2026-07-28_98806fdb506ae720460fdc019b07a6f7_amadey_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_98806fdb506ae720460fdc019b07a6f7_amadey_elex_smoke-loader_stop
Size 7.8MB
Sample260728-2d36baar6v
SHA256 75e58aa6ba9a4e3dd12dc87fe518404761580c8387ebe755c5f391d1e24ffad2
MD5 98806fdb506ae720460fdc019b07a6f7
SHA1 8c52362158d67375594c54e5d88456489e4e74c0
SHA512 725029408a52e2b5bbe843278c57b2c3bd52e1d7ff3864075a0f4f6422a4ce5ec3f9041dc5b8f4a1ad5cd2a333a6e8cba0fc92f8184248d8ae4c65310b06cf91
SSDEEP 196608:GNfRF7cV3cuKgrGawrPQCmkj2NbfMvNZOI+qoKC+T33V+az:4s4N9cCmkjYbfMVZOIGGHV+az
TLSH
T1F286337EE186C89EC1460631588393746E725C625FC8AEE7B36DF538AA300D3B6BF544
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-28_98806fdb506ae720460fdc019b07a6f7_amadey_elex_smoke-loader_stop

File Explorer

2026-07-28_98806fdb506ae720460fdc019b07a6f7_amadey_elex_smoke-loader_stop

.exe 7.8MB

2026-07-28_98806fdb506ae720460fdc019b07a6f7_amadey_elex_smoke-loader_stop

IMPHASH 34d5a649297c705f9406a6d203caf679
SHA256 75e58aa6ba9a4e3dd12dc87fe518404761580c8387ebe755c5f391d1e24ffad2
MD5 98806fdb506ae720460fdc019b07a6f7
SHA1 8c52362158d67375594c54e5d88456489e4e74c0
SHA512 725029408a52e2b5bbe843278c57b2c3bd52e1d7ff3864075a0f4f6422a4ce5ec3f9041dc5b8f4a1ad5cd2a333a6e8cba0fc92f8184248d8ae4c65310b06cf91
SSDEEP 196608:GNfRF7cV3cuKgrGawrPQCmkj2NbfMvNZOI+qoKC+T33V+az:4s4N9cCmkjYbfMVZOIGGHV+az
TLSH
T1F286337EE186C89EC1460631588393746E725C625FC8AEE7B36DF538AA300D3B6BF544
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ca:33:6c:35:eb:cf:0e:7e:3d:57:61:0b:8c:94:f7:f6:e2:71:35:3e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Chains

Jul 7, 2008

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Serial Number

48:ee:2c:9d:ad:71:45:09:44:a1:13:71:a8:0c:00:69

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 21, 2008 - Apr 23, 2011

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

89132

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\ccview$\ase_installers_main\ase_installers\utilities\pacman\release\PackageManager.pdb

kernel32

GetFileAttributesA DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime SetFileAttributesA FindResourceA GetModuleFileNameA LoadLibraryA LoadResource SizeofResource LockResource FreeLibrary CreateDirectoryA CopyFileA BeginUpdateResourceA UpdateResourceA EndUpdateResourceA DeleteFileA GetLastError WriteFile CreateProcessA FileTimeToDosDateTime GetExitCodeProcess FindFirstFileA FindNextFileA FindClose GetFileSize ReadFile SetLastError RemoveDirectoryA CreateEventA CreateThread SetEvent SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoA FileTimeToLocalFileTime CloseHandle GetFileInformationByHandle WaitForSingleObject CreateFileA GetStringTypeW GetStringTypeA SetEndOfFile HeapFree HeapAlloc MultiByteToWideChar WideCharToMultiByte GetConsoleCP GetConsoleMode SetFilePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetVersionExA GetProcessHeap GetStartupInfoA RaiseException RtlUnwind HeapDestroy HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc SetStdHandle GetFileType SetHandleCount GetStdHandle GetProcAddress GetModuleHandleA ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement Sleep WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCPInfo GetACP GetOEMCP LCMapStringA LCMapStringW HeapSize FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSection FlushFileBuffers

user32

SetWindowTextA SetDlgItemTextA LoadStringA EndDialog GetDlgItem DialogBoxParamA SendMessageA LoadImageA

gdi32

CreateFontIndirectA GetObjectA CreateSolidBrush DeleteObject

shell32

SHCreateDirectoryExA

shlwapi

PathRemoveFileSpecA PathFindFileNameA PathAddBackslashA PathAppendA PathRelativePathToA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_98806fdb506ae720460fdc019b07a6f7_amadey_elex_smoke-loader_stop

PE Signature issue

kernel32

user32

gdi32

shell32

shlwapi

generic