General
-
Target
2025-04-02_3eb3656602d5d81d942815125c8144b6_amadey_smoke-loader
-
Size
480KB
-
MD5
3eb3656602d5d81d942815125c8144b6
-
SHA1
8cee9e4db8c9bae715ba86e1c03bded7802d91aa
-
SHA256
3044e0deeb3ff89daaad87edce4001b8e0e8ee109cb7705ff72f7aa9689531ec
-
SHA512
02e3ea2e489f79c357bd02172e3f9a8db3c865a4e633c92a1b14e6a9884e5e3094bc594ef53bb855c1e801e922a796d3db50e1c64fb998b4b1ff1ceeaaf54b49
-
SSDEEP
6144:wqXAoQT5Tr9R0HN/3w36EnCYLTcz6MY5NYnE/QhyjxJBErrZAWkPW5oeNtLjpVOd:TQRI/3w36EnCYcFE/iydJai/WZtW
Malware Config
Extracted
urelas
1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235
218.54.31.165
Signatures
-
Urelas family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-04-02_3eb3656602d5d81d942815125c8144b6_amadey_smoke-loader
Files
-
2025-04-02_3eb3656602d5d81d942815125c8144b6_amadey_smoke-loader.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