2026-10-22_a50b500a0aa8cb11b9df2b069fbc17dc_amadey_elex_emotet_floxif_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_a50b500a0aa8cb11b9df2b069fbc17dc_amadey_elex_emotet_floxif_smoke-loader_stop
Size 813KB
Sample261024-ceefxae18s
SHA256 d58434763b3f7555fca0689fbdd569d81a9f74d624544f10f94ef2a4e9e42bb0
MD5 a50b500a0aa8cb11b9df2b069fbc17dc
SHA1 c93ce14c72012af1ebe635b69048b4a616bf1ad3
SHA512 903db9015a9b2058bcf531a4f6d597c25d1004b3ceb37653f864cd0f83d38c577f758bab6f94ebe8f56b753b71644b962e8ce68971b9f06f09c3715e9158df34
SSDEEP 24576:6sEj0ZcOnqW/pfmHfbW+CyQb23lfTMoARGvRYZcrEH7A:61q5f4W+ZrTMLkWk
TLSH
T16305AD2277C1C176D17322309ADAD3346AFAFC794D36830B67D41A6D2E7C6D28E19326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-22_a50b500a0aa8cb11b9df2b069fbc17dc_amadey_elex_emotet_floxif_smoke-loader_stop

File Explorer

2026-10-22_a50b500a0aa8cb11b9df2b069fbc17dc_amadey_elex_emotet_floxif_smoke-loader_stop

.exe 813KB

2026-10-22_a50b500a0aa8cb11b9df2b069fbc17dc_amadey_elex_emotet_floxif_smoke-loader_stop

IMPHASH 7e04d2988ad5efac70eaafbc90135fc5
SHA256 d58434763b3f7555fca0689fbdd569d81a9f74d624544f10f94ef2a4e9e42bb0
MD5 a50b500a0aa8cb11b9df2b069fbc17dc
SHA1 c93ce14c72012af1ebe635b69048b4a616bf1ad3
SHA512 903db9015a9b2058bcf531a4f6d597c25d1004b3ceb37653f864cd0f83d38c577f758bab6f94ebe8f56b753b71644b962e8ce68971b9f06f09c3715e9158df34
SSDEEP 24576:6sEj0ZcOnqW/pfmHfbW+CyQb23lfTMoARGvRYZcrEH7A:61q5f4W+ZrTMLkWk
TLSH
T16305AD2277C1C176D17322309ADAD3346AFAFC794D36830B67D41A6D2E7C6D28E19326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

06:c8:1e:d9:be:bd:a7:02:c6:97:f3:f9:5a:9b:4e:7b:6f:a4:d9:76

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Symantec Corporation,OU=Endpoint Management Group,O=Symantec Corporation,L=Lindon,ST=Utah,C=US

Chains

Jan 19, 2016

CN=Symantec Corporation,OU=Endpoint Management Group,O=Symantec Corporation,L=Lindon,ST=Utah,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Corporation,OU=Endpoint Management Group,O=Symantec Corporation,L=Lindon,ST=Utah,C=US

Serial Number

29:95:cc:1b:5c:60:5d:c3:fe:19:48:03:ec:65:0d:a9

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 6, 2015 - Oct 18, 2016

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Minor OS version

Major OS version

Entry point

389203

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\depotCI\Ghost\GSSTrunk\Ghost\ghost\src\GhostSrv\vs2008\Win32\Release\GhostSrv.pdb

ws2_32

getprotobyname ntohl inet_ntoa inet_addr connect shutdown getservbyname WSAIoctl ioctlsocket WSACleanup WSAStartup getsockopt WSARecv WSARecvFrom WSAWaitForMultipleEvents WSASendTo getsockname listen WSASocketA socket bind accept recv recvfrom send sendto setsockopt gethostbyname WSAGetLastError gethostname WSACloseEvent htons WSASetLastError htonl WSACreateEvent WSASend WSAEventSelect WSAAddressToStringA WSAEnumNetworkEvents closesocket ntohs getservbyport

imm32

ImmAssociateContext

kernel32

FindResourceExA CreateEventW OutputDebugStringA GetVersionExW GlobalMemoryStatus QueryPerformanceCounter GetProcessTimes GetProcessWorkingSetSize GetThreadTimes GetStdHandle VirtualQuery VirtualFree VirtualAlloc GetSystemInfo GetStringTypeA TerminateProcess IsValidCodePage IsDBCSLeadByteEx GetTempFileNameW GetTempPathW DeleteFileW RtlUnwind VirtualProtect GetSystemTimeAsFileTime GetCommandLineA GetStartupInfoA SetUnhandledExceptionFilter GetConsoleCP GetConsoleMode UnhandledExceptionFilter GetACP SetHandleCount GetFileType LCMapStringA LCMapStringW GetStringTypeW GetTimeZoneInformation SetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale HeapAlloc GetLocaleInfoW CompareStringW SetEnvironmentVariableA GetCurrentDirectoryW GetFileAttributesW CreateProcessW GetExitCodeProcess DebugBreak LoadLibraryW Sleep IsDebuggerPresent CreateThread CreateFileW SetErrorMode GetFileSizeEx LocalFileTimeToFileTime GetFileAttributesExA FileTimeToLocalFileTime SystemTimeToFileTime FileTimeToSystemTime CreateFileA GetShortPathNameA GetVolumeInformationA FindFirstFileA FindClose GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale GetStringTypeExA MoveFileA InitializeCriticalSectionAndSpinCount GetThreadContext FindResourceW VirtualProtectEx GetLocalTime GetOEMCP GetCPInfo GlobalFlags GetModuleHandleW TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GetDiskFreeSpaceA GetTempFileNameA GetFileTime SetFileTime GetPrivateProfileStringA WritePrivateProfileStringA GetPrivateProfileIntA CreateEventA SuspendThread SetEvent SetThreadPriority GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA InterlockedExchange lstrcmpA FreeResource GetCurrentThreadId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom CompareStringA lstrcmpW GlobalFree MulDiv SetLastError GetProcessHeap HeapFree lstrcpyA GetFileAttributesA ExpandEnvironmentStringsA GetCurrentProcess DuplicateHandle CreatePipe CloseHandle GetFullPathNameA GetExitCodeThread WaitForSingleObject FormatMessageA CreateDirectoryA DeleteFileA ResumeThread LocalFree ExitProcess GetLocaleInfoA GetTickCount LoadLibraryA SetCurrentDirectoryA GetUserDefaultLangID GetModuleFileNameW GetVersionExA GetCurrentDirectoryA LockResource GlobalLock GlobalUnlock GlobalAlloc GetModuleFileNameA LoadLibraryExA FindResourceA LoadResource SizeofResource FreeLibrary GetCurrentProcessId IsDBCSLeadByte lstrcmpiA lstrlenA GetModuleHandleA GetProcAddress InterlockedDecrement InterlockedIncrement GetLastError lstrlenW WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InitializeCriticalSection RaiseException FormatMessageW ResetEvent ExitThread

