2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader
Size 14.6MB
Sample260728-e686psar9x
SHA256 cc421f4b22a36888891c64e45d003f18e42396e4a6fcfb77bbf94e783c8e642b
MD5 a3e282f3e33c11c8660d2695847417be
SHA1 05d6215a96b21d23c87e0f8ea82c5e51b58d6bff
SHA512 310c2a0ffe8bc3025fa08c3b31fe7bd0578db328882e0827c239c85aa0e9d6f1aeba44993bcf7b7a2bd3d7aa1d54e136b05e2f5bc278525be20769db4ceca477
SSDEEP 393216:OeJWGhrr2GcT9nKF/jwOlhjriPt1b+yOAVZiqUz:yGhwKF/jXRkt1b+yhZiqUz
TLSH
T10EF63306B286C872C550167164771BFA9B313D12FE25DC6A6368BECD2CF13D119BA2CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader

File Explorer

2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader

.exe 14.6MB

2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader

IMPHASH 8b6130a51e22ee5ae74880b8b58d6211
SHA256 cc421f4b22a36888891c64e45d003f18e42396e4a6fcfb77bbf94e783c8e642b
MD5 a3e282f3e33c11c8660d2695847417be
SHA1 05d6215a96b21d23c87e0f8ea82c5e51b58d6bff
SHA512 310c2a0ffe8bc3025fa08c3b31fe7bd0578db328882e0827c239c85aa0e9d6f1aeba44993bcf7b7a2bd3d7aa1d54e136b05e2f5bc278525be20769db4ceca477
SSDEEP 393216:OeJWGhrr2GcT9nKF/jwOlhjriPt1b+yOAVZiqUz:yGhwKF/jXRkt1b+yhZiqUz
TLSH
T10EF63306B286C872C550167164771BFA9B313D12FE25DC6A6368BECD2CF13D119BA2CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

WSACleanup WSAStartup send socket htons connect WSAAsyncSelect WSAGetLastError shutdown recv setsockopt closesocket ioctlsocket gethostbyname

kernel32

lstrcpyA lstrlenA _lwrite SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime _lclose GetProcAddress LoadLibraryA _lcreat GetPrivateProfileStringA GetPrivateProfileIntA GlobalLock GlobalAlloc GlobalFree GlobalUnlock GetTempFileNameA lstrcatA FreeLibrary DeleteFileA _llseek lstrcmpA _lread GetCommandLineA CloseHandle GetFileTime CreateFileA FreeResource LockResource LoadResource SizeofResource FindResourceA GetExitCodeProcess WaitForSingleObject GetModuleFileNameA CreateDirectoryA GetSystemDirectoryA GetVersionExA MulDiv GetUserDefaultLangID SetCurrentDirectoryA lstrcmpiA ExpandEnvironmentStringsA Sleep GetFileSize ExitProcess _lopen SetEnvironmentVariableA GetModuleHandleA SetErrorMode GetTempPathA GetCurrentProcess

user32

GetDC MessageBoxA DestroyWindow CharNextA LoadStringA SendMessageA GetDlgItem EnumChildWindows ReleaseDC EndDialog GetDlgItemTextA wsprintfA SetDlgItemTextA CreateDialogParamA ExitWindowsEx EnableWindow ShowWindow SetTimer DialogBoxParamA TranslateMessage DispatchMessageA SetWindowTextA PeekMessageA

gdi32

GetDeviceCaps DeleteObject CreateFontA

advapi32

LookupPrivilegeValueA RegDeleteValueA RegEnumValueA OpenSCManagerA CloseServiceHandle OpenProcessToken RegCloseKey AdjustTokenPrivileges RegCreateKeyExA RegSetValueExA RegQueryValueA RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader

wsock32

kernel32

user32

gdi32

advapi32

shell32

generic