2026-11-07_092f9f6c174c15c43b7c7889c4ad59a6_amadey_emotet_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_092f9f6c174c15c43b7c7889c4ad59a6_amadey_emotet_smoke-loader_stop
Size 8.8MB
Sample261107-vsvddsev4n
SHA256 dc066f5bcc299e53ccaf1668e876340fd3c0718b462bdfcdbd5d74e84d053e3c
MD5 092f9f6c174c15c43b7c7889c4ad59a6
SHA1 c91209c26f4b76451c13d77212fd4929dc9bef05
SHA512 8143fd9d74ed148160e17409099ba0cb1535d64df4337915d3dc9774ba06522e168251f2ad462445d3aab796ea05bf4e765beb4311ac98c65bf5dda47e5c35b8
SSDEEP 49152:ZVFstTTv2wpthffyKoDbHmJ17T55btdyoeFwlGfzaxUtaS3xDgJhtBYz58RNSRv1:VOuoi6VeFwlGfTtagxDgJhtBlRqQimw
TLSH
T122960D16E2F9425FFAF3ABF0E9B483754D767C56AB3481CE2B1431690931F908868727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-07_092f9f6c174c15c43b7c7889c4ad59a6_amadey_emotet_smoke-loader_stop

.exe 8.8MB

2026-11-07_092f9f6c174c15c43b7c7889c4ad59a6_amadey_emotet_smoke-loader_stop

IMPHASH 4fba823d47f71807d6171d2a1f756f55
SHA256 dc066f5bcc299e53ccaf1668e876340fd3c0718b462bdfcdbd5d74e84d053e3c
MD5 092f9f6c174c15c43b7c7889c4ad59a6
SHA1 c91209c26f4b76451c13d77212fd4929dc9bef05
SHA512 8143fd9d74ed148160e17409099ba0cb1535d64df4337915d3dc9774ba06522e168251f2ad462445d3aab796ea05bf4e765beb4311ac98c65bf5dda47e5c35b8
SSDEEP 49152:ZVFstTTv2wpthffyKoDbHmJ17T55btdyoeFwlGfzaxUtaS3xDgJhtBYz58RNSRv1:VOuoi6VeFwlGfTtagxDgJhtBlRqQimw
TLSH
T122960D16E2F9425FFAF3ABF0E9B483754D767C56AB3481CE2B1431690931F908868727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Digest

9e:0a:b7:ef:28:d0:3e:41:e8:df:f5:c5:85:67:fe:f4:eb:99:15:f0:e7:83:65:36:f8:74:6d:79:53:ac:b6:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 9, 2017

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

99:17:17:b7:22:b8:e8:ea:15:84:5c:be:dd:1a:c1:7e:e4:cb:e9:c7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,POSTALCODE=300,STREET=No. 2\, Innovation Road II\, Hsinchu Science Park,L=Hsinchu,ST=Taiwan,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 7, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

Serial Number

03:20:be:3e:b8:66:52:69:27:f9:99:b9:7b:04:34:6e

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 13, 2016 - Jan 24, 2019

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2f:68:b2:be:77:b6:b3:5e:cc:00:00:00:00:00:2f

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 12, 2016 - May 12, 2017

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b4:43:3a:1c:fe:b6:ba:52:89:00:00:00:00:00:b4

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

Major OS version

Entry point

1431312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\chunyung.RTDOMAIN\Documents\Visual Studio 2005\Projects\RtkNGui\x64\release\RtkNGUI64.pdb

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeGetTime mmioClose mmioOpenW mmioDescend mmioAscend mmioSeek mmioRead mciSendStringW mmioCreateChunk mmioWrite mmioSetInfo mmioAdvance mmioGetInfo

imm32

ImmDisableIME

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceInstanceIdW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

dsound

ord3 ord1 ord6

rpcrt4

RpcStringFreeW UuidToStringW

bcrypt

BCryptImportKeyPair BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptEncrypt BCryptOpenAlgorithmProvider

pdh

PdhCloseQuery PdhGetFormattedCounterValue PdhCollectQueryData PdhAddCounterW PdhOpenQueryW

