2026-05-06_808bd5915db72da3e47cf1fe6e4141e8_amadey_elex_nionspy_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-06_808bd5915db72da3e47cf1fe6e4141e8_amadey_elex_nionspy_smoke-loader
Size 1.5MB
Sample260506-ph4w7aev2p
SHA256 27972f9f62ecac71d52890e5a2ddae06b376452a9dd26f8636d6a8b3b9e4e533
MD5 808bd5915db72da3e47cf1fe6e4141e8
SHA1 82dd27fc4ab86ae2d472c458ca5a5adfb1917409
SHA512 66fac69da91fe57673b9299e96073c1daa2ba303c9673e7221ffd06a62c787a6ca1c05fdc301ed1a6fc28ff7620ed9d7540e74dd47c816c04c87245f86b294dd
SSDEEP 24576:Xp6xWv9NwsDjHp6xWv9NwsDjLp6xWv9NwsDjHYp6xWv9NwsDjHp6xWv9NwsDjLpz:Zz9C0tz9C0hz9C0Wz9C0tz9C0hz9C0
TLSH
T152658E00B6E0C4B2D85666B440BBAB660D7D36352F26E5D3F7601E649D603F2BE3436E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-06_808bd5915db72da3e47cf1fe6e4141e8_amadey_elex_nionspy_smoke-loader

File Explorer

2026-05-06_808bd5915db72da3e47cf1fe6e4141e8_amadey_elex_nionspy_smoke-loader

.exe 1.5MB

2026-05-06_808bd5915db72da3e47cf1fe6e4141e8_amadey_elex_nionspy_smoke-loader

IMPHASH 366ace8a1c8bfddc75a256e571e54824
SHA256 27972f9f62ecac71d52890e5a2ddae06b376452a9dd26f8636d6a8b3b9e4e533
MD5 808bd5915db72da3e47cf1fe6e4141e8
SHA1 82dd27fc4ab86ae2d472c458ca5a5adfb1917409
SHA512 66fac69da91fe57673b9299e96073c1daa2ba303c9673e7221ffd06a62c787a6ca1c05fdc301ed1a6fc28ff7620ed9d7540e74dd47c816c04c87245f86b294dd
SSDEEP 24576:Xp6xWv9NwsDjHp6xWv9NwsDjLp6xWv9NwsDjHYp6xWv9NwsDjHp6xWv9NwsDjLpz:Zz9C0tz9C0hz9C0Wz9C0tz9C0hz9C0
TLSH
T152658E00B6E0C4B2D85666B440BBAB660D7D36352F26E5D3F7601E649D603F2BE3436E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocalTime LoadLibraryA GetSystemTime CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GetDriveTypeA GlobalLock GlobalUnlock GetTickCount SetFileAttributesA CreateFileW GetProcessHeap SetEndOfFile GetStringTypeW LCMapStringW GetTimeZoneInformation WriteConsoleW SetEnvironmentVariableA CompareStringW FlushFileBuffers SetStdHandle GetCurrentProcessId QueryPerformanceCounter Sleep GlobalMemoryStatus GetComputerNameA GetVersionExA CreateToolhelp32Snapshot TerminateProcess Process32Next OpenProcess Process32First CloseHandle GetFileTime SetFileTime OpenFile GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameW HeapCreate GetConsoleMode GetConsoleCP MultiByteToWideChar WideCharToMultiByte SetFilePointer InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind DeleteCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError DeleteFileA HeapFree HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType

user32

ReleaseDC GetDC GetWindowRect MessageBoxA DispatchMessageA GetDesktopWindow SetWindowsHookExA CallNextHookEx CloseClipboard GetClipboardData OpenClipboard UnhookWindowsHookEx TranslateMessage GetMessageA GetKeyState

gdi32

DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap GetPixel BitBlt

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

InternetConnectA InternetCloseHandle InternetReadFile HttpOpenRequestA InternetGetConnectedState HttpSendRequestA InternetOpenA

winmm

mciSendStringA mciSendCommandA

wsock32

socket send gethostbyname closesocket htons WSAStartup connect

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_808bd5915db72da3e47cf1fe6e4141e8_amadey_elex_nionspy_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

generic