user32

LoadCursorA SetCapture SetWindowRgn DrawIcon EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA FillRect GetMenuItemInfoA InflateRect UnpackDDElParam ReuseDDElParam DestroyMenu ReleaseCapture LoadAcceleratorsA InvalidateRect InsertMenuItemA CreatePopupMenu SetRectEmpty BringWindowToTop TranslateAcceleratorA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA GetWindowThreadProcessId IsWindowEnabled ShowOwnedPopups SetCursor GetMessageA TranslateMessage GetActiveWindow GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA CheckMenuItem RegisterWindowMessageA WinHelpA IsChild GetCapture SetWindowsHookExA CallNextHookEx GetNextDlgTabItem GetClassNameA SetPropA RemovePropA IsWindow SetFocus GetWindowTextLengthA GetWindowTextA GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageA BeginDeferWindowPos EndDeferWindowPos GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageA MapWindowPoints ScrollWindow TrackPopupMenu GetKeyState SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar IsWindowVisible GetClientRect CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement CopyRect GetDlgCtrlID DefWindowProcA CallWindowProcA PtInRect GetMenu GetWindowLongA SetWindowLongA SetWindowPos OffsetRect IntersectRect SystemParametersInfoA CreateDialogIndirectParamA IsZoomed GetSysColorBrush UnregisterClassA DeleteMenu DestroyIcon CharUpperA SetRect WindowFromPoint IsIconic GetWindowPlacement GetSystemMetrics GetWindow GetOpenClipboardWindow GetClipboardOwner GetClipboardViewer GetCaretPos GetInputState GetQueueStatus GetClassLongA GetProcessWindowStation GetMenuState GetMenuStringA GetMenuItemID InsertMenuA GetMenuItemCount GetSubMenu wsprintfA EndDialog LoadIconA SendDlgItemMessageA SetDlgItemTextA GetDlgItem MessageBoxA DialogBoxParamA LoadStringA PostQuitMessage OemToCharBuffA CharToOemBuffA SendMessageA EnableWindow GetParent GetFocus KillTimer SetTimer ReleaseDC GetDC GetWindowRect GetSystemMenu EnableMenuItem GetDesktopWindow PostMessageA UpdateWindow GetClipboardData CharNextExA EmptyClipboard CloseClipboard SetClipboardData OpenClipboard CharNextA GetPropA LoadMenuA

gdi32

GetBkColor GetPixel PtVisible GetTextMetricsA Ellipse LPtoDP CreateEllipticRgn CreateSolidBrush CreatePatternBrush DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape TextOutA CreateFontIndirectA GetTextExtentPoint32A GetStockObject SelectObject IntersectClipRect ExcludeClipRect SetMapMode SetBkMode RestoreDC SaveDC ExtTextOutA BitBlt CreateCompatibleDC CreateCompatibleBitmap CreateBitmap SetBkColor SetTextColor GetClipBox GetDeviceCaps DeleteObject GetObjectA RectVisible

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

QueryServiceConfigW RegNotifyChangeKeyValue SetServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle RegQueryInfoKeyW RegCreateKeyExW RegSetValueExW RegCreateKeyA GetFileSecurityA SetFileSecurityA RegQueryValueA RegOpenKeyA RegEnumKeyA RegSetValueA RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA

shell32

FindExecutableA DragFinish DragQueryFileA ExtractIconA SHGetFileInfoA ShellExecuteA

shlwapi

PathFindExtensionA PathIsUNCA PathStripToRootA PathRemoveFileSpecW PathFindFileNameA

ole32

CoInitialize OleRun CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc

oleaut32

SysFreeString GetActiveObject VarUI4FromStr VariantClear SysAllocString GetErrorInfo VariantChangeType VariantInit SysAllocStringLen

dbghelp

SymGetModuleInfo SymFromAddr SymInitialize SymCleanup SymGetLineFromAddr SymLoadModule SymSetOptions SymGetModuleBase SymFunctionTableAccess SymSetContext SymEnumSymbols StackWalk SymGetTypeInfo MiniDumpWriteDump

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

netapi32

Netbios

secur32

DeleteSecurityContext FreeCredentialsHandle QueryContextAttributesA AcquireCredentialsHandleA InitializeSecurityContextW CompleteAuthToken DecryptMessage EncryptMessage

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_a50b500a0aa8cb11b9df2b069fbc17dc_amadey_elex_emotet_floxif_smoke-loader_stop

PE Signature issue

ws2_32

imm32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

dbghelp

version

netapi32

secur32

generic