2026-08-09_49079f7a5e32b828488caa38ddd75cfc_amadey_elex_smoke-loader_stop

General

Target
2026-08-09_49079f7a5e32b828488caa38ddd75cfc_amadey_elex_smoke-loader_stop
Size 672KB
Sample260809-rtfd3sgm6s
SHA256 2f0a01f8c7d27e7fdacdc9d1743c1591451ea3b54d366c22bce11d26d33ab68f
MD5 49079f7a5e32b828488caa38ddd75cfc
SHA1 e8eeea2c4b2423112834c8a88c3dd8354cbaee66
SHA512 f87b29415bcfc4a9c3c4b4c70e32aa45b2281e2bda84be207a72174fd2b9b48bdf585973bdaf9236de2279bd2f418b5775b6f6384be24e85f9ff623f88695d85
SSDEEP 12288:RSFMr4s4OrYXV6GgRh5WdFhYlI4HxKF8R92kCfem:L3kdDCHxKk9Gem
TLSH
T1BAE4BF2272C2C4B2D0B263FE599793795E33B52257325CD35BD12AECAA201F1673DB84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_49079f7a5e32b828488caa38ddd75cfc_amadey_elex_smoke-loader_stop

File Explorer

2026-08-09_49079f7a5e32b828488caa38ddd75cfc_amadey_elex_smoke-loader_stop

.exe 672KB

2026-08-09_49079f7a5e32b828488caa38ddd75cfc_amadey_elex_smoke-loader_stop

IMPHASH 5c4d5775857bdbf9d866f5561890ced2
SHA256 2f0a01f8c7d27e7fdacdc9d1743c1591451ea3b54d366c22bce11d26d33ab68f
MD5 49079f7a5e32b828488caa38ddd75cfc
SHA1 e8eeea2c4b2423112834c8a88c3dd8354cbaee66
SHA512 f87b29415bcfc4a9c3c4b4c70e32aa45b2281e2bda84be207a72174fd2b9b48bdf585973bdaf9236de2279bd2f418b5775b6f6384be24e85f9ff623f88695d85
SSDEEP 12288:RSFMr4s4OrYXV6GgRh5WdFhYlI4HxKF8R92kCfem:L3kdDCHxKk9Gem
TLSH
T1BAE4BF2272C2C4B2D0B263FE599793795E33B52257325CD35BD12AECAA201F1673DB84
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\p4client\dev\ThirdParties\tcsh\tcsh-x86.pdb

user32

MessageBeep GetMessageA DispatchMessageA TranslateMessage RegisterClassA IsClipboardFormatAvailable GetClipboardData OpenClipboard EmptyClipboard SetClipboardData CloseClipboard DefWindowProcA PostQuitMessage CreateWindowExA UpdateWindow ExitWindowsEx EnumWindows PostMessageA GetWindowThreadProcessId GetWindowTextA wvsprintfA LoadStringA LoadStringW OemToCharA wsprintfA MessageBoxA

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegQueryValueExA RegCloseKey GetUserNameA OpenProcessToken

kernel32

VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsValidLocale EnumSystemLocalesA QueryPerformanceCounter GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetFullPathNameA GetStartupInfoA SetHandleCount GetTimeZoneInformation GetStringTypeW GetStringTypeA CompareStringA CompareStringW HeapSize GetLocaleInfoW FlushFileBuffers GetConsoleOutputCP GetLocaleInfoA HeapReAlloc ExitProcess GetCurrentProcessId Sleep GetLastError ReadFile WriteFile HeapFree ReadConsoleInputA HeapAlloc GetProcessHeap WaitForMultipleObjects WriteConsoleA GetFileType GetStdHandle CloseHandle DuplicateHandle GetCurrentProcess GetBinaryTypeA GetFileAttributesA SetFilePointer SetStdHandle CreatePipe CreateFileA lstrcmpA GetProcAddress LoadLibraryA lstrlenA lstrcmpiA FindFirstFileA FindClose FindNextFileA DeleteCriticalSection SetEvent LeaveCriticalSection EnterCriticalSection WaitForSingleObject CreateThread CreateEventA ResumeThread SuspendThread GetExitCodeProcess GenerateConsoleCtrlEvent TerminateProcess OpenProcess SetThreadPriority GetCurrentThread SetPriorityClass InitializeCriticalSection SetConsoleCtrlHandler SetProcessAffinityMask GetProcessAffinityMask GetCurrentDirectoryA GetSystemInfo GetVersionExA GetComputerNameA FreeLibrary SetEnvironmentVariableA GetWindowsDirectoryA GetEnvironmentVariableA VirtualAlloc DeleteFileA CreateProcessA GetThreadPriority GetPriorityClass WideCharToMultiByte GetConsoleCP GetTickCount GetProcessTimes FillConsoleOutputAttribute CreateConsoleScreenBuffer GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode FillConsoleOutputCharacterA SetConsoleCursorPosition SetConsoleActiveScreenBuffer SetConsoleWindowInfo ScrollConsoleScreenBufferA SetConsoleScreenBufferSize SetConsoleTextAttribute OpenEventA WriteProcessMemory VirtualAllocEx ResetEvent GetModuleFileNameA GetModuleHandleA FormatMessageA SetConsoleTitleA GetConsoleTitleA SetLastError OutputDebugStringA GetOverlappedResult SearchPathA GlobalUnlock GlobalFree GlobalLock GlobalAlloc GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter WriteConsoleW GetModuleFileNameW RtlUnwind InterlockedDecrement GetCPInfo FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetDriveTypeA SetCurrentDirectoryA InterlockedIncrement IsDebuggerPresent GetCommandLineA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId FatalAppExitA InterlockedExchange GetACP GetOEMCP IsValidCodePage LoadLibraryW LCMapStringA MultiByteToWideChar LCMapStringW

Name

.text

Size

492KB

Virtual Size

489KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

48KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fusrdat

Size

20KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_49079f7a5e32b828488caa38ddd75cfc_amadey_elex_smoke-loader_stop

user32

advapi32

kernel32

generic