2026-08-14_eec971053191b8e7e66cb83e4e6fed82_amadey_elex_nionspy_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_eec971053191b8e7e66cb83e4e6fed82_amadey_elex_nionspy_smoke-loader
Size 250KB
Sample260814-pbx53aserf
SHA256 caacb771eedf253d28f56012c32e609f7f924b8fa311e6fe374bc89ef4babd7e
MD5 eec971053191b8e7e66cb83e4e6fed82
SHA1 5daf33ad47edba812d8a4f7ec2b6359f2a8626e3
SHA512 e7cf6f75ca3c6606e8e50a09f16fb3a9cc440772dda54697e2ee5e70c382409f7474ba08893404af23a4455c4b840ce084efcfc84e27d00a1e046ca4a161323e
SSDEEP 6144:cd208gooGwxCo0WD2zIUQuHDv41URN/IKjyRSzDT:cdj8goyd0WfXuHDv46RNQKjP
TLSH
T1B0448E50A6D1C472C4B7257000BBAAA20D7C36352B36F5D3F7642BA49D602E1FE7936E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_eec971053191b8e7e66cb83e4e6fed82_amadey_elex_nionspy_smoke-loader

File Explorer

2026-08-14_eec971053191b8e7e66cb83e4e6fed82_amadey_elex_nionspy_smoke-loader

.exe 250KB

2026-08-14_eec971053191b8e7e66cb83e4e6fed82_amadey_elex_nionspy_smoke-loader

IMPHASH 366ace8a1c8bfddc75a256e571e54824
SHA256 caacb771eedf253d28f56012c32e609f7f924b8fa311e6fe374bc89ef4babd7e
MD5 eec971053191b8e7e66cb83e4e6fed82
SHA1 5daf33ad47edba812d8a4f7ec2b6359f2a8626e3
SHA512 e7cf6f75ca3c6606e8e50a09f16fb3a9cc440772dda54697e2ee5e70c382409f7474ba08893404af23a4455c4b840ce084efcfc84e27d00a1e046ca4a161323e
SSDEEP 6144:cd208gooGwxCo0WD2zIUQuHDv41URN/IKjyRSzDT:cdj8goyd0WfXuHDv46RNQKjP
TLSH
T1B0448E50A6D1C472C4B7257000BBAAA20D7C36352B36F5D3F7642BA49D602E1FE7936E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocalTime LoadLibraryA GetSystemTime CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GetDriveTypeA GlobalLock GlobalUnlock GetTickCount SetFileAttributesA CreateFileW GetProcessHeap SetEndOfFile GetStringTypeW LCMapStringW GetTimeZoneInformation WriteConsoleW SetEnvironmentVariableA CompareStringW FlushFileBuffers SetStdHandle GetCurrentProcessId QueryPerformanceCounter Sleep GlobalMemoryStatus GetComputerNameA GetVersionExA CreateToolhelp32Snapshot TerminateProcess Process32Next OpenProcess Process32First CloseHandle GetFileTime SetFileTime OpenFile GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameW HeapCreate GetConsoleMode GetConsoleCP MultiByteToWideChar WideCharToMultiByte SetFilePointer InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind DeleteCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError DeleteFileA HeapFree HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType

user32

ReleaseDC GetDC GetWindowRect MessageBoxA DispatchMessageA GetDesktopWindow SetWindowsHookExA CallNextHookEx CloseClipboard GetClipboardData OpenClipboard UnhookWindowsHookEx TranslateMessage GetMessageA GetKeyState

gdi32

DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap GetPixel BitBlt

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

InternetConnectA InternetCloseHandle InternetReadFile HttpOpenRequestA InternetGetConnectedState HttpSendRequestA InternetOpenA

winmm

mciSendStringA mciSendCommandA

wsock32

socket send gethostbyname closesocket htons WSAStartup connect

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_eec971053191b8e7e66cb83e4e6fed82_amadey_elex_nionspy_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

generic