2026-09-21_89ea73e5dbf6a1fe9cfaca0dad93d82b_amadey_elex_emotet_floxif_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_89ea73e5dbf6a1fe9cfaca0dad93d82b_amadey_elex_emotet_floxif_smoke-loader_stop
Size 49.4MB
Sample260922-nyv4jsde55
SHA256 6e96e0828c40d921cc47ab7955ef747f574c0bb874c3aeafb87f040821240cd3
MD5 89ea73e5dbf6a1fe9cfaca0dad93d82b
SHA1 937eee88cf24b0e61f663058f7efe9dcdb2c2324
SHA512 f2fd4463e8e69e5624c87afba5a3c255f88c30a7cabbf739a67d17fcccf5c2ec8d8648a4770975b8c3a1378878dd94e4098a439280ce5aad05eb33ce6645051a
SSDEEP 786432:FAwAci9olqc+j8POuVlVxn3PF2YzkmpWyF6hmdM3Iv7mlYfnisuOybeO:yH9Wqc+jcOuxxndzkfyF6QQImthOybZ
TLSH
T17FB73312B6FAC0B9D2EB04318A6997B541F5BA158F3148C77BD0BE2E1F315D4C239B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-21_89ea73e5dbf6a1fe9cfaca0dad93d82b_amadey_elex_emotet_floxif_smoke-loader_stop

File Explorer

2026-09-21_89ea73e5dbf6a1fe9cfaca0dad93d82b_amadey_elex_emotet_floxif_smoke-loader_stop

.exe 49.4MB

2026-09-21_89ea73e5dbf6a1fe9cfaca0dad93d82b_amadey_elex_emotet_floxif_smoke-loader_stop

IMPHASH 68d4cecb957e7e01d7bde9827cb207fe
SHA256 6e96e0828c40d921cc47ab7955ef747f574c0bb874c3aeafb87f040821240cd3
MD5 89ea73e5dbf6a1fe9cfaca0dad93d82b
SHA1 937eee88cf24b0e61f663058f7efe9dcdb2c2324
SHA512 f2fd4463e8e69e5624c87afba5a3c255f88c30a7cabbf739a67d17fcccf5c2ec8d8648a4770975b8c3a1378878dd94e4098a439280ce5aad05eb33ce6645051a
SSDEEP 786432:FAwAci9olqc+j8POuVlVxn3PF2YzkmpWyF6hmdM3Iv7mlYfnisuOybeO:yH9Wqc+jcOuxxndzkfyF6QQImthOybZ
TLSH
T17FB73312B6FAC0B9D2EB04318A6997B541F5BA158F3148C77BD0BE2E1F315D4C239B1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a3:8b:64:3a:da:f8:5f:77:d1:bf:8f:46:61:89:35:e2:0a:0c:a2:f6:ca:eb:00:a1:53:3b:e0:5c:94:b9:13:cd

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Chains

Sep 29, 2016

CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

fb:bf:05:3a:1f:4e:27:a9:03:3f:3a:82:78:51:cd:1e:44:62:f5:71

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Chains

Sep 29, 2016

CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Serial Number

26:18:1c:ed:f2:c1:13:e1:6a:c7:48:20:df:7a:38:a3

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jan 27, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Apr 11, 2027

Minor OS version

Major OS version

Entry point

198968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\ClearCase_View\EDM_Phase2\AdminDeployment_WIN\Source\AdminDeploymentTool\release\Inst.pdb

mpr

WNetAddConnection3W

kernel32

lstrlenA GetThreadLocale SetFilePointer FlushFileBuffers LockFile UnlockFile DuplicateHandle GetVolumeInformationW GetFullPathNameW SetErrorMode GetTickCount FileTimeToLocalFileTime HeapFree HeapAlloc GetProcessHeap GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime RtlUnwind ExitProcess HeapReAlloc RaiseException HeapSize VirtualProtect GetSystemInfo VirtualQuery GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode GetTimeZoneInformation GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags GetModuleHandleA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GetCurrentProcessId SetLastError GlobalAddAtomW GlobalUnlock MulDiv WritePrivateProfileStringW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange GlobalLock lstrcmpW GetModuleHandleW lstrlenW OutputDebugStringW DosDateTimeToFileTime CreateDirectoryW MultiByteToWideChar FileTimeToSystemTime LocalFileTimeToFileTime SetFileTime GetFileAttributesW GetCurrentProcess InterlockedDecrement GetExitCodeProcess CreateProcessW GetFileTime MoveFileExW RemoveDirectoryW DeleteFileW SetFileAttributesW FreeResource GlobalAlloc GlobalFree FindClose FindNextFileW FindFirstFileW ReadFile GetFileSize EndUpdateResourceW GetSystemTime GetTimeFormatW WideCharToMultiByte SetEndOfFile LocalFree FormatMessageW SetStdHandle GetStdHandle GetTempFileNameW GetTempPathW WriteFile WaitNamedPipeW GetLastError CreateFileW CloseHandle WaitForSingleObject GetModuleFileNameW GetProcAddress LoadLibraryW FindResourceW LoadResource LockResource SizeofResource FreeLibrary VirtualAlloc

user32

MessageBeep GetNextDlgGroupItem InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW CharNextW ReleaseCapture LoadCursorW SetCapture ShowWindow MoveWindow SetWindowTextW IsDialogMessageW DestroyMenu EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetDesktopWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow UpdateWindow GetMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx EqualRect CopyRect UnregisterClassA IsIconic SendMessageW GetSystemMetrics GetClientRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement UnhookWindowsHookEx GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled SetCursor GetMenuItemID GetMenuItemCount GetSubMenu PostThreadMessageW RegisterClipboardFormatW GetWindow UnregisterClassW CharUpperW SetActiveWindow DrawIcon GetWindowRect LoadBitmapW GetSysColorBrush LoadIconW EnableWindow IsWindow PostMessageW MessageBoxW PostQuitMessage CheckMenuItem EnableMenuItem GetMenuState ModifyMenuW GetParent GetFocus GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageW GetKeyState IsWindowVisible GetActiveWindow DispatchMessageW TranslateMessage GetMessageW CallNextHookEx SetWindowsHookExW SetWindowPos MapDialogRect SetWindowContextHelpId RegisterWindowMessageW

gdi32

GetStockObject CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx GetClipBox GetDeviceCaps CreateBitmap Escape ExtTextOutW TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode SetBkMode RestoreDC SaveDC GetObjectW SetBkColor SetTextColor SelectObject

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW XcvDataW OpenPrinterW

advapi32

RegQueryValueW RegOpenKeyW RegDeleteKeyW RegSetValueExW RegEnumKeyW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey

shell32

SHGetPathFromIDListW ShellExecuteExW SHCreateDirectoryExW SHBrowseForFolderW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW PathFindFileNameW PathIsDirectoryW PathIsDirectoryEmptyW PathFindExtensionW PathStripToRootW PathIsUNCW

oledlg

OleUIBusyW

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CoTaskMemAlloc CoTaskMemFree CLSIDFromProgID CoCreateInstance CoInitializeEx CLSIDFromString CoUninitialize CoInitialize OleUninitialize CoFreeUnusedLibraries OleInitialize CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject

oleaut32

VariantClear SysAllocString SysStringLen SysAllocStringLen VariantChangeType VariantInit VariantCopy SysFreeString SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_89ea73e5dbf6a1fe9cfaca0dad93d82b_amadey_elex_emotet_floxif_smoke-loader_stop

PE Signature issue

PE Signature issue

mpr

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic