de68c84d91a69ecfa6a8c8053f9814c9ccaba8b339a54e9dd599b059f549af59

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_702814e6839d14a778d8d554159ecb69_amadey_elex_hijackloader_jeefo_smoke-loader
Size 1.5MB
Sample260705-2mb37af18t
SHA256 de68c84d91a69ecfa6a8c8053f9814c9ccaba8b339a54e9dd599b059f549af59
MD5 702814e6839d14a778d8d554159ecb69
SHA1 17fa15e84a3588d5182ba788638f039946eec8b1
SHA512 033a7d99e760a3d2db519ed23c3d03ee06159cf2a4bd2ee47a64934302bba57897f152ee653a2bdb7a8a2370d78141feb7935aba2b9c082c9257fcf0e8daa21b
SSDEEP 12288:Ga2UjD5BKLe9euP+bnEPsSjlSoTUJDJM95+B7a2SooEPcQkIs:GafKLChmbEPsSjIoZ0BW1oZPcQkIs
TLSH
T1F3652813A790A862D46E6D3064ABC7153B37FD812E71864B7B1DB39C4F73340AA7825E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-07-05_702814e6839d14a778d8d554159ecb69_amadey_elex_hijackloader_jeefo_smoke-loader
- Size 1.5MB
- SHA256 de68c84d91a69ecfa6a8c8053f9814c9ccaba8b339a54e9dd599b059f549af59
- MD5 702814e6839d14a778d8d554159ecb69
- SHA1 17fa15e84a3588d5182ba788638f039946eec8b1
- SHA512 033a7d99e760a3d2db519ed23c3d03ee06159cf2a4bd2ee47a64934302bba57897f152ee653a2bdb7a8a2370d78141feb7935aba2b9c082c9257fcf0e8daa21b
- SSDEEP 12288:Ga2UjD5BKLe9euP+bnEPsSjlSoTUJDJM95+B7a2SooEPcQkIs:GafKLChmbEPsSjIoZ0BW1oZPcQkIs
- TLSH
  T1F3652813A790A862D46E6D3064ABC7153B37FD812E71864B7B1DB39C4F73340AA7825E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/ApplicationID.dll
- Size 55KB
- SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
- MD5 fdc0338e6faeaf6f7c271982e103473b
- SHA1 9a41f7932abe8be7e32c6371f085cf14de355d00
- SHA512 a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0
- SSDEEP 768:oY+N1V9Ek9B/3I2IIk85ZLa342QpIK0+KE1zRBoSLDGFo+EAM:oY+LpI2IIk85Fs+LNRBo1oyM
- TLSH
  T167438C10BA80D473C556983970E8DA225E7E7D122BF090D37FBA83694F617D0B67E34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/Banner.dll
- Size 14KB
- SHA256 9de96ef2e7739482d08716500e4df0a9b5c5e828edae26455f88da9de9c19ec4
- MD5 9595a877c0b9b959e50b2d4896a034ee
- SHA1 74ddd8c770e0e230e2b4a6c8ffa34ac0426bd5b1
- SHA512 419d01652263408d72a419cf209239faa0d863798638cec2f3d118309582ee36a4efed1a6c62af24663c1a4a1d57f8ed1a4158e4cb7a0de9d3190ca8e97de0c7
- SSDEEP 192:bAfhCpBEyMW7x0KDWpHFtH6cAAANa3Gy2sE9j2FVX0iznnnnnGi2d8XR4+5BKD:YCJMUvDGFtart8E9i0i22zW
- TLSH
  T1D8627CB6C6609C72ED2B4E7631C4C9173D76BA41ABD4C0E3466BC090D7817C366BCA6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/BitsUtils.dll
- Size 15KB
- SHA256 ab77c0a6c79e76ab0f509d655273b2ee5c682c702217f4f884bbab3d2fdfc4c0
- MD5 8dd17c172a24ebf9601308b949a9ea22
- SHA1 507e586c9f69ddc7e58442631efc44f3fe58089c
- SHA512 7de5a35771ac8ead2e3096de29bdedd8e94696d35dc304388c1cff2a14bb264e389a576dae21aaf9cbac79de6c99606b61f1dc5f0ba35fd261b2f5553d389e59
- SSDEEP 192:3VaJs7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRPmq514Lvsoj:3VaJWvDGFtart8E9VFK4iFm810Hj
- TLSH
  T1B3623CB787905C66ED7B8D7530E4C9267A3577475BA084F3126EC1009BC07C27AFD19A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/CityHash.dll
- Size 53KB
- SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
- MD5 2021acc65fa998daa98131e20c4605be
- SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
- SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
- SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
- TLSH
  T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/HttpPostFile.dll
- Size 14KB
- SHA256 55e714d2e298c42f73c5872ca50275d2d6b4b161c76cb87a8ebca8c1f99858db
- MD5 b97c09fdb76e1f5f5b964c229f0e9cc0
- SHA1 808e64bea4fde6d4944b6ffe5a3acbc6f45f9be7
