx GetVersion SearchPathA GetSystemDirectoryA GetModuleFileNameW SetFileTime SetErrorMode GetTempPathW CreateFileW GetShortPathNameW QueryPerformanceFrequency SetPriorityClass GetCurrentThreadId LeaveCriticalSection EnterCriticalSection SetEvent ExitThread HeapDestroy GetThreadPriority SetThreadPriority TerminateThread GetFileSize FormatMessageA LocalFree OutputDebugStringA GlobalFree TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime SetEnvironmentVariableA CompareStringW CompareStringA CreateFileA GetUserDefaultLCID GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RtlUnwind GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetTimeZoneInformation IsValidCodePage GetOEMCP GetCPInfo GetConsoleMode GetConsoleCP SetFilePointer ReadFile GetFileType SetHandleCount HeapSize TlsFree TlsSetValue TlsAlloc TlsGetValue GetStdHandle WriteFile GetACP GetLocaleInfoA GetThreadLocale GetVersionExA HeapFree GetProcessHeap HeapAlloc IsProcessorFeaturePresent VirtualFree VirtualAlloc HeapReAlloc VirtualProtect GetSystemInfo VirtualQuery GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime TerminateProcess GetCommandLineA GetStartupInfoA HeapCreate

user32

DefWindowProcA GetWindowLongA SetWindowLongA DestroyIcon DestroyMenu DestroyWindow CreateWindowExA RegisterClassA LoadIconA PostMessageA ShowWindow PostQuitMessage SetForegroundWindow EnumWindows FindWindowA GetClassNameA ShowOwnedPopups TrackPopupMenu CreatePopupMenu SetMenuInfo SetTimer KillTimer GetKeyState CallWindowProcA EnumChildWindows MoveWindow UpdateWindow SetFocus CharNextA LoadCursorA SetWindowPos ClientToScreen GetDlgItem SendMessageA GetCursorPos GetClassInfoExA SetCapture ReleaseCapture GetParent IsChild CreateAcceleratorTableA RedrawWindow GetWindowTextLengthA GetWindow GetWindowTextA SetWindowTextA GetDesktopWindow GetSysColor InvalidateRgn InvalidateRect ReleaseDC RegisterWindowMessageA GetDC RemovePropA EndPaint SetPropA BeginPaint FillRect GetFocus DestroyAcceleratorTable IsWindow GetClientRect ScreenToClient RegisterClassExA UnregisterClassA DrawTextW IsIconic GetScrollBarInfo CreateDialogIndirectParamA GetSystemMetrics GetForegroundWindow SystemParametersInfoA EnableWindow DialogBoxIndirectParamW GetWindowRect IsWindowEnabled EndDialog IsWindowVisible DialogBoxIndirectParamA GetPropA GetWindowTextLengthW GetWindowTextW PeekMessageA IsDialogMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects SetActiveWindow GetAsyncKeyState SetCursor FlashWindowEx GetCursor UnhookWindowsHookEx CallNextHookEx SetWindowsHookExA EnumThreadWindows GetClassInfoA AppendMenuA SetClassLongW SetWindowTextW MessageBoxA DialogBoxParamA DialogBoxParamW SendMessageW GetMenuItemInfoA SetDlgItemTextW SetDlgItemTextA DefWindowProcW CreateDialogParamW CreateDialogParamA CreateWindowExW SetMenuItemInfoW GetMenuItemInfoW InsertMenuItemW AppendMenuW MessageBoxW SetWindowLongW SetMenuItemInfoA GetWindowLongW CallWindowProcW RegisterClassW InsertMenuItemA UnregisterClassW SetClassLongA GetClassLongA BringWindowToTop GetActiveWindow MessageBeep

gdi32

GetTextExtentPoint32A GetTextExtentPoint32W GetTextMetricsA CreateDIBSection GetICMProfileA SetDIBits TextOutW ExtTextOutW TextOutA ExtTextOutA GetKerningPairsA SetBkMode GetGlyphOutlineW GetGlyphOutlineA CreateSolidBrush CreateCompatibleBitmap CreateCompatibleDC BitBlt DeleteDC GetObjectA GetDeviceCaps SelectObject DeleteObject CreateFontIndirectA GetStockObject

advapi32

RegQueryValueExW ReportEventA DeregisterEventSource CryptGenRandom RegQueryValueExA RegEnumValueW CryptDeriveKey CryptEncrypt CryptReleaseContext CryptDecrypt FreeSid CheckTokenMembership AllocateAndInitializeSid RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyA RegEnumValueA CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextA RegSetValueExW RegEnumKeyExW RegOpenKeyExW RegCreateKeyExW RegisterEventSourceA

shell32

ord2 ord4 ShellExecuteA SHGetMalloc SHGetPathFromIDListW SHGetPathFromIDListA Shell_NotifyIconW SHFileOperationA SHGetFileInfoA SHGetSpecialFolderPathA SHBrowseForFolderW DragQueryFileW ShellExecuteExA Shell_NotifyIconA DragQueryFileA SHFileOperationW SHGetFileInfoW SHGetSpecialFolderPathW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteExW SHBrowseForFolderA

ole32

FreePropVariantArray CoTaskMemFree CreateStreamOnHGlobal StringFromGUID2 CoCreateInstance PropVariantClear CoRegisterClassObject OleLockRunning CLSIDFromString CoTaskMemRealloc CoTaskMemAlloc CoGetClassObject CoUninitialize CLSIDFromProgID CoResumeClassObjects OleUninitialize OleInitialize CoInitializeEx

oleaut32

VarBstrFromDate SystemTimeToVariantTime VarBstrCat OleCreateFontIndirect LoadTypeLi LoadRegTypeLi VariantClear VariantInit VarUI4FromStr SysStringByteLen SysAllocStringLen SysStringLen SysAllocString VariantTimeToSystemTime SysFreeString

comctl32

CreatePropertySheetPageW PropertySheetA CreatePropertySheetPageA PropertySheetW InitCommonControlsEx

mscms

GetColorDirectoryA

shlwapi

SHDeleteValueA SHDeleteKeyA

urlmon

FindMimeFromData CoInternetGetSession

version

GetFileVersionInfoW VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoSizeW

ws2_32

htons htonl gethostbyname ntohl ntohs

comdlg32

GetSaveFileNameW GetOpenFileNameW GetSaveFileNameA GetOpenFileNameA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_1a2fb49e324575e12ebdcc6e4fd3b9a8_amadey_elex_floxif_poet-rat_remcos_smoke-loader_stop

PE Signature issue

mpr

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

mscms

shlwapi

urlmon

version

ws2_32

comdlg32

generic