General
-
Target
2025-04-03_3585a9b04309d2954ae972be591503cf_amadey_smoke-loader
-
Size
480KB
-
MD5
3585a9b04309d2954ae972be591503cf
-
SHA1
b105170a023464484c6774a85a2ec9fc77371610
-
SHA256
11a14a88658ce0f07f34f1490642089c572e55621d1dd07fec814efbe4215a7b
-
SHA512
5491987d83a28b4f23681485acb99f7b46ef41d9f29f44bb6dd18447a6893338e23aa221d6979a1a497f902fb98c4edb3abec6fd95081f9400e9688882ac0ba6
-
SSDEEP
6144:wqXAoQT5Tr9R0HN/3w36EnCYLTcz6MY5NYnE/QhyjxJBErrZAWkPW5oeNtLjpVOr:TQRI/3w36EnCYcFE/iydJai/WZtA
Malware Config
Extracted
urelas
1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235
218.54.31.165
Signatures
-
Urelas family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-04-03_3585a9b04309d2954ae972be591503cf_amadey_smoke-loader
Files
-
2025-04-03_3585a9b04309d2954ae972be591503cf_amadey_smoke-loader.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