6a349117d8979fc2ca41826c1a879d7772750097f29db2b42f87ba5198688b4e

General

Target
2026-07-01_87e9d3b3234a9a707236389b3b2a8fcf_amadey_elex_smoke-loader_stealc_stop_tofsee
Size 1.1MB
Sample260701-k3bc6aas4k
SHA256 6a349117d8979fc2ca41826c1a879d7772750097f29db2b42f87ba5198688b4e
MD5 87e9d3b3234a9a707236389b3b2a8fcf
SHA1 6e226eb2fea05357f649a14dfdfcc30688b273cd
SHA512 6fd2a03566c585a35da9cd91d37df3535e093e920ce0dd30fde2e99e122e3d742b9b0d22d287f4c858483dc7b58c35e820c2d3d6c5139fc370521a40cbda4dad
SSDEEP 24576:Lny/f9uRpSQNr4gtSij0dAqYzLFMkPIYxNIQn7LONssmu7v:GFoSijgAqYekPIWvOrl7v
TLSH
T18745126171D2C4B6E81360748CAEDA202476B53DA5B1A90F37852F3EAEF37535227B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Targets

- Target
  2026-07-01_87e9d3b3234a9a707236389b3b2a8fcf_amadey_elex_smoke-loader_stealc_stop_tofsee
- Size 1.1MB
- SHA256 6a349117d8979fc2ca41826c1a879d7772750097f29db2b42f87ba5198688b4e
- MD5 87e9d3b3234a9a707236389b3b2a8fcf
- SHA1 6e226eb2fea05357f649a14dfdfcc30688b273cd
- SHA512 6fd2a03566c585a35da9cd91d37df3535e093e920ce0dd30fde2e99e122e3d742b9b0d22d287f4c858483dc7b58c35e820c2d3d6c5139fc370521a40cbda4dad
- SSDEEP 24576:Lny/f9uRpSQNr4gtSij0dAqYzLFMkPIYxNIQn7LONssmu7v:GFoSijgAqYekPIWvOrl7v
- TLSH
  T18745126171D2C4B6E81360748CAEDA202476B53DA5B1A90F37852F3EAEF37535227B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects binaries and memory artifacts referencing sandbox product IDs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many email and collaboration clients. Observed in information steale
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2