2026-07-27_960b7c3b8cd163def5395a233fc68ce0_amadey_elex_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_960b7c3b8cd163def5395a233fc68ce0_amadey_elex_smoke-loader_stealc_stop_tofsee
Size 1.3MB
Sample260727-pbbbasej7z
SHA256 f3a459dd0a14709eeb67be10dea29df87889f7baf02302fb596f42da1c19b093
MD5 960b7c3b8cd163def5395a233fc68ce0
SHA1 73761909ba3bf640430cc8d0a92b323a902ae586
SHA512 cb6b7a0d87f08925319bf60a46f1d8b66455ca91d99a27f4f5e3644ef01298e57cb498ea1828cf9deb0c38a0493e422033a2e93cbfe52c6d84c60842e96a5169
SSDEEP 12288:Ph/FavhfCj/WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDtL:PtFufCjusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E355022070D6807BD8A251318FE8E67E681AFF724F2608D773D52B6E1EB15D50B38627
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_960b7c3b8cd163def5395a233fc68ce0_amadey_elex_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-27_960b7c3b8cd163def5395a233fc68ce0_amadey_elex_smoke-loader_stealc_stop_tofsee

.exe 1.3MB

2026-07-27_960b7c3b8cd163def5395a233fc68ce0_amadey_elex_smoke-loader_stealc_stop_tofsee

IMPHASH 65192ed6bf9726984843cf1fc371e1b7
SHA256 f3a459dd0a14709eeb67be10dea29df87889f7baf02302fb596f42da1c19b093
MD5 960b7c3b8cd163def5395a233fc68ce0
SHA1 73761909ba3bf640430cc8d0a92b323a902ae586
SHA512 cb6b7a0d87f08925319bf60a46f1d8b66455ca91d99a27f4f5e3644ef01298e57cb498ea1828cf9deb0c38a0493e422033a2e93cbfe52c6d84c60842e96a5169
SSDEEP 12288:Ph/FavhfCj/WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDtL:PtFufCjusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E355022070D6807BD8A251318FE8E67E681AFF724F2608D773D52B6E1EB15D50B38627
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Conexant\Projects\Application_Components\CxUtilityService-AUDBI\trunk\CxUtilSvc\Release\CxUtilSvc.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

setupapi

SetupDiClassGuidsFromNameA SetupDiDestroyDeviceInfoList SetupDiGetClassDevsExA SetupDiEnumDeviceInfo SetupDiDestroyDriverInfoList SetupDiGetDeviceRegistryPropertyA SetupDiOpenDevRegKey

kernel32

TerminateProcess OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot InterlockedIncrement CopyFileW DeleteFileW CreateDirectoryW FindResourceExW GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType LockResource GetLocaleInfoEx Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetPrivateProfileStringW GetCommandLineW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary InterlockedDecrement SetEvent GetCurrentThreadId CreateEventW CreateThread Sleep GetCurrentThread GetCurrentProcess GetModuleFileNameW lstrcmpiW GetModuleHandleW GetProcAddress DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW WaitForSingleObject CloseHandle CreateFileW LoadLibraryW GetStringTypeW FlushFileBuffers SetStdHandle WriteConsoleW SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW WideCharToMultiByte IsValidCodePage GetOEMCP GetACP GetCPInfo IsProcessorFeaturePresent SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc HeapCreate GetStdHandle WriteFile ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW HeapSetInformation DecodePointer EncodePointer RtlUnwind GetProcessHeap HeapSize HeapDestroy HeapAlloc HeapFree HeapReAlloc

user32

TranslateMessage PostThreadMessageW DispatchMessageW LoadStringW CharNextW CharUpperW MessageBoxW GetMessageW

advapi32

OpenThreadToken RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegEnumValueA RegDeleteKeyA RegQueryValueExA ChangeServiceConfigW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW AllocateAndInitializeSid FreeSid OpenProcessToken SetSecurityDescriptorDacl RegEnumKeyExW ControlService DeleteService CreateServiceW InitializeAcl AddAccessAllowedAce GetAclInformation AddAce GetAce GetTokenInformation SetSecurityDescriptorGroup SetSecurityDescriptorOwner InitializeSecurityDescriptor IsValidSid GetLengthSid CopySid RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource OpenSCManagerW OpenServiceW CloseServiceHandle

shell32

SHGetFolderPathA SHGetFolderPathAndSubDirA

ole32

CoInitializeEx CoTaskMemAlloc CoTaskMemRealloc CoRevokeClassObject CoRegisterClassObject CoTaskMemFree StringFromGUID2 CoCreateInstance CoInitializeSecurity CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoUninitialize

oleaut32

SysStringLen SysAllocString LoadRegTypeLi SysAllocStringByteLen SysStringByteLen VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysFreeString

shlwapi

PathFileExistsA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_960b7c3b8cd163def5395a233fc68ce0_amadey_elex_smoke-loader_stealc_stop_tofsee

version

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic