2026-08-04_9010c6368f1a4ceff205c0129f5991c8_amadey_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_9010c6368f1a4ceff205c0129f5991c8_amadey_elex_smoke-loader_stop
Size 200KB
Sample260804-sdaz4azzav
SHA256 1c805f71b19aed9680a20e04443e4205506fb8032ddb650ae1414a86cdc4d38d
MD5 9010c6368f1a4ceff205c0129f5991c8
SHA1 90f2a523472956f056516ef4f47e70c1c15d0197
SHA512 9bfa2f3953b6bb00098c1e235f2fd4bc55eec39c4e54bd5d70b7724e4c6e4df9eee739e97749810004f1167ceab6513e0b5c4bc4304f362c75200dbae0ab858e
SSDEEP 3072:BH80ez8a0V0T4d5djIHHZAkS+0kj/mbQdbdZYWawkCPThYId+q:BHnezL0V0TwdjInqkSdkTjWwtEq
TLSH
T16E146C32FA818075D852467B4DFA577AD632F22D436280D377D82F99CB113E1A3BA349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-04_9010c6368f1a4ceff205c0129f5991c8_amadey_elex_smoke-loader_stop

.exe 200KB

2026-08-04_9010c6368f1a4ceff205c0129f5991c8_amadey_elex_smoke-loader_stop

IMPHASH 9650e817b3cb00cab1310c3a0f8690cc
SHA256 1c805f71b19aed9680a20e04443e4205506fb8032ddb650ae1414a86cdc4d38d
MD5 9010c6368f1a4ceff205c0129f5991c8
SHA1 90f2a523472956f056516ef4f47e70c1c15d0197
SHA512 9bfa2f3953b6bb00098c1e235f2fd4bc55eec39c4e54bd5d70b7724e4c6e4df9eee739e97749810004f1167ceab6513e0b5c4bc4304f362c75200dbae0ab858e
SSDEEP 3072:BH80ez8a0V0T4d5djIHHZAkS+0kj/mbQdbdZYWawkCPThYId+q:BHnezL0V0TwdjInqkSdkTjWwtEq
TLSH
T16E146C32FA818075D852467B4DFA577AD632F22D436280D377D82F99CB113E1A3BA349
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

d8:d2:d7:e9:5c:01:44:c9:d4:eb:10:4d:62:44:35:9c:1b:98:d6:8c:36:af:12:5d:93:17:cf:68:e0:9c:64:5d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

Apr 7, 2026

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Serial Number

04:4c:41:86:39:d4:52:74:47:0b:f1:a5:fa:de:a0:18

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2025 - May 20, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

107808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\dev\everything\cli\vs2005\Win32\Release\es.pdb

kernel32

CloseHandle ReadFile GetFileSize GetStdHandle ExitProcess LoadLibraryA GetVersionExA WriteFile SetConsoleTextAttribute FileTimeToSystemTime FillConsoleOutputAttribute GetConsoleScreenBufferInfo GetLastError Sleep GetTickCount SetConsoleCursorPosition GetLocalTime SystemTimeToFileTime GetModuleHandleA WaitForSingleObject OpenProcess SetConsoleScreenBufferSize SetStdHandle SetConsoleWindowInfo GetCommandLineW GetFileType GetConsoleMode GetConsoleCP SetLastError HeapAlloc GetProcessHeap HeapFree MoveFileExW LocalFileTimeToFileTime FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime FreeLibrary CompareStringA GetModuleFileNameA GetWindowsDirectoryA GetSystemDirectoryA InterlockedExchange HeapSize GetLocaleInfoA GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings SetHandleCount GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualAlloc HeapReAlloc RtlUnwind LCMapStringA GetStringTypeA

user32

GetWindowThreadProcessId TranslateMessage WaitMessage DestroyWindow PostQuitMessage

shell32

SHGetSpecialFolderLocation ord155

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_9010c6368f1a4ceff205c0129f5991c8_amadey_elex_smoke-loader_stop

kernel32

user32

shell32

generic