2026-07-07_e9e02cd0638d9263763114d77785a1da_amadey_bkransomware_elex_maze_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_e9e02cd0638d9263763114d77785a1da_amadey_bkransomware_elex_maze_smoke-loader_stealc
Size 782KB
Sample260707-hmkksagy6m
SHA256 810d8994639865a3ffc16b47a6e3cde734a3082df7d7bc877c8fbd8e84c49aff
MD5 e9e02cd0638d9263763114d77785a1da
SHA1 2caa641e5f8274b0be837d0ae36671588b0d463f
SHA512 1326c28a26f49e63476139e621c3d102f0231e30ce991f55a2f48c1004d12170c6a398e304ce3a322815db2492b5f0d55cc81ee04a4affbcd2a42a58250a2c4a
SSDEEP 24576:vCERI6ifz70iwX2GTqRNx/4kLp1CfhgbpC:vCERI/0fX2XAe1CUpC
TLSH
T1B105AF31B9C18137C1B301728D6CAB3A506DB9360B2A49E7B3C84B2D5D782D26F357A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-07_e9e02cd0638d9263763114d77785a1da_amadey_bkransomware_elex_maze_smoke-loader_stealc

.exe 782KB

2026-07-07_e9e02cd0638d9263763114d77785a1da_amadey_bkransomware_elex_maze_smoke-loader_stealc

IMPHASH 43de51e692200a9e60df350564ca3340
SHA256 810d8994639865a3ffc16b47a6e3cde734a3082df7d7bc877c8fbd8e84c49aff
MD5 e9e02cd0638d9263763114d77785a1da
SHA1 2caa641e5f8274b0be837d0ae36671588b0d463f
SHA512 1326c28a26f49e63476139e621c3d102f0231e30ce991f55a2f48c1004d12170c6a398e304ce3a322815db2492b5f0d55cc81ee04a4affbcd2a42a58250a2c4a
SSDEEP 24576:vCERI6ifz70iwX2GTqRNx/4kLp1CfhgbpC:vCERI/0fX2XAe1CUpC
TLSH
T1B105AF31B9C18137C1B301728D6CAB3A506DB9360B2A49E7B3C84B2D5D782D26F357A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

fa:ab:a8:42:91:d0:db:1c:10:c0:09:bb:e3:69:7d:d7:ad:f8:5d:0c:a8:c8:75:91:58:a7:8e:8a:ac:a3:aa:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Xetex Business Systems\, Inc.,O=Xetex Business Systems\, Inc.,L=Reading,ST=Pennsylvania,C=US

Chains

Jun 19, 2026

CN=Xetex Business Systems\, Inc.,O=Xetex Business Systems\, Inc.,L=Reading,ST=Pennsylvania,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Xetex Business Systems\, Inc.,O=Xetex Business Systems\, Inc.,L=Reading,ST=Pennsylvania,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Xetex Business Systems\, Inc.,O=Xetex Business Systems\, Inc.,L=Reading,ST=Pennsylvania,C=US

Serial Number

07:75:ef:c8:99:0e:81:d8:b5:9c:83:51:45:78:22:6a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 30, 2025 - May 31, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

362729

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

WSAGetLastError closesocket connect htons recv send WSACleanup WSAStartup getprotobyname socket