- SHA512 1e930930bceb5895c599bdc5a886012ebaa3e08da03dcbf0579acf6d22bd061d36202c8f05d3d49c3b823543162f9ece74f9beefc9cc4085a67415e46bd84727
- SSDEEP 192:deoj8f2F7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRIb3i7Q:dU2nvDGFtart8E9VFK4iGbik
- TLSH
  T188623BF7C7905C50EC6A8D3530E89A2A7A7177426B91C4F7631EC1104BC1B81BAFC2AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 25KB
- SHA256 c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad
- MD5 fd249bc508706f04a18e0bc0afddec82
- SHA1 b94efda9f41c89fc6120ed385867125d03f28bea
- SHA512 c820c06ad5ae21101602d9e7864fed9b470b25fa9a0ee025d05e72697d88c7e03cbee7ad476f4e3d5b6e467248b8ad1fefa2710c76011e2156b85068961404ba
- SSDEEP 384:EAC43tPegZ3eBaRwCPOYY7nNYXCA/YosaNvDGFtart8E9VFK4ivDGb:EdTgZ3eBTCmrnNAEYDGFo+EAy
- TLSH
  T19BC28DA2A7C06CB3E9A35E3575E0AA179FB1F7126881CD93C33789005A417827EBC395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/ServicesHelper.dll
- Size 14KB
- SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
- MD5 b9e8c2212ac8dae4b0eaf97c048529fa
- SHA1 331d172323480b0518abdb0cc9e256dc7f46c357
- SHA512 d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96
- SSDEEP 192:UIHxGS7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHR5tHPk6NM:UR4vDGFtart8E9VFK4i/9kSM
- TLSH
  T148622BBB86A06C51DD668D3231988E2ABE7577456B90C0F7532AC1504BC1F8376FC2DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  $PLUGINSDIR/ShellLink.dll
- Size 14KB
- SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
- MD5 fa94d120efb029b43217c66bbc8c650c
- SHA1 1fcf2d76adf69b403b7400681ac91d50ed20385f
- SHA512 07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158
- SSDEEP 192:46J7JQCdiaR+7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRqt8kzN0eM2s:LJ7JQG2vDGFtart8E9VFK4ictvU2s
- TLSH
  T177623A6AC7A1EC90DC2BCD3730D4B9376A71AB8156A184EB576CC54047827873EFC0AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/System.dll
- Size 22KB
- SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
- MD5 b361682fa5e6a1906e754cfa08aa8d90
- SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
- SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
- SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
- TLSH
  T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/UAC.dll
- Size 28KB
- SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
- MD5 d23b256e9c12fe37d984bae5017c5f8c
- SHA1 fd698b58a563816b2260bbc50d7f864b33523121
- SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
- SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
- TLSH
  T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/liteFirewallW.dll
- Size 92KB
- SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
- MD5 f5a3005a46e051b8d9eb5e2be7802f7e
- SHA1 4fae43843bf6210d5d98683b50705824877a7d9a
- SHA512 4993fcfe6669dd1e3621ca50e35aad750bc6c89838abf94da4303c5a31e958b3d3bc2cf70c268590c8cd5cdbc90f015ffa37cf98548c2b54ea8171b63a3bfa0c
- SSDEEP 1536:tNiXc1jND/x0LI7W2kG3Crh520Hsy7xxz4J:79N7iPrh52ssyXe
- TLSH
  T1BE939E21B6E0C472C88BA9395464D7B25BBFB5316AE089877B68077D5F303C0977938B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  $PLUGINSDIR/nsExec.dll
- Size 17KB
- SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
- MD5 0e584c7120bd474c616013c58d51dc6b
- SHA1 0bc980892341b52985d92fb3d8fbb6be77951935
- SHA512 aa3a471b3f33c3ffdbe1b1e3c1e5d04367bcab3c16049396a8dd12c5a8317e4b153761f74f39b756dd4fb1806aedc4f1bb38bfbc12f16480eed3fd3087a0d157
- SSDEEP 384:qDrvAxnJGernNQZGdH7vDGFtart8E9VFK4ibEge:qDrkoernAGRLDGFo+EAxe
- TLSH
  T12C824CB685C02C55D85A8D353098AD1B6BB5B7462BA184F3533FC19057C1BC3FABC2D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26