2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop
Size 797KB
Sample261023-x9rpyade27
SHA256 878e77316ea676913e9e7293cddd0542a24dbd5306376cfaae56e8d325b81bd0
MD5 d173d0b880346867f07e773172bac9fa
SHA1 e0a0d17cfe25198366cc5a85f24c7f2a2a8f87da
SHA512 a60f82a770afefad4354685e19e051bc83b5e39127140841ffaff3832272e15c5b16d83151cbc4b52ca9334132f9dd56a04d30d10341c4f32e32f3561015d2dd
SSDEEP 12288:o6/QmQbHLnEiDwmAjtGs2YezJsdjkwy64sxxCvPvIoM/qc9T0E8YO:TQmQPAjtGvV4py+CvooM/79TN8F
TLSH
T1E2054A21FA83803AEDB3147D4C7D826A5465BD321B74C8C7B3C42E6E19F95D26A3172B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop

File Explorer

2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop

.exe 797KB

2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop

IMPHASH e32d3a19d25292c78c4af5927ae6cdf7
SHA256 878e77316ea676913e9e7293cddd0542a24dbd5306376cfaae56e8d325b81bd0
MD5 d173d0b880346867f07e773172bac9fa
SHA1 e0a0d17cfe25198366cc5a85f24c7f2a2a8f87da
SHA512 a60f82a770afefad4354685e19e051bc83b5e39127140841ffaff3832272e15c5b16d83151cbc4b52ca9334132f9dd56a04d30d10341c4f32e32f3561015d2dd
SSDEEP 12288:o6/QmQbHLnEiDwmAjtGs2YezJsdjkwy64sxxCvPvIoM/qc9T0E8YO:TQmQPAjtGvV4py+CvooM/79TN8F
TLSH
T1E2054A21FA83803AEDB3147D4C7D826A5465BD321B74C8C7B3C42E6E19F95D26A3172B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ee:90:74:d6:f1:71:3c:58:88:1d:4c:66:bf:cc:40:e1

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Seagull Scientific\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=BarTender Development,O=Seagull Scientific\, Inc,L=Bellevue,ST=Washington,C=US

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Seagull Scientific\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=BarTender Development,O=Seagull Scientific\, Inc,L=Bellevue,ST=Washington,C=US

Serial Number

70:72:6b:45:f0:fa:20:f4:55:dc:6d:30:aa:44:07:a4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 15, 2012 - Sep 14, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

426569

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\main\driver\bin\DriverWizard.pdb

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

psapi

GetModuleFileNameExA EnumProcesses EnumProcessModules

kernel32

TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GlobalFlags FindResourceExA GetCPInfo GetOEMCP GetFileSizeEx SetErrorMode RtlUnwind HeapFree HeapAlloc RemoveDirectoryA HeapReAlloc GetStartupInfoA VirtualAlloc ExitProcess SetStdHandle GetFileType GetFullPathNameA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsValidCodePage LCMapStringA GetStringTypeA GetStringTypeW HeapCreate VirtualFree SetHandleCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetDriveTypeA GetConsoleCP GetConsoleMode WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap CompareStringW SetEnvironmentVariableA GetVolumeInformationA DuplicateHandle UnlockFile LockFile FlushFileBuffers FreeResource GlobalGetAtomNameA GlobalFindAtomA lstrcmpW FileTimeToSystemTime FindNextFileA VirtualProtect GlobalAddAtomA GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA LoadLibraryExA CompareStringA lstrcmpA GlobalFree GlobalAlloc GlobalLock GlobalUnlock lstrlenA RaiseException InterlockedExchange MulDiv MultiByteToWideChar GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetVersionExW GetCurrentThreadId GetStdHandle SetCurrentDirectoryW GetCurrentDirectoryW GetModuleHandleW GetCurrentProcessId CreateProcessW GetModuleFileNameW LoadLibraryW GetTempPathW GetSystemDirectoryW SetFileTime SetFileAttributesW GetTempFileNameW CreateDirectoryW GetFileSize SetFilePointer WriteFile ReadFile SetEndOfFile CreateFileW LCMapStringW InterlockedDecrement InterlockedIncrement LocalFileTimeToFileTime DosDateTimeToFileTime FileTimeToLocalFileTime MoveFileExW CreateThread GetFileTime CompareFileTime GetCurrentDirectoryA GetDefaultCommConfigA GetACP DeviceIoControl CreateDirectoryA SetLastError OpenProcess GetProfileStringA WriteProfileStringA GetTimeFormatA WritePrivateProfileSectionA GetPrivateProfileSectionA CopyFileA GetTempPathA GetTempFileNameA GetTickCount WaitForSingleObject FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA GetWindowsDirectoryA GetSystemDirectoryA FormatMessageA LocalAlloc LocalFree GetModuleHandleA GetProcAddress Sleep WritePrivateProfileStringA GetPrivateProfileIntA GetPrivateProfileStringA CreateFileA CloseHandle GetModuleFileNameA GetLocaleInfoA LoadLibraryA GetCommandLineA FreeLibrary DeleteFileA WideCharToMultiByte LoadResource LockResource SizeofResource FindResourceA GetVersionExA GetCurrentProcess GetLastError MoveFileExA HeapSize

