2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader
Size 2.0MB
Sample260720-sr4vbset7l
SHA256 04b078a5b68a6ad230dfcc12bb037a479878c18b70066f402f51f91cfdfe43c4
MD5 f6de382fd6699c02621494bf4b5e7b37
SHA1 4c969f760e543593186e09de3c90fc078db9cbb3
SHA512 cf36fae51cd6c8ee145be58370793f9abab98e653eb586a6a1b2e06ca64ef17aa7cba4b028f5c998cbac3a04e8393d54b0fbbba21e5d79b7f81e96101d4a0edf
SSDEEP 49152:Joa1tHC070U9mJld5ZwopnClX1P3ezhSLe0p:Joa1tHC0CJP5Zwopn6dn
TLSH
T1B7951249F79880B2D042D4BAD5A2DB66D073387653008DCB67D48F7B1E27BC5B632B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader

File Explorer

2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader

.exe 2.0MB

2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader

IMPHASH 95122753ea27818b35f9b51859e4c692
SHA256 04b078a5b68a6ad230dfcc12bb037a479878c18b70066f402f51f91cfdfe43c4
MD5 f6de382fd6699c02621494bf4b5e7b37
SHA1 4c969f760e543593186e09de3c90fc078db9cbb3
SHA512 cf36fae51cd6c8ee145be58370793f9abab98e653eb586a6a1b2e06ca64ef17aa7cba4b028f5c998cbac3a04e8393d54b0fbbba21e5d79b7f81e96101d4a0edf
SSDEEP 49152:Joa1tHC070U9mJld5ZwopnClX1P3ezhSLe0p:Joa1tHC0CJP5Zwopn6dn
TLSH
T1B7951249F79880B2D042D4BAD5A2DB66D073387653008DCB67D48F7B1E27BC5B632B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

296672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect Sleep GetCurrentProcessId GetCurrentThreadId GetModuleHandleW lstrlenW WideCharToMultiByte MoveFileExW GetTempFileNameW GetTempPathW DeleteFileW MoveFileW WriteFile ReadFile GetFileSize CreateFileW SetFileAttributesW GetModuleFileNameW GetComputerNameA GetSystemTime RaiseException RtlUnwind HeapAlloc HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer TlsAlloc TlsGetValue TlsSetValue InterlockedIncrement SetLastError InterlockedDecrement ExitProcess GetStdHandle HeapCreate HeapDestroy FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW HeapReAlloc HeapSize SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers MultiByteToWideChar GetStringTypeW SetStdHandle WriteConsoleW SetEndOfFile GetProcessHeap CloseHandle GetLastError DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentProcess GetModuleHandleA CreateProcessW LoadLibraryW SystemTimeToFileTime FindResourceExW FindResourceW LoadResource LockResource SizeofResource LoadLibraryA TlsFree GetProcAddress

user32

FlashWindow

advapi32

CreateServiceW RegCreateKeyExW OpenSCManagerW OpenServiceW QueryServiceConfigW ChangeServiceConfigW StartServiceW CloseServiceHandle RegCloseKey RegOpenKeyExW CryptAcquireContextW CryptReleaseContext GetUserNameW GetUserNameA AllocateAndInitializeSid CheckTokenMembership FreeSid RegQueryValueExW RegSetValueExW

shell32

ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathIsRootW PathAddExtensionW PathAppendW PathRemoveExtensionW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader

kernel32

user32

advapi32

shell32

shlwapi

generic