kernel32

AllocConsole GetStdHandle FreeConsole WriteConsoleW SystemTimeToFileTime CompareFileTime GetPrivateProfileStringW GetFileSize GetPrivateProfileIntW DeviceIoControl ResumeThread DuplicateHandle HeapFree GetProcessHeap GetSystemDirectoryA ResetEvent GetTempPathW DeleteFileW GetSystemPowerStatus HeapAlloc ReleaseMutex OpenFileMappingW MapViewOfFile UnmapViewOfFile CreateDirectoryW OpenMutexW IsBadReadPtr GetSystemInfo RaiseException lstrcmpA GetVersionExA lstrcmpW CompareStringW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW CompareStringA GetLocaleInfoW EnumResourceLanguagesW ConvertDefaultLocale GetCurrentThread GetTimeZoneInformation SetThreadPriority SuspendThread GetCurrentProcessId GetThreadLocale ReadFile SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile GetVolumeInformationW GetFullPathNameW FileTimeToSystemTime FileTimeToLocalFileTime TlsGetValue TlsAlloc GlobalHandle TlsSetValue LocalReAlloc TlsFree GlobalFlags SetErrorMode GetFileTime GetStartupInfoW RtlPcToFileHeader VirtualProtect VirtualAlloc VirtualQuery HeapReAlloc GetSystemTimeAsFileTime ExitThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx ExitProcess HeapSize SetStdHandle GetFileType GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetStartupInfoA FlsGetValue FlsSetValue FlsAlloc HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetConsoleCP GetConsoleMode RtlVirtualUnwind GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW WriteConsoleA GetConsoleOutputCP GetStringTypeA GetStringTypeW GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA CreateFileA SetEnvironmentVariableA GetWindowsDirectoryW Process32NextW Process32FirstW CreateToolhelp32Snapshot SetThreadExecutionState GetFileAttributesW WaitForMultipleObjects GetExitCodeThread GetModuleHandleA WriteFile CreateFileW Sleep LoadLibraryA GetSystemDirectoryW SearchPathW GetUserDefaultUILanguage FindResourceExW MulDiv FreeLibrary TerminateThread CreateThread CreateEventW GetCPInfo FreeResource lstrlenA lstrcmpiW GetVersionExW GetVersion GetTickCount FormatMessageW SetEvent GetModuleHandleW SetLastError lstrcpynW WideCharToMultiByte lstrlenW GlobalFree GlobalReAlloc GlobalUnlock GlobalLock GlobalAlloc WaitForSingleObject CreateProcessW GetCurrentProcess IsWow64Process SetThreadUILanguage GetCurrentThreadId GetUserGeoID MultiByteToWideChar FindClose FindNextFileW FindFirstFileW GetProcAddress LoadLibraryW CloseHandle GetLastError CreateMutexW LocalFree LocalAlloc InitializeCriticalSection OutputDebugStringW FindResourceW LeaveCriticalSection LoadResource LockResource GetLocalTime SizeofResource GetModuleFileNameW EnterCriticalSection DeleteCriticalSection FlsFree GetSystemTime WritePrivateProfileStringW

user32

GetLastActivePopup GetWindowTextW GetWindowTextLengthW SetFocus RemovePropW GetPropW SetPropW GetClassLongPtrW GetCapture WinHelpW SendDlgItemMessageW SendDlgItemMessageA IsDialogMessageW MoveWindow IsWindowEnabled ClientToScreen BeginPaint EndPaint CheckMenuItem EnableMenuItem GetMenuCheckMarkDimensions SetMenuItemBitmaps GetActiveWindow GetMessageW CharUpperW EndDialog GetNextDlgTabItem CreateDialogIndirectParamW WindowFromPoint DestroyMenu UnregisterClassW GetDlgItem GetTopWindow DestroyWindow GetMessageTime MapWindowPoints TrackPopupMenuEx TrackPopupMenu GetKeyState GetScrollRange GetScrollPos GetMenu CreateWindowExW GetClassInfoExW RegisterClassW UnregisterClassA SetScrollInfo DefWindowProcW SystemParametersInfoA IsIconic GetWindowPlacement GetMenuStringW FindWindowW UnregisterDeviceNotification RegisterDeviceNotificationW UnhookWindowsHookEx GetMonitorInfoW MonitorFromWindow GetShellWindow ExitWindowsEx RegisterWindowMessageW GetClassInfoW SetMenuDefaultItem SetWindowTextW LoadIconW IsWindow DrawTextW CreatePopupMenu DrawEdge TabbedTextOutW CreateMenu GetSubMenu ModifyMenuW DeleteMenu GetMenuItemInfoW GetMenuItemID InsertMenuW GetMenuItemCount GetMenuState DestroyIcon DrawIconEx GrayStringW LoadBitmapW DrawTextExW UpdateLayeredWindow LoadImageW DestroyCursor SetClassLongW GetClassLongW TranslateAcceleratorW GetSysColorBrush GetScrollInfo CallWindowProcW GetWindowLongPtrW SetWindowLongPtrW GetCursorPos SetTimer KillTimer GetClassNameW GetDlgCtrlID SetWindowLongW ValidateRect ScreenToClient AppendMenuW FillRect SystemParametersInfoW EqualRect GetComboBoxInfo SetCursor LoadCursorW IntersectRect ReleaseDC GetDC PtInRect InflateRect GetMessagePos SetRect SetRectEmpty ReleaseCapture FrameRect IsRectEmpty SetCapture DispatchMessageW TranslateMessage PostQuitMessage PeekMessageW SetForegroundWindow SetWindowPos AttachThreadInput GetWindowThreadProcessId ShowWindow GetWindowLongW SetWindowRgn GetWindowRgn LockWindowUpdate SetParent GetAncestor IsWindowVisible GetDesktopWindow CallNextHookEx MessageBoxW GetForegroundWindow SetWindowsHookExW OffsetRect SetActiveWindow UnionRect ChildWindowFromPointEx WindowFromDC ShowScrollBar SetScrollPos SetScrollRange CopyRect GetSystemMetrics GetParent GetWindow GetWindowRect RedrawWindow PostMessageW FindWindowExW SetProcessDPIAware UpdateWindow SendMessageW InvalidateRect SetCaretPos GetCaretPos EnableWindow GetClientRect GetSysColor GetFocus SetClassLongPtrW AdjustWindowRectEx