user32

LoadCursorA GetSysColorBrush InvalidateRect DrawFocusRect EndPaint BeginPaint ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA FillRect CharUpperA CreateDialogIndirectParamA GetNextDlgTabItem EndDialog RegisterWindowMessageA LoadIconA WinHelpA GetClassLongA GetClassNameA GetForegroundWindow GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx ScreenToClient CopyRect PtInRect DefWindowProcA CallWindowProcA GetMenu SystemParametersInfoA GetWindowPlacement GetWindowTextLengthA GetWindowTextA MoveWindow SetWindowLongA GetDlgCtrlID IsWindow SetWindowTextA IsDialogMessageA IsDlgButtonChecked SetDlgItemTextA SendDlgItemMessageA CheckRadioButton CheckDlgButton SetPropA GetCapture SetActiveWindow MapDialogRect SetWindowPos ShowWindow GetPropA RemovePropA SetFocus GetDlgItem GetWindowThreadProcessId GetWindowLongA GetLastActivePopup IsWindowEnabled SetCursor SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions GetFocus ModifyMenuA EnableMenuItem CheckMenuItem PostQuitMessage GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetSystemMetrics wvsprintfW wvsprintfA GetAsyncKeyState GetClientRect ReleaseDC GetWindowDC GetDC GetWindowRect DestroyMenu UnregisterClassA LoadBitmapA PostMessageA IsIconic GetParent SendNotifyMessageA EnableWindow GetWindow SendMessageA ExitWindowsEx GetDesktopWindow MessageBoxA

gdi32

RestoreDC SaveDC DPtoLP DeleteObject EnumFontFamiliesExA GetTextMetricsA CreateSolidBrush GetStockObject CreateCompatibleDC DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape TextOutA RectVisible PtVisible BitBlt SetTextColor GetClipBox CreateBitmap GetTextExtentPoint32A GetDeviceCaps SetMapMode CreateFontIndirectA ExtTextOutA GetObjectA SetBkColor

comdlg32

GetFileTitleA

winspool.drv

EnumPrinterDriversA ClosePrinter OpenPrinterA AddPortA EnumMonitorsA GetPrinterA ord201 EnumPrintersA DeletePrinter DeletePrinterConnectionA SetJobA EnumJobsA DeletePrinterDriverA SetPrinterA DocumentPropertiesA DocumentPropertiesW EnumPortsA ord202 GetPrinterDriverDirectoryA ConfigurePortA AddPrinterA GetPrintProcessorDirectoryA

advapi32

QueryServiceStatus RegQueryValueA ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventW RegisterEventSourceW DeregisterEventSource RegQueryValueExW RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegOpenKeyA RegEnumKeyA EnumServicesStatusA OpenServiceA OpenSCManagerA QueryServiceConfigA DeleteService AdjustTokenPrivileges ControlService StartServiceA CloseServiceHandle GetExplicitEntriesFromAclA EqualSid SetEntriesInAclA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegSetKeySecurity GetAclInformation RegGetKeySecurity GetSecurityDescriptorDacl RegDeleteValueA RegSetValueExA RegQueryValueExA RegEnumValueA RegEnumKeyExA RegDeleteKeyA RegCloseKey RegCreateKeyExA RegOpenKeyExA AllocateAndInitializeSid FreeSid OpenProcessToken LookupPrivilegeValueA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHChangeNotify ShellExecuteExA ord155 ShellExecuteA SHGetFolderLocation

comctl32

ord17

shlwapi

PathFindExtensionA PathStripToRootA PathIsUNCA PathFindFileNameA

oleaut32

VariantClear VariantChangeType VariantInit SysAllocStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop

PE Signature issue

version

psapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oleaut32

generic