2026-08-09_c85498eea90e0ea3911928f1c43a71af_amadey_elex_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_c85498eea90e0ea3911928f1c43a71af_amadey_elex_njrat_smoke-loader
Size 1.3MB
Sample260809-tfcr5styes
SHA256 ccb6c0e3987c8c8db456f5075b51061782bb83926eda00f45f85bd38f5118eb9
MD5 c85498eea90e0ea3911928f1c43a71af
SHA1 64533ba01557d5635b04e221d873302e1d46aeab
SHA512 8ffd2f16be19d654cb5628d7f2519feb641c121893497ce64ba11506dda6c56272faaf71b2710c8e82af5d305cfcf97f4f08455af1340f4fc7d0dddfc045c427
SSDEEP 12288:y3uM4+nKTGrBOoFqFfuO9WFU94HIYjPpgKVMB8lirNPDsljVyjg4WGCIgLUA1De/:ye+CGeQOh9+VjPpg3B8lir16n4QIBAY
TLSH
T11B551553E6918EEAD7890432DF148150972AF12DABFF1271785C12C8EE53387BF65A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_c85498eea90e0ea3911928f1c43a71af_amadey_elex_njrat_smoke-loader

File Explorer

2026-08-09_c85498eea90e0ea3911928f1c43a71af_amadey_elex_njrat_smoke-loader

.exe 1.3MB

2026-08-09_c85498eea90e0ea3911928f1c43a71af_amadey_elex_njrat_smoke-loader

IMPHASH e52f8fc3e1a423f4bf0b7594819f81a6
SHA256 ccb6c0e3987c8c8db456f5075b51061782bb83926eda00f45f85bd38f5118eb9
MD5 c85498eea90e0ea3911928f1c43a71af
SHA1 64533ba01557d5635b04e221d873302e1d46aeab
SHA512 8ffd2f16be19d654cb5628d7f2519feb641c121893497ce64ba11506dda6c56272faaf71b2710c8e82af5d305cfcf97f4f08455af1340f4fc7d0dddfc045c427
SSDEEP 12288:y3uM4+nKTGrBOoFqFfuO9WFU94HIYjPpgKVMB8lirNPDsljVyjg4WGCIgLUA1De/:ye+CGeQOh9+VjPpg3B8lir16n4QIBAY
TLSH
T11B551553E6918EEAD7890432DF148150972AF12DABFF1271785C12C8EE53387BF65A2C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

325716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetLocalTime GetProcAddress LoadLibraryA SystemTimeToFileTime LoadLibraryW GetModuleHandleA GetCurrentProcess EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLastError CloseHandle WaitForSingleObject InitializeCriticalSection lstrlenW WideCharToMultiByte MoveFileExW GetTempFileNameW GetTempPathW DeleteFileW MoveFileW WriteFile ReadFile GetFileSize CreateFileW Process32NextW Process32FirstW CreateToolhelp32Snapshot TerminateProcess OpenProcess SleepEx SetFileAttributesW CreateProcessW GetModuleFileNameW GetComputerNameA Sleep GetSystemTime HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount LocalAlloc WaitForMultipleObjects VirtualQueryEx ReadProcessMemory Module32NextW Module32FirstW ProcessIdToSessionId SetEndOfFile WriteConsoleW SetStdHandle GetStringTypeW GetCommandLineW HeapSetInformation GetStartupInfoW RtlUnwind ExitThread GetCurrentThreadId CreateThread EncodePointer DecodePointer SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime IsProcessorFeaturePresent UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW MultiByteToWideChar SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers FreeLibrary InterlockedExchange

ole32

CoCreateInstance CoInitialize

shell32

ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathIsRootW PathFileExistsW PathRemoveExtensionW PathAddExtensionW PathAppendW

psapi

GetModuleFileNameExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Name

.text

Size

369KB

Virtual Size

369KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

232KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

XnEWNRaR

Size

3KB

Virtual Size

3KB

Characteristics

Name

fNgdDLOO

Size

2KB

Virtual Size

2KB

Characteristics

Name

VFzsaFWM

Size

2KB

Virtual Size

1KB

Characteristics

Name

qSlPMrNy

Size

25KB

Virtual Size

24KB

Characteristics

Name

ETEBECdN

Size

359KB

Virtual Size

359KB

Characteristics

Name

trlcBAPd

Size

29KB

Virtual Size

29KB

Characteristics

Name

TgVMUrqK

Size

1KB

Virtual Size

1KB

Characteristics

Name

xNJPKwQf

Size

165KB

Virtual Size

165KB

Characteristics

Name

DcaxBgsZ

Size

2KB

Virtual Size

2KB

Characteristics

Name

ZGgSsPUa

Size

12KB

Virtual Size

12KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_c85498eea90e0ea3911928f1c43a71af_amadey_elex_njrat_smoke-loader

kernel32

ole32

shell32

shlwapi

psapi

userenv

generic