gdi32

RectVisible GetBkMode PtVisible Ellipse TextOutW GetPixel SetPixel CreateFontW EnumFontFamiliesExW GetClipBox SetTextColor SetBkColor SaveDC RestoreDC SetBkMode Escape SetWindowExtEx ScaleWindowExtEx GetDeviceCaps CreateBitmap DPtoLP SetViewportExtEx OffsetViewportOrgEx PatBlt SetViewportOrgEx CreatePen GetCurrentObject ExtTextOutW CreateFontIndirectW SetWindowOrgEx CreateSolidBrush SetDIBColorTable GetMapMode CreateCompatibleBitmap CombineRgn ExtCreateRegion CreateDIBSection GetObjectW DeleteObject CreateRectRgn CreateCompatibleDC SelectObject SetTextAlign MoveToEx LineTo DeleteDC BitBlt GetStockObject GetTextExtentPoint32W SetMapMode ScaleViewportExtEx

msimg32

AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegQueryValueW RegCloseKey RegQueryValueExW RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegOpenKeyExW RegNotifyChangeKeyValue AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW

shell32

Shell_NotifyIconW ShellExecuteExW SHGetSpecialFolderPathW SHGetFolderPathW SHGetKnownFolderPath

comctl32

_TrackMouseEvent InitCommonControlsEx ord380

shlwapi

PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW SHStrDupW

ole32

CoCreateInstance CoUninitialize CoCreateGuid CreateStreamOnHGlobal PropVariantClear CoInitializeEx CoTaskMemAlloc FreePropVariantArray PropVariantCopy CoInitializeSecurity CoFreeUnusedLibrariesEx CoInitialize StringFromGUID2 CLSIDFromString CoTaskMemFree CLSIDFromProgID

oleaut32

VariantClear VariantInit SysFreeString SysAllocString SafeArrayCreate VariantChangeType

gdiplus

GdipGetImageGraphicsContext GdipDrawImageRectI GdipDisposeImage GdipCloneImage GdipDeleteGraphics GdipAlloc GdipFree GdipGetImagePalette GdipCreateBitmapFromHBITMAP GdipGetImagePaletteSize GdipGetImagePixelFormat GdipDrawImageI GdipCreateFromHDC GdipBitmapUnlockBits GdipSetInterpolationMode GdipBitmapLockBits GdipCreateBitmapFromStream GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipImageRotateFlip GdipDrawImageRectRectI GdipDrawImageRectRect GdipCreateBitmapFromHICON GdipSetSmoothingMode GdipDrawImageRect GdipCreatePen1 GdipDeletePen GdipDrawLineI GdipDeleteFont GdipMeasureString GdipDeleteFontFamily GdipGetFamily GdipCreateFont GdipGetFontUnit GdipGetFontStyle GdipGetFontSize GdipGetLogFontW GdipCreateFontFromDC GdipCreateFontFromLogfontW GdipSetStringFormatAlign GdipDeleteBrush GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipCloneBrush GdipSetTextRenderingHint GdipDrawString GdipCreateSolidFill GdipCreateStringFormat GdipDeleteStringFormat GdipDrawImage GdipCreateBitmapFromScan0 GdipGetImageWidth GdipCreateHBITMAPFromBitmap GdiplusStartup GdiplusShutdown GdipGetImageHeight

wininet

InternetConnectW HttpSendRequestW InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallbackW InternetOpenW InternetGetLastResponseInfoW InternetQueryDataAvailable HttpOpenRequestW InternetCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_092f9f6c174c15c43b7c7889c4ad59a6_amadey_emotet_smoke-loader_stop

PE Signature issue

dwmapi

winmm

imm32

setupapi

version

dsound

rpcrt4

bcrypt

pdh

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

wininet

generic