2026-08-14_85f83c9b4741fcc6b112406b535762cd_amadey_elex_nionspy_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_85f83c9b4741fcc6b112406b535762cd_amadey_elex_nionspy_smoke-loader
Size 250KB
Sample260815-ctfmhsdd44
SHA256 6b3a80692a878395415ad6873559a3023903683ed3a294e274019ca63d515292
MD5 85f83c9b4741fcc6b112406b535762cd
SHA1 55d335bd2689c6e26a9ef1dd0142cbca29e43c04
SHA512 22e8b8c2e69983d9cecda546126b85728ad5352983c70a01d179a144d910ac970778ee571b42b3fe7958f048611538dddedf252d818c6406f3f3823488c6213d
SSDEEP 6144:od208gooGwxCo0WD2zIUQuHDv41URN/IKjyRSzDT:odj8goyd0WfXuHDv46RNQKjP
TLSH
T1D9448E50A6D1C472C4B7257000BBAAA20D7C36352B36F5D3F7642BA49D602E1FE7936E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_85f83c9b4741fcc6b112406b535762cd_amadey_elex_nionspy_smoke-loader

File Explorer

2026-08-14_85f83c9b4741fcc6b112406b535762cd_amadey_elex_nionspy_smoke-loader

.exe 250KB

2026-08-14_85f83c9b4741fcc6b112406b535762cd_amadey_elex_nionspy_smoke-loader

IMPHASH 366ace8a1c8bfddc75a256e571e54824
SHA256 6b3a80692a878395415ad6873559a3023903683ed3a294e274019ca63d515292
MD5 85f83c9b4741fcc6b112406b535762cd
SHA1 55d335bd2689c6e26a9ef1dd0142cbca29e43c04
SHA512 22e8b8c2e69983d9cecda546126b85728ad5352983c70a01d179a144d910ac970778ee571b42b3fe7958f048611538dddedf252d818c6406f3f3823488c6213d
SSDEEP 6144:od208gooGwxCo0WD2zIUQuHDv41URN/IKjyRSzDT:odj8goyd0WfXuHDv46RNQKjP
TLSH
T1D9448E50A6D1C472C4B7257000BBAAA20D7C36352B36F5D3F7642BA49D602E1FE7936E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocalTime LoadLibraryA GetSystemTime CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GetDriveTypeA GlobalLock GlobalUnlock GetTickCount SetFileAttributesA CreateFileW GetProcessHeap SetEndOfFile GetStringTypeW LCMapStringW GetTimeZoneInformation WriteConsoleW SetEnvironmentVariableA CompareStringW FlushFileBuffers SetStdHandle GetCurrentProcessId QueryPerformanceCounter Sleep GlobalMemoryStatus GetComputerNameA GetVersionExA CreateToolhelp32Snapshot TerminateProcess Process32Next OpenProcess Process32First CloseHandle GetFileTime SetFileTime OpenFile GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameW HeapCreate GetConsoleMode GetConsoleCP MultiByteToWideChar WideCharToMultiByte SetFilePointer InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind DeleteCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError DeleteFileA HeapFree HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType

user32

ReleaseDC GetDC GetWindowRect MessageBoxA DispatchMessageA GetDesktopWindow SetWindowsHookExA CallNextHookEx CloseClipboard GetClipboardData OpenClipboard UnhookWindowsHookEx TranslateMessage GetMessageA GetKeyState

gdi32

DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap GetPixel BitBlt

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

InternetConnectA InternetCloseHandle InternetReadFile HttpOpenRequestA InternetGetConnectedState HttpSendRequestA InternetOpenA

winmm

mciSendStringA mciSendCommandA

wsock32

socket send gethostbyname closesocket htons WSAStartup connect

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_85f83c9b4741fcc6b112406b535762cd_amadey_elex_nionspy_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

generic