2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee

General

Target
2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee
Size 1.1MB
Sample260720-2nnhlsh19x
SHA256 6b263193a8dc67f5efc1c07788c30f96b55ca403c82ddc088d6157c0f35867bf
MD5 c4e818994682efe44c00e688dd819b8a
SHA1 86ca20c2757279c1d4631b6f83fd0ba718afb689
SHA512 746d0e626a9b560d6b123885540aae9fa6d34bc61c520994c24313e1bbab10a228ad3ff7df1d70b0369717ac929056de280d1219234c951fda1f078c5ca5a3ba
SSDEEP 24576:egBlcMzBQUrAGtMYVPVvcNy4DyLqhOvsCf:egIMmUrZ5cNd1Qko
TLSH
T19B35CE19249084B3F13272F2459262AA75EA2D727720F5C6B7BA371D6A7524FCF4320F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee

File Explorer

2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee

.exe 1.1MB

2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee

IMPHASH 12d25a536feab4d5a17e241370f49efa
SHA256 6b263193a8dc67f5efc1c07788c30f96b55ca403c82ddc088d6157c0f35867bf
MD5 c4e818994682efe44c00e688dd819b8a
SHA1 86ca20c2757279c1d4631b6f83fd0ba718afb689
SHA512 746d0e626a9b560d6b123885540aae9fa6d34bc61c520994c24313e1bbab10a228ad3ff7df1d70b0369717ac929056de280d1219234c951fda1f078c5ca5a3ba
SSDEEP 24576:egBlcMzBQUrAGtMYVPVvcNy4DyLqhOvsCf:egIMmUrZ5cNd1Qko
TLSH
T19B35CE19249084B3F13272F2459262AA75EA2D727720F5C6B7BA371D6A7524FCF4320F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

111537

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar WideCharToMultiByte GetLastError AreFileApisANSI LoadLibraryExW LoadLibraryW GetModuleFileNameW GetModuleFileNameA LocalFree FormatMessageW FormatMessageA GetSystemDirectoryW CloseHandle SetFileTime CreateFileW SetLastError SetFileAttributesW SetFileAttributesA RemoveDirectoryW RemoveDirectoryA GetProcAddress GetModuleHandleW CreateDirectoryW CreateDirectoryA DeleteFileW DeleteFileA SetCurrentDirectoryW SetCurrentDirectoryA GetCurrentDirectoryW GetCurrentDirectoryA GetTempPathW GetTempPathA GetCurrentProcessId GetTickCount GetCurrentThreadId FindClose FindFirstFileW FindFirstFileA FindNextFileW FindNextFileA GetModuleHandleA GetFileAttributesW GetFileAttributesA GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile CreateFileA GetProcessAffinityMask GetCurrentProcess GetSystemInfo GlobalMemoryStatus GetFileInformationByHandle GetStdHandle WaitForMultipleObjects Sleep VirtualAlloc VirtualFree GetVersionExA lstrcatW lstrlenW WaitForSingleObject CreateEventA SetEvent ResetEvent InitializeCriticalSection CreateProcessA GetCommandLineW HeapSize GetStringTypeW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapCreate ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InterlockedDecrement InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc IsProcessorFeaturePresent GetStartupInfoW HeapSetInformation GetCommandLineA CreateThread ExitThread HeapReAlloc HeapFree HeapAlloc RaiseException DecodePointer EncodePointer RtlUnwind

user32

DestroyWindow LoadIconA EndDialog KillTimer SetTimer PostMessageA SendMessageA MessageBoxW SetWindowTextW SetWindowTextA LoadStringW LoadStringA DialogBoxParamW DialogBoxParamA GetDlgItem GetWindowLongA SetWindowLongA ShowWindow CharUpperW CharUpperA

shell32

ShellExecuteExA

oleaut32

VariantClear SysAllocStringLen SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee

kernel32

user32

shell32

oleaut32

generic