comctl32

ord17 ord6 CreateToolbarEx

kernel32

CreateMutexA FlushFileBuffers FindClose GetFileTime CreateDirectoryA DeleteFileA FindFirstFileA FindNextFileA CopyFileA FileTimeToLocalFileTime FileTimeToSystemTime GetShortPathNameA GetLastError CreateProcessA LockResource LoadResource SizeofResource FindResourceA GetFileSize WriteFile ReadFile SetEndOfFile SetFilePointer SetFilePointerEx CreateFileA GetFileAttributesExA GetCurrentProcessId GlobalAlloc GlobalLock GlobalUnlock GlobalFree SetEvent CreateEventA MultiByteToWideChar ReleaseSemaphore GetModuleHandleA GetModuleFileNameW FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW VirtualProtect VirtualFree VirtualAlloc GetVersionExW GetOEMCP GetACP IsValidCodePage GetProcessHeap GetModuleHandleExW ExitProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW CloseHandle UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue LoadLibraryExW CreateSemaphoreW GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess CreateEventW InitializeCriticalSectionAndSpinCount SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter GetCommandLineA ResumeThread ExitThread CreateThread HeapQueryInformation HeapSize HeapAlloc AreFileApisANSI HeapReAlloc IsProcessorFeaturePresent IsDebuggerPresent HeapFree RtlUnwind RaiseException GetStringTypeW WideCharToMultiByte DecodePointer EncodePointer InterlockedFlushSList DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentThread GetCurrentProcess DuplicateHandle GetSystemTimeAsFileTime QueryDepthSList UnregisterWaitEx MoveFileExW GetStdHandle GetConsoleCP GetConsoleMode WaitForSingleObject ReleaseMutex GetVersionExA GetComputerNameA GetDiskFreeSpaceA GlobalMemoryStatus GetLocalTime GetModuleFileNameA LoadLibraryA GetProcAddress FreeLibrary SystemTimeToFileTime SetFileTime GetTickCount Sleep GetCurrentThreadId InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetFileType QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryW SetStdHandle WriteConsoleW CreateFileW GetCPInfo

user32

SetCursorPos GetScrollRange GetScrollPos SetScrollInfo LoadStringA GetCursorPos ShowScrollBar SetScrollPos SetForegroundWindow TrackPopupMenuEx GetMenuItemID GetSubMenu CreatePopupMenu GetMenuState GetMenuStringA SetMenu FrameRect IsIconic SetClassLongA ChildWindowFromPoint ReleaseCapture SetCapture GetCapture GetFocus IsWindowVisible IsWindow InflateRect SetWindowTextA EnableWindow CallWindowProcA DrawEdge CopyRect SetRect EnableMenuItem GetSystemMenu KillTimer SetTimer GetKeyState GetActiveWindow PostQuitMessage LoadMenuA TranslateMessage GetMessageA InvalidateRect MonitorFromRect SystemParametersInfoA GetDesktopWindow GetWindowTextA GetSystemMetrics GetWindowPlacement IsWindowEnabled ScreenToClient GetMenuItemInfoA RemoveMenu AppendMenuA GetMenuItemCount SetWindowLongA FillRect GetSysColor EndPaint BeginPaint DrawTextA ShowWindow DestroyWindow CreateWindowExA GetClassInfoA RegisterClassA FindWindowExA FindWindowA ReleaseDC GetDC LoadIconA GetWindowLongA LoadImageA LoadCursorA SetCursor SetFocus DefWindowProcA GetClientRect SetWindowPos ClientToScreen GetScrollInfo GetWindowRect UpdateWindow SendMessageA PostThreadMessageA PostMessageA PeekMessageA MessageBoxA DestroyIcon DispatchMessageA DestroyMenu

gdi32

Rectangle DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt ExtCreatePen GetTextFaceA Polygon DPtoLP GetTextMetricsA SetDCPenColor SetDCBrushColor CreateDIBitmap GetObjectA StretchBlt SetStretchBltMode SaveDC RestoreDC GetStockObject GetDeviceCaps CreateFontIndirectA MoveToEx SetTextColor SetBkMode SetBkColor SelectObject LineTo DeleteObject CreateSolidBrush CreatePen GetTextExtentPoint32A GetBkColor GetTextColor

comdlg32

ChooseColorA

shell32

SHGetMalloc SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

ole32

OleUninitialize CoInitialize CoUninitialize CoCreateInstance OleInitialize

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_e9e02cd0638d9263763114d77785a1da_amadey_bkransomware_elex_maze_smoke-loader_stealc

wsock32

comctl32

kernel32

user32

gdi32

comdlg32

shell32

ole32

generic