2026-05-07_cb1f4583a66f06d8b1656d3fe10a3b16_amadey_elex_nionspy_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-07_cb1f4583a66f06d8b1656d3fe10a3b16_amadey_elex_nionspy_smoke-loader
Size 14.6MB
Sample260507-a9flcagy6r
SHA256 6b60ba0f3c400eae0a413767245abc798366411867a988bff804c0d90099f42c
MD5 cb1f4583a66f06d8b1656d3fe10a3b16
SHA1 044d30ca76197f448cb7d789e9b22581216e74d2
SHA512 d1c5dbebb9a84961e71cbc76e8a32e924563b425eb710e374990717f744b76f64537573d647e0f6bf01e41fc3ee402acf748878e7a0b23906d7495d532eb12f6
SSDEEP 196608:u7m707m7z7m707m7f7m707m7z7m707m7c7m707m7z7m707m7f7m707m7z7m707m7:
TLSH
T19DF69E00B6E1C4B2D857667440ABABA60D7D36352F26E2D3F7601E649D603F2BE3435E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-07_cb1f4583a66f06d8b1656d3fe10a3b16_amadey_elex_nionspy_smoke-loader

File Explorer

2026-05-07_cb1f4583a66f06d8b1656d3fe10a3b16_amadey_elex_nionspy_smoke-loader

.exe 14.6MB

2026-05-07_cb1f4583a66f06d8b1656d3fe10a3b16_amadey_elex_nionspy_smoke-loader

IMPHASH 366ace8a1c8bfddc75a256e571e54824
SHA256 6b60ba0f3c400eae0a413767245abc798366411867a988bff804c0d90099f42c
MD5 cb1f4583a66f06d8b1656d3fe10a3b16
SHA1 044d30ca76197f448cb7d789e9b22581216e74d2
SHA512 d1c5dbebb9a84961e71cbc76e8a32e924563b425eb710e374990717f744b76f64537573d647e0f6bf01e41fc3ee402acf748878e7a0b23906d7495d532eb12f6
SSDEEP 196608:u7m707m7z7m707m7f7m707m7z7m707m7c7m707m7z7m707m7f7m707m7z7m707m7:
TLSH
T19DF69E00B6E1C4B2D857667440ABABA60D7D36352F26E2D3F7601E649D603F2BE3435E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocalTime LoadLibraryA GetSystemTime CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GetDriveTypeA GlobalLock GlobalUnlock GetTickCount SetFileAttributesA CreateFileW GetProcessHeap SetEndOfFile GetStringTypeW LCMapStringW GetTimeZoneInformation WriteConsoleW SetEnvironmentVariableA CompareStringW FlushFileBuffers SetStdHandle GetCurrentProcessId QueryPerformanceCounter Sleep GlobalMemoryStatus GetComputerNameA GetVersionExA CreateToolhelp32Snapshot TerminateProcess Process32Next OpenProcess Process32First CloseHandle GetFileTime SetFileTime OpenFile GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameW HeapCreate GetConsoleMode GetConsoleCP MultiByteToWideChar WideCharToMultiByte SetFilePointer InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind DeleteCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError DeleteFileA HeapFree HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType

user32

ReleaseDC GetDC GetWindowRect MessageBoxA DispatchMessageA GetDesktopWindow SetWindowsHookExA CallNextHookEx CloseClipboard GetClipboardData OpenClipboard UnhookWindowsHookEx TranslateMessage GetMessageA GetKeyState

gdi32

DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap GetPixel BitBlt

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

InternetConnectA InternetCloseHandle InternetReadFile HttpOpenRequestA InternetGetConnectedState HttpSendRequestA InternetOpenA

winmm

mciSendStringA mciSendCommandA

wsock32

socket send gethostbyname closesocket htons WSAStartup connect

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-07_cb1f4583a66f06d8b1656d3fe10a3b16_amadey_elex_nionspy_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

generic