2026-08-11_0eda4b1357cbc25d94a1eb4ed76678ba_amadey_dharma_elex_smoke-loader_stop

General

Target
2026-08-11_0eda4b1357cbc25d94a1eb4ed76678ba_amadey_dharma_elex_smoke-loader_stop
Size 423KB
Sample260811-efppda1shz
SHA256 c66638315bf122b2b4d58946ea8cfd51f8389aab1d36251698bc463b052d4d5e
MD5 0eda4b1357cbc25d94a1eb4ed76678ba
SHA1 8cf450b096f884f33992c218df2f92867d0a5992
SHA512 26a116e4fd14f7273eb8b035596937162c33f9ba1ea9020829df602be70765f765a7bbc50f221522176f956930e795dae73c5f20aee740c9d798d27b67f25380
SSDEEP 3072:J7b/RKk2yR0385rHjJB9m1wZIlEsy2jEpAI+smOPu6dMJ+qdgPKcgELtOwIHmH8H:lV03orHjJBNIlEsdKAI+s2+gCl8Zm4
TLSH
T170948D00B790D039E1B752F48A7AD7A8B92EBEE15B2451CB32C53AEE56356D0EC30317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_0eda4b1357cbc25d94a1eb4ed76678ba_amadey_dharma_elex_smoke-loader_stop

File Explorer

2026-08-11_0eda4b1357cbc25d94a1eb4ed76678ba_amadey_dharma_elex_smoke-loader_stop

.exe 423KB

2026-08-11_0eda4b1357cbc25d94a1eb4ed76678ba_amadey_dharma_elex_smoke-loader_stop

IMPHASH 64f41b6ccf70695431f3489f358e80d2
SHA256 c66638315bf122b2b4d58946ea8cfd51f8389aab1d36251698bc463b052d4d5e
MD5 0eda4b1357cbc25d94a1eb4ed76678ba
SHA1 8cf450b096f884f33992c218df2f92867d0a5992
SHA512 26a116e4fd14f7273eb8b035596937162c33f9ba1ea9020829df602be70765f765a7bbc50f221522176f956930e795dae73c5f20aee740c9d798d27b67f25380
SSDEEP 3072:J7b/RKk2yR0385rHjJB9m1wZIlEsy2jEpAI+smOPu6dMJ+qdgPKcgELtOwIHmH8H:lV03orHjJBNIlEsdKAI+s2+gCl8Zm4
TLSH
T170948D00B790D039E1B752F48A7AD7A8B92EBEE15B2451CB32C53AEE56356D0EC30317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

39952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\boyegepajef\xepic.pdb

kernel32

FindNextVolumeA HeapUnlock GetNamedPipeHandleStateA FileTimeToLocalFileTime FillConsoleOutputCharacterA VirtualAlloc TerminateProcess GetCurrentProcessId GetVersionExW EnumDateFormatsExA EnumResourceNamesW FindNextFileA CopyFileExW BuildCommDCBAndTimeoutsW SetDefaultCommConfigW WritePrivateProfileStructW HeapSetInformation CreateTimerQueueTimer ReadConsoleInputA WriteConsoleInputA GetSystemDirectoryW GetDriveTypeW VirtualProtect GetModuleHandleA GlobalAlloc GetBinaryTypeA GetProfileSectionA InterlockedDecrement ReadConsoleOutputCharacterW FindFirstChangeNotificationW VerifyVersionInfoA FormatMessageA SetDllDirectoryW PostQueuedCompletionStatus LoadLibraryA WritePrivateProfileStringW GetConsoleAliasesLengthA GetProcessHeap OpenWaitableTimerA SetConsoleTextAttribute InterlockedIncrement GetStartupInfoW GetSystemWow64DirectoryW GetConsoleAliasExesA DebugBreak EndUpdateResourceA SetLastError FatalAppExitW SetSystemTime OpenFileMappingW lstrcmpW SetConsoleActiveScreenBuffer ContinueDebugEvent InterlockedCompareExchange GlobalFix GetSystemWindowsDirectoryA CopyFileW TerminateThread GetACP GlobalFindAtomA lstrcatA SetSystemTimeAdjustment SetMailslotInfo CreateActCtxW _lread CreateNamedPipeA GetAtomNameA SetConsoleScreenBufferSize EnumResourceTypesA lstrlenA WriteConsoleW lstrcpyA ReadConsoleOutputA SetThreadContext BuildCommDCBW ReleaseActCtx GetStringTypeA GetPrivateProfileStringW GetDriveTypeA GetFileAttributesA OpenWaitableTimerW GetVolumePathNameA MoveFileW SetCommMask SetFileShortNameW VerLanguageNameW LockFile EndUpdateResourceW LoadLibraryW GetOverlappedResult FreeConsole GlobalGetAtomNameW SetComputerNameW GetConsoleAliasExesLengthW WriteConsoleInputW CreateMailslotW TzSpecificLocalTimeToSystemTime MoveFileExW DebugActiveProcess GetStringTypeExW EnumSystemLocalesA GetConsoleAliasExesLengthA FindActCtxSectionGuid MoveFileA ResetWriteWatch GetPrivateProfileIntW ProcessIdToSessionId GetTickCount GetModuleFileNameA GetConsoleAliasesLengthW GlobalWire FillConsoleOutputCharacterW GetCompressedFileSizeA SetThreadPriority MapUserPhysicalPages WriteConsoleOutputCharacterW EnumDateFormatsW TerminateJobObject CreateFileA GetDateFormatW GetBinaryTypeW HeapWalk lstrcatW RaiseException GetCommandLineA GetStartupInfoA HeapValidate IsBadReadPtr DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameW SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime GetModuleHandleW Sleep GetProcAddress ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree HeapDestroy HeapCreate HeapFree VirtualFree WriteFile HeapAlloc GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapSize HeapReAlloc GetOEMCP GetCPInfo IsValidCodePage RtlUnwind InitializeCriticalSectionAndSpinCount OutputDebugStringA OutputDebugStringW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP CloseHandle FlushFileBuffers

user32

GetCaretBlinkTime

advapi32

ImpersonateSelf

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_0eda4b1357cbc25d94a1eb4ed76678ba_amadey_dharma_elex_smoke-loader_stop

kernel32

user32

advapi32

generic