2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop
Size 3.5MB
Sample260930-ffls6at12p
SHA256 31e8d34b79eed0939f0546a0f6db94e15e55e8dd021a3def8eae070856eb6170
MD5 1bb2143d955b35d8065eb0595cced5c2
SHA1 eacddfbace1dd26365e0d8e0cd8dc302277f2162
SHA512 f79cfbd6fd7c1212da317d54231d258acb7fd6bed8500987cc74e46a35131122668daa92467af944aabd739a5b731690f0d5012fd9473e2815d88db6f961fad3
SSDEEP 49152:76ps/Yps/RmQvepE+k71FCZKbEi1U25gmQvepE+k71FCZKbEi1U25Orrp:gqeqTWpZkBFZ7mWpZkBFZ7OHp
TLSH
T15E069D85F7D2607DD942017A4461CF3A8E22BC6A47B50AEBB3DCB7295F70AC04E37685
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop

File Explorer

2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop

.exe 3.5MB

2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop

IMPHASH f260242f04250571023d9a80a1c5a005
SHA256 31e8d34b79eed0939f0546a0f6db94e15e55e8dd021a3def8eae070856eb6170
MD5 1bb2143d955b35d8065eb0595cced5c2
SHA1 eacddfbace1dd26365e0d8e0cd8dc302277f2162
SHA512 f79cfbd6fd7c1212da317d54231d258acb7fd6bed8500987cc74e46a35131122668daa92467af944aabd739a5b731690f0d5012fd9473e2815d88db6f961fad3
SSDEEP 49152:76ps/Yps/RmQvepE+k71FCZKbEi1U25gmQvepE+k71FCZKbEi1U25Orrp:gqeqTWpZkBFZ7mWpZkBFZ7OHp
TLSH
T15E069D85F7D2607DD942017A4461CF3A8E22BC6A47B50AEBB3DCB7295F70AC04E37685
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

65:a8:df:b3:c7:1c:b3:bd:5d:55:ba:9f:1f:98:1f:01:ba:45:ed:75:32:ed:27:fd:52:ea:07:3c:fe:df:6e:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WDKTestCert PC-03\,134285756662049522

Chains

Sep 25, 2026

CN=WDKTestCert PC-03\,134285756662049522

Minor OS version

Major OS version

Entry point

18719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetNativeSystemInfo GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource GlobalAlloc GlobalUnlock GlobalLock GlobalFree LocalAlloc LocalFree lstrcmpiA lstrcpynA lstrcatA lstrlenA FindResourceA GetPrivateProfileSectionA CopyFileA CompareStringA GetWindowsDirectoryA CreateFileW SetFilePointerEx CreateProcessA GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW VirtualProtect ReadFile FlsFree FlsSetValue FlsGetValue GetSystemDirectoryA WriteConsoleW GetLocalTime FlsAlloc FindNextFileA FindFirstFileA FindClose DeleteFileA CreateFileA CreateDirectoryA GetCurrentProcess WaitForSingleObject DeviceIoControl GetLastError CloseHandle WriteFile SetFileAttributesA GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP DecodePointer IsValidCodePage FindNextFileW FindFirstFileExW HeapFree HeapAlloc GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle RaiseException EncodePointer LoadLibraryExW InitializeCriticalSectionEx GetEnvironmentVariableA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary

user32

SetClipboardData DialogBoxParamA EndDialog GetDlgItem SetDlgItemTextA wvsprintfA wsprintfA CheckDlgButton SetWindowLongA GetWindowLongA MessageBoxA GetWindowTextLengthA GetWindowTextA EnableWindow EmptyClipboard IsDlgButtonChecked CloseClipboard OpenClipboard SendDlgItemMessageA SendMessageA

gdi32

CreateFontA DeleteObject

shell32

ShellExecuteExA

advapi32

GetTokenInformation RegQueryValueExA RegOpenKeyExA RegCloseKey OpenProcessToken

crypt32

CertAddCertificateContextToStore CertFreeCertificateContext CertCreateCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CertDeleteCertificateFromStore

bcrypt

BCryptSetProperty BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptCloseAlgorithmProvider

setupapi

SetupCopyOEMInfA SetupDiInstallClassA SetupUninstallOEMInfA SetupDiOpenDeviceInfoA CM_Get_Next_Res_Des CM_Locate_DevNodeA CM_Get_Res_Des_Data_Size CM_Get_Res_Des_Data CM_Get_Parent CM_Get_First_Log_Conf CM_Get_DevNode_Status CM_Free_Res_Des_Handle SetupDiGetDeviceRegistryPropertyA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdA

newdev

UpdateDriverForPlugAndPlayDevicesA

shlwapi

StrStrIA

comctl32

InitCommonControlsEx

Name

.text

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

crypt32

bcrypt

setupapi

newdev

shlwapi

comctl32

generic