2026-07-24_d71ffa266fccbcdf3ce113dfe2db3999_amadey_elex_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-24_d71ffa266fccbcdf3ce113dfe2db3999_amadey_elex_smoke-loader_stealc_stop_tofsee
Size 1.3MB
Sample260724-2prawsvsbz
SHA256 f705f2fccdabb8b526b3c20c3aa26518eaa02b96ffae7b4e4096905424409502
MD5 d71ffa266fccbcdf3ce113dfe2db3999
SHA1 bdfe706cadcb88759a91da7198ad6e9f982874f1
SHA512 64a197d4620e2279d454a06069e77cfa5431222cfd1bbd5c525dc6dc8f3f0aa6a04d820ae4cfddeabec17e2695d66e45d7420d51826fec3325c044da151c450b
SSDEEP 12288:Pvf0lJyw8r4ZrXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:P0lD8r4Zc743TvRk6NwG
TLSH
T1DB55012032D6803BD0A361328EA8D6BA552AFF715B171CDF73D92B6A1DB01D2273571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_d71ffa266fccbcdf3ce113dfe2db3999_amadey_elex_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-24_d71ffa266fccbcdf3ce113dfe2db3999_amadey_elex_smoke-loader_stealc_stop_tofsee

.exe 1.3MB

2026-07-24_d71ffa266fccbcdf3ce113dfe2db3999_amadey_elex_smoke-loader_stealc_stop_tofsee

IMPHASH 27332499b5c45c26aabd060957e517ad
SHA256 f705f2fccdabb8b526b3c20c3aa26518eaa02b96ffae7b4e4096905424409502
MD5 d71ffa266fccbcdf3ce113dfe2db3999
SHA1 bdfe706cadcb88759a91da7198ad6e9f982874f1
SHA512 64a197d4620e2279d454a06069e77cfa5431222cfd1bbd5c525dc6dc8f3f0aa6a04d820ae4cfddeabec17e2695d66e45d7420d51826fec3325c044da151c450b
SSDEEP 12288:Pvf0lJyw8r4ZrXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:P0lD8r4Zc743TvRk6NwG
TLSH
T1DB55012032D6803BD0A361328EA8D6BA552AFF715B171CDF73D92B6A1DB01D2273571B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61353

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\jdomingo\Desktop\CxUtilityService-AUDBI\CxUtilSvc\Release\CxUtilSvc.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

setupapi

SetupDiClassGuidsFromNameA SetupDiGetClassDevsExA SetupDiGetDeviceRegistryPropertyA SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList SetupDiDestroyDriverInfoList SetupDiEnumDeviceInfo

kernel32

TerminateProcess OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot InterlockedIncrement CopyFileW DeleteFileW CreateDirectoryW FindResourceExW GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType LockResource GetLocaleInfoEx Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetPrivateProfileStringW GetCommandLineW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary InterlockedDecrement SetEvent GetCurrentThreadId CreateEventW CreateThread Sleep GetCurrentThread GetCurrentProcess GetModuleFileNameW lstrcmpiW GetModuleHandleW GetProcAddress DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW WaitForSingleObject CreateFileW CloseHandle LoadLibraryW GetStringTypeW FlushFileBuffers SetStdHandle WriteConsoleW SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW WideCharToMultiByte IsValidCodePage GetOEMCP GetACP GetCPInfo IsProcessorFeaturePresent SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc HeapCreate GetStdHandle WriteFile ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW HeapSetInformation DecodePointer EncodePointer RtlUnwind HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap

user32

DispatchMessageW CharNextW TranslateMessage LoadStringW PostThreadMessageW GetMessageW MessageBoxW CharUpperW

advapi32

OpenProcessToken RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegEnumValueA RegDeleteKeyA RegQueryValueExA ChangeServiceConfigW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW AllocateAndInitializeSid FreeSid OpenThreadToken SetSecurityDescriptorDacl RegEnumKeyExW ControlService DeleteService CreateServiceW InitializeAcl AddAccessAllowedAce GetAclInformation AddAce GetAce GetTokenInformation SetSecurityDescriptorGroup SetSecurityDescriptorOwner InitializeSecurityDescriptor IsValidSid GetLengthSid CopySid RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource OpenSCManagerW OpenServiceW CloseServiceHandle

shell32

SHGetFolderPathA SHGetFolderPathAndSubDirA

ole32

CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoRevokeClassObject CoRegisterClassObject CoTaskMemFree StringFromGUID2 CoCreateInstance CoInitializeSecurity CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoInitializeEx

oleaut32

LoadRegTypeLi SysAllocStringByteLen SysStringByteLen VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_d71ffa266fccbcdf3ce113dfe2db3999_amadey_elex_smoke-loader_stealc_stop_tofsee

version

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic