General
-
Target
2025-04-04_40c30e9a08fa24da8610a9def50e51bd_amadey_smoke-loader
-
Size
790KB
-
MD5
40c30e9a08fa24da8610a9def50e51bd
-
SHA1
afbcb07801aca53750b920e191a5a910fa76de0f
-
SHA256
c17f935c7a26f36ed26ffe807033054469869841ce7ca49ff08104f7f6f7cce3
-
SHA512
6b2e8530a90fab68e2b7fe9796c7518409841c16a2ca84179124542ca6178174ab716099cb0916d5b14a05d523fea13b18e8516ad6cb4f2a62cefc3fc9d63720
-
SSDEEP
12288:dccNvdRExZGe+Q1nzPAlDqfJZTvfTRTWkI42gqmoWkI094og2GXfJKnbkS3LdAPp:dnPfQpzyD8ZTn8kZ2gqAkI094vOkSCLl
Malware Config
Extracted
urelas
1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
Signatures
-
Urelas family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-04-04_40c30e9a08fa24da8610a9def50e51bd_amadey_smoke-loader
Files
-
2025-04-04_40c30e9a08fa24da8610a9def50e51bd_amadey_smoke-loader.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
IOKGDTTY Size: 460KB - Virtual size: 484KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IOKGDTTY Size: 326KB - Virtual size: 328KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE