2026-08-12_8f213bfe1784a61bec3600feb1502237_amadey_badda_elex_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_8f213bfe1784a61bec3600feb1502237_amadey_badda_elex_smoke-loader_stealc
Size 261KB
Sample260813-azvbrawya1
SHA256 d1841111e445e1beea70d780bb42220c1ef04f656a4c43fda8d920a67b1ee43f
MD5 8f213bfe1784a61bec3600feb1502237
SHA1 a503e438cc10a74e1fcb173febae3bd6bbc07d5b
SHA512 a5b69bbfd6b27819d30dfbe70897b6b71f5131928b83837f3fd5e1303a885c012d0ea940b3994a918569ee9247d33e9680760e60075a23c54c11ad1d51091916
SSDEEP 6144:/dkiC5hwHspYalIRnuCC8dLAyzWcWpyo7dv:/dknQMCaCRtjlJz5W5dv
TLSH
T146445A6137E09032E5B3193059B9D731497FBC366971C58E63983A2D2E32BD0C9B5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_8f213bfe1784a61bec3600feb1502237_amadey_badda_elex_smoke-loader_stealc

File Explorer

2026-08-12_8f213bfe1784a61bec3600feb1502237_amadey_badda_elex_smoke-loader_stealc

.exe 261KB

2026-08-12_8f213bfe1784a61bec3600feb1502237_amadey_badda_elex_smoke-loader_stealc

IMPHASH 0681a4c7a9b345a39225394cd491fbb0
SHA256 d1841111e445e1beea70d780bb42220c1ef04f656a4c43fda8d920a67b1ee43f
MD5 8f213bfe1784a61bec3600feb1502237
SHA1 a503e438cc10a74e1fcb173febae3bd6bbc07d5b
SHA512 a5b69bbfd6b27819d30dfbe70897b6b71f5131928b83837f3fd5e1303a885c012d0ea940b3994a918569ee9247d33e9680760e60075a23c54c11ad1d51091916
SSDEEP 6144:/dkiC5hwHspYalIRnuCC8dLAyzWcWpyo7dv:/dknQMCaCRtjlJz5W5dv
TLSH
T146445A6137E09032E5B3193059B9D731497FBC366971C58E63983A2D2E32BD0C9B5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

356352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\re\jdk7u45\229\build\windows-i586\tmp\deploy\jre-image\bin\javaws.pdb

kernel32

LoadLibraryW GetModuleHandleW FreeLibrary GetProcAddress GetTickCount GetThreadLocale ReadFile CloseHandle WaitForSingleObject SetHandleInformation CreatePipe CreateDirectoryW GetSystemWindowsDirectoryW FindClose FindFirstFileW GetModuleFileNameW InterlockedIncrement GlobalMemoryStatusEx GetVersionExW GetCurrentProcess GetNativeSystemInfo GetLastError CreateFileW GetSystemDirectoryW CreateProcessW lstrlenW LocalAlloc FormatMessageW GetLongPathNameW GetShortPathNameW InterlockedDecrement GetWindowsDirectoryW OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetModuleHandleExW GetFileAttributesW lstrlenA GetExitCodeProcess WriteConsoleW FlushFileBuffers HeapSize CompareStringW LCMapStringW QueryPerformanceCounter GetProcessHeap SetEndOfFile SetFilePointer SetStdHandle GetConsoleMode GetConsoleCP SetHandleCount Sleep SetEnvironmentVariableW SetEnvironmentVariableA DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle WriteFile HeapCreate IsProcessorFeaturePresent LocalFree InterlockedExchange LoadLibraryA RaiseException FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW WideCharToMultiByte GetSystemTimeAsFileTime HeapFree HeapReAlloc HeapAlloc GetStringTypeW ExitProcess DecodePointer MultiByteToWideChar RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteFileW GetFileType GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetCommandLineW HeapSetInformation GetStartupInfoW GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError

user32

LoadCursorW DefWindowProcW DispatchMessageW TranslateMessage GetMessageW SetTimer CreateWindowExW RegisterClassW wsprintfW MessageBoxW

ole32

StringFromCLSID CoTaskMemFree

oleaut32

SysFreeString VariantClear SysAllocString SysStringLen SysAllocStringByteLen

wsock32

closesocket WSAAsyncSelect connect htons getsockname ioctlsocket socket bind recv accept ntohs listen WSAStartup send WSAGetLastError

Name

.text

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.BadDay

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_8f213bfe1784a61bec3600feb1502237_amadey_badda_elex_smoke-loader_stealc

kernel32

user32

ole32

oleaut32

wsock32

generic