2026-08-04_4e29d5676555deb5aa1f943f830b95e7_amadey_elex_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_4e29d5676555deb5aa1f943f830b95e7_amadey_elex_smoke-loader_stealc_stop_tofsee
Size 1.4MB
Sample260805-bb2llasvhs
SHA256 a52a754e49b7f577f51fcd6d8762224507c7f917a8b39241a1e9476243200828
MD5 4e29d5676555deb5aa1f943f830b95e7
SHA1 1a97cee062140ef887108cada7fe68dbdbe70a1e
SHA512 9845d73ba65aa332848035a14d67e79c841a0ef7079f4471bc5ae610c5a8c20dc6037cef75dc464ae51992727bd50a00dd0aeed52ab300d4e98528797c58c850
SSDEEP 24576:b0lD8r4Z6g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b0lDC4Z6gLNiXicJFFRGNzj3
TLSH
T14365012134C68077E4A620364FB8DA79A51CFF714B2718E773C42B5E1A70AD75B3922B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_4e29d5676555deb5aa1f943f830b95e7_amadey_elex_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-04_4e29d5676555deb5aa1f943f830b95e7_amadey_elex_smoke-loader_stealc_stop_tofsee

.exe 1.4MB

2026-08-04_4e29d5676555deb5aa1f943f830b95e7_amadey_elex_smoke-loader_stealc_stop_tofsee

IMPHASH 27332499b5c45c26aabd060957e517ad
SHA256 a52a754e49b7f577f51fcd6d8762224507c7f917a8b39241a1e9476243200828
MD5 4e29d5676555deb5aa1f943f830b95e7
SHA1 1a97cee062140ef887108cada7fe68dbdbe70a1e
SHA512 9845d73ba65aa332848035a14d67e79c841a0ef7079f4471bc5ae610c5a8c20dc6037cef75dc464ae51992727bd50a00dd0aeed52ab300d4e98528797c58c850
SSDEEP 24576:b0lD8r4Z6g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b0lDC4Z6gLNiXicJFFRGNzj3
TLSH
T14365012134C68077E4A620364FB8DA79A51CFF714B2718E773C42B5E1A70AD75B3922B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61353

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\jdomingo\Desktop\CxUtilityService-AUDBI\CxUtilSvc\Release\CxUtilSvc.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

setupapi

SetupDiClassGuidsFromNameA SetupDiGetClassDevsExA SetupDiGetDeviceRegistryPropertyA SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList SetupDiDestroyDriverInfoList SetupDiEnumDeviceInfo

kernel32

TerminateProcess OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot InterlockedIncrement CopyFileW DeleteFileW CreateDirectoryW FindResourceExW GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType LockResource GetLocaleInfoEx Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetPrivateProfileStringW GetCommandLineW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary InterlockedDecrement SetEvent GetCurrentThreadId CreateEventW CreateThread Sleep GetCurrentThread GetCurrentProcess GetModuleFileNameW lstrcmpiW GetModuleHandleW GetProcAddress DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW WaitForSingleObject CreateFileW CloseHandle LoadLibraryW GetStringTypeW FlushFileBuffers SetStdHandle WriteConsoleW SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW WideCharToMultiByte IsValidCodePage GetOEMCP GetACP GetCPInfo IsProcessorFeaturePresent SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc HeapCreate GetStdHandle WriteFile ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW HeapSetInformation DecodePointer EncodePointer RtlUnwind HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap

user32

DispatchMessageW CharNextW TranslateMessage LoadStringW PostThreadMessageW GetMessageW MessageBoxW CharUpperW

advapi32

OpenProcessToken RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegEnumValueA RegDeleteKeyA RegQueryValueExA ChangeServiceConfigW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW AllocateAndInitializeSid FreeSid OpenThreadToken SetSecurityDescriptorDacl RegEnumKeyExW ControlService DeleteService CreateServiceW InitializeAcl AddAccessAllowedAce GetAclInformation AddAce GetAce GetTokenInformation SetSecurityDescriptorGroup SetSecurityDescriptorOwner InitializeSecurityDescriptor IsValidSid GetLengthSid CopySid RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource OpenSCManagerW OpenServiceW CloseServiceHandle

shell32

SHGetFolderPathA SHGetFolderPathAndSubDirA

ole32

CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoRevokeClassObject CoRegisterClassObject CoTaskMemFree StringFromGUID2 CoCreateInstance CoInitializeSecurity CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoInitializeEx

oleaut32

LoadRegTypeLi SysAllocStringByteLen SysStringByteLen VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_4e29d5676555deb5aa1f943f830b95e7_amadey_elex_smoke-loader_stealc_stop_tofsee

version

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic