2026-07-30_d15b93e05731aa5c6445399361cca9c9_amadey_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_d15b93e05731aa5c6445399361cca9c9_amadey_elex_smoke-loader_stop
Size 23.1MB
Sample260730-bjgamawerg
SHA256 f344d15a0439459cff6e0ab364666941d21c3f0f5491e0d100e5b2a793158fe7
MD5 d15b93e05731aa5c6445399361cca9c9
SHA1 aa85342c14ce64a160a1f1a9521deca5a8dae34f
SHA512 673e085361b94412fb0b0546e21f5b5a466fde450d4a3c1b50f7d44c0fca67b4108f2479b1a21c2c24596dc190707335daa73e8bd516e7ce416ddfb8067c22b1
SSDEEP 393216:AW8byQhMCvE3P5cWHGY39JpBpXtpfMdCK/B+hjyOGC81IheFYi1Ezg4bncPcI5rw:AW8byCMCvE3P5cWHN3hBpXtpfMdCK/B0
TLSH
T18637E006FB8741F4DB8921700DAE6B6AB9775B894F202EC373943D9E94362D158332DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_d15b93e05731aa5c6445399361cca9c9_amadey_elex_smoke-loader_stop

File Explorer

2026-07-30_d15b93e05731aa5c6445399361cca9c9_amadey_elex_smoke-loader_stop

.exe 23.1MB

2026-07-30_d15b93e05731aa5c6445399361cca9c9_amadey_elex_smoke-loader_stop

IMPHASH c1b41086c427213c85372ba761070760
SHA256 f344d15a0439459cff6e0ab364666941d21c3f0f5491e0d100e5b2a793158fe7
MD5 d15b93e05731aa5c6445399361cca9c9
SHA1 aa85342c14ce64a160a1f1a9521deca5a8dae34f
SHA512 673e085361b94412fb0b0546e21f5b5a466fde450d4a3c1b50f7d44c0fca67b4108f2479b1a21c2c24596dc190707335daa73e8bd516e7ce416ddfb8067c22b1
SSDEEP 393216:AW8byQhMCvE3P5cWHGY39JpBpXtpfMdCK/B+hjyOGC81IheFYi1Ezg4bncPcI5rw:AW8byCMCvE3P5cWHN3hBpXtpfMdCK/B0
TLSH
T18637E006FB8741F4DB8921700DAE6B6AB9775B894F202EC373943D9E94362D158332DE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22694265

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

InitializeCriticalSection GetProcAddress LocalFree RaiseException LocalAlloc GetModuleHandleA LeaveCriticalSection EnterCriticalSection GetShortPathNameA ResumeThread WriteProcessMemory GetPrivateProfileSectionA GetStringTypeA LCMapStringW LCMapStringA RtlUnwind WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers VirtualQuery

user32

DefWindowProcA AdjustWindowRectEx

Name

Size

8.1MB

Virtual Size

8.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

152KB

Virtual Size

932KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yTp

Size

23KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

71KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

28KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Xgo

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.2]L

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Dm-

Size

9.6MB

Virtual Size

9.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_d15b93e05731aa5c6445399361cca9c9_amadey_elex_smoke-loader_stop

kernel32

user32

generic