2026-06-30_92addd9fcf4f98ab7ad5cba6f908f42b_amadey_elex_nionspy_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_92addd9fcf4f98ab7ad5cba6f908f42b_amadey_elex_nionspy_smoke-loader
Size 1.5MB
Sample260701-ecttxsfx2w
SHA256 a43e9627cc9975215483843c5c571cb8b01abea73142e169fe162400dfef1800
MD5 92addd9fcf4f98ab7ad5cba6f908f42b
SHA1 1685b5f191e5f66b4694ab1c30ba31baf53636e0
SHA512 959fd2917c8070f8346ad1275e308b98ff699930e457c319911af50ecd98832588c59af5bfb384f88e7558fad6491a6a6f7a7771df5d70cc79180e9018a14e87
SSDEEP 24576:Gp6xWv9NwsDjHp6xWv9NwsDjLp6xWv9NwsDjHYp6xWv9NwsDjHp6xWv9NwsDjLpz:Mz9C0tz9C0hz9C0Wz9C0tz9C0hz9C0
TLSH
T120658E00B6E0C4B2D85666B440ABAB760D7D36352F26E5D3F7601E649D603F2BE3436E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_92addd9fcf4f98ab7ad5cba6f908f42b_amadey_elex_nionspy_smoke-loader

File Explorer

2026-06-30_92addd9fcf4f98ab7ad5cba6f908f42b_amadey_elex_nionspy_smoke-loader

.exe 1.5MB

2026-06-30_92addd9fcf4f98ab7ad5cba6f908f42b_amadey_elex_nionspy_smoke-loader

IMPHASH 366ace8a1c8bfddc75a256e571e54824
SHA256 a43e9627cc9975215483843c5c571cb8b01abea73142e169fe162400dfef1800
MD5 92addd9fcf4f98ab7ad5cba6f908f42b
SHA1 1685b5f191e5f66b4694ab1c30ba31baf53636e0
SHA512 959fd2917c8070f8346ad1275e308b98ff699930e457c319911af50ecd98832588c59af5bfb384f88e7558fad6491a6a6f7a7771df5d70cc79180e9018a14e87
SSDEEP 24576:Gp6xWv9NwsDjHp6xWv9NwsDjLp6xWv9NwsDjHYp6xWv9NwsDjHp6xWv9NwsDjLpz:Mz9C0tz9C0hz9C0Wz9C0tz9C0hz9C0
TLSH
T120658E00B6E0C4B2D85666B440ABAB760D7D36352F26E5D3F7601E649D603F2BE3436E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocalTime LoadLibraryA GetSystemTime CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GetDriveTypeA GlobalLock GlobalUnlock GetTickCount SetFileAttributesA CreateFileW GetProcessHeap SetEndOfFile GetStringTypeW LCMapStringW GetTimeZoneInformation WriteConsoleW SetEnvironmentVariableA CompareStringW FlushFileBuffers SetStdHandle GetCurrentProcessId QueryPerformanceCounter Sleep GlobalMemoryStatus GetComputerNameA GetVersionExA CreateToolhelp32Snapshot TerminateProcess Process32Next OpenProcess Process32First CloseHandle GetFileTime SetFileTime OpenFile GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameW HeapCreate GetConsoleMode GetConsoleCP MultiByteToWideChar WideCharToMultiByte SetFilePointer InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind DeleteCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError DeleteFileA HeapFree HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType

user32

ReleaseDC GetDC GetWindowRect MessageBoxA DispatchMessageA GetDesktopWindow SetWindowsHookExA CallNextHookEx CloseClipboard GetClipboardData OpenClipboard UnhookWindowsHookEx TranslateMessage GetMessageA GetKeyState

gdi32

DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap GetPixel BitBlt

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

InternetConnectA InternetCloseHandle InternetReadFile HttpOpenRequestA InternetGetConnectedState HttpSendRequestA InternetOpenA

winmm

mciSendStringA mciSendCommandA

wsock32

socket send gethostbyname closesocket htons WSAStartup connect

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_92addd9fcf4f98ab7ad5cba6f908f42b_amadey_elex_nionspy_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

generic