2026-07-25_cf8362d377dd3e27f8db0a491100225e_amadey_elex_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-25_cf8362d377dd3e27f8db0a491100225e_amadey_elex_smoke-loader_stealc_tofsee
Size 227KB
Sample260725-dftsnafe36
SHA256 b178a9329fd64ea6ee3cd5d4f2dbee6182f4d8bef6c04807020153bd294b3acc
MD5 cf8362d377dd3e27f8db0a491100225e
SHA1 880e739bd5c6dfa8123be60ec8bf4b9d672b3fe3
SHA512 70f85b1091e3cb7174a2512e65cb3c9fdd96778caecd457e096651fa7c52570d31c1286d69fb029e73a17b0369d11eecccd936b40a3e7bd6388b4c583c115b1a
SSDEEP 6144:QBC4T359LKgsblsifZhptKBuX3vOir6ozN4S:QBCubL1sb2ifptKYX3r5
TLSH
T1D0348D36B69280B3D8BB297254FDAF667C7CE942076440C3B7540F691E143E22E3938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-25_cf8362d377dd3e27f8db0a491100225e_amadey_elex_smoke-loader_stealc_tofsee

.exe 227KB

2026-07-25_cf8362d377dd3e27f8db0a491100225e_amadey_elex_smoke-loader_stealc_tofsee

IMPHASH a67305e264575f152a70cdf2c11c428f
SHA256 b178a9329fd64ea6ee3cd5d4f2dbee6182f4d8bef6c04807020153bd294b3acc
MD5 cf8362d377dd3e27f8db0a491100225e
SHA1 880e739bd5c6dfa8123be60ec8bf4b9d672b3fe3
SHA512 70f85b1091e3cb7174a2512e65cb3c9fdd96778caecd457e096651fa7c52570d31c1286d69fb029e73a17b0369d11eecccd936b40a3e7bd6388b4c583c115b1a
SSDEEP 6144:QBC4T359LKgsblsifZhptKBuX3vOir6ozN4S:QBCubL1sb2ifptKYX3r5
TLSH
T1D0348D36B69280B3D8BB297254FDAF667C7CE942076440C3B7540F691E143E22E3938B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

bf:7b:3e:4f:f6:de:32:39:bb:3c:07:a1:35:98:40:4f:f6:1e:2a:65:6b:1c:62:7a:e8:98:ca:38:ee:b4:6a:be

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 21, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Digest

5b:e5:b9:81:d0:17:71:01:4a:b7:53:ed:91:15:07:13:38:2d:f8:b3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

May 21, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

21:e3:17:fd:88:8c:97:04:e6:1d:e9:b0

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2025 - Jul 17, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

105196

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\nsmsrc\nsm\1412\1412\client32\Release\NSClientTB.pdb

comctl32

ImageList_GetImageCount ImageList_DrawEx ImageList_Create ImageList_ReplaceIcon ImageList_LoadImageA ImageList_AddMasked _TrackMouseEvent ImageList_Draw ImageList_Destroy

kernel32

TerminateProcess RaiseException ResetEvent OpenThread LocalAlloc GetExitCodeThread WaitForMultipleObjects LoadLibraryExA LocalFree SuspendThread ResumeThread DeleteFileA GlobalGetAtomNameA SetUnhandledExceptionFilter CreateFileW WriteConsoleW SetEndOfFile FlushFileBuffers GetConsoleMode SetStdHandle LoadLibraryW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointer IsProcessorFeaturePresent GetFileType SetHandleCount GetStringTypeW RtlUnwind InitializeCriticalSectionAndSpinCount HeapSize LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameW GetStdHandle GetModuleHandleW HeapCreate IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW HeapSetInformation GetCommandLineA DecodePointer EncodePointer HeapReAlloc VirtualQueryEx IsBadReadPtr GetThreadContext GetSystemDefaultLangID CreateThread SetEvent WaitForSingleObject ReadFile WriteFile GetProcessHeap HeapFree HeapAlloc CreateFileA WideCharToMultiByte GetTempPathA GetVersion OutputDebugStringA GetModuleHandleA GetLocalTime SetLastError CreateEventA GetProcessTimes GetSystemTimeAsFileTime GetCurrentProcess ExitProcess MultiByteToWideChar GetCurrentProcessId CloseHandle GetModuleFileNameA OpenProcess GetVersionExA LoadLibraryA GetProcAddress FreeLibrary GetCurrentThreadId IsDBCSLeadByte GetLastError InterlockedDecrement InterlockedIncrement GlobalAddAtomA GlobalDeleteAtom DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetThreadPriority SetThreadPriority Sleep GetCurrentThread GetTickCount GetConsoleCP

user32

GetMenuItemCount GetMenuItemInfoA GetKeyState GetMenuItemID InsertMenuItemA CheckMenuItem SetMenu EnableMenuItem TrackPopupMenuEx InflateRect GetMessageA GetGuiResources TranslateMessage MessageBoxA GetMonitorInfoA MonitorFromRect PostQuitMessage PeekMessageA SetWindowsHookExA DispatchMessageA EndPaint ClientToScreen DestroyWindow IsChild GetTopWindow SetCapture IsZoomed DrawTextA GetPropA GetSubMenu LoadStringA LoadBitmapA LoadMenuA RemovePropA IsWindowEnabled GetClientRect SetRectEmpty BeginPaint GetUpdateRect GetDC GetCapture OffsetRect CopyIcon SetRect SetWindowLongA IntersectRect InvalidateRect GetWindowLongA ReleaseDC GetDlgItem GetSysColor MoveWindow GetWindow RegisterClassA LoadCursorA FindWindowA CallWindowProcA UpdateWindow GetSystemMetrics PostMessageA CallNextHookEx CreatePopupMenu GetActiveWindow AppendMenuA wvsprintfA EqualRect DeferWindowPos SystemParametersInfoA ReleaseCapture MapWindowPoints EnableWindow DestroyMenu SetMenuItemInfoA GetDlgCtrlID DestroyIcon CopyRect wsprintfA GetClassNameA SetTimer GetWindowRect SendDlgItemMessageA KillTimer GetParent SendMessageA RegisterWindowMessageA EnumWindows PtInRect GetForegroundWindow GetWindowTextA SetPropA CreateWindowExA DefWindowProcA GetDesktopWindow SetWindowPos GetCursorPos ShowWindow GetClassInfoA IsWindow GetMenu

gdi32

ExtTextOutA CreateDIBitmap BitBlt PatBlt GetTextExtentPoint32A LineTo SetTextColor DeleteDC GetDeviceCaps CreateFontIndirectA SetBkColor CreateDCA SetPixel SetBkMode DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap GetTextExtentPointA CreatePatternBrush CreatePen GetTextMetricsA RectVisible CreateSolidBrush GetObjectA MoveToEx GetStockObject

advapi32

RegOpenKeyExA RegCloseKey OpenProcessToken GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA

shell32

ExtractIconExA SHAppBarMessage

winmm

timeGetTime

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-25_cf8362d377dd3e27f8db0a491100225e_amadey_elex_smoke-loader_stealc_tofsee

comctl32

kernel32

user32

gdi32

advapi32

shell32

winmm

version

generic