2026-08-20_9fa3925018e1f6cd00fbe833087866f1_amadey_badda_elex_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_9fa3925018e1f6cd00fbe833087866f1_amadey_badda_elex_smoke-loader_stealc
Size 261KB
Sample260820-sa513azard
SHA256 bc44c978e22b4209892ecaf7c8584895f0626a84ec36d11c5f2822ea99f2bc45
MD5 9fa3925018e1f6cd00fbe833087866f1
SHA1 bed97e98d425e0263de7e057c7d1d11763bf832c
SHA512 7a61c0c57291613202ba43911484c19661cf4ddc8870c545fc9fa2d99263f4f1d47827595dc16a358d96b162135b342b5eb70cf7515d97184511780f2030d710
SSDEEP 6144:/dkiC5hwHspYalIRnuCC8dLAyzWcWpyo7dv:/dknQMCaCRtjlJz5W5dv
TLSH
T11D445A6137E09032E5B3193059BAD731497FBC366971C58E63983A2D2E327D0C9B5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_9fa3925018e1f6cd00fbe833087866f1_amadey_badda_elex_smoke-loader_stealc

File Explorer

2026-08-20_9fa3925018e1f6cd00fbe833087866f1_amadey_badda_elex_smoke-loader_stealc

.exe 261KB

2026-08-20_9fa3925018e1f6cd00fbe833087866f1_amadey_badda_elex_smoke-loader_stealc

IMPHASH 0681a4c7a9b345a39225394cd491fbb0
SHA256 bc44c978e22b4209892ecaf7c8584895f0626a84ec36d11c5f2822ea99f2bc45
MD5 9fa3925018e1f6cd00fbe833087866f1
SHA1 bed97e98d425e0263de7e057c7d1d11763bf832c
SHA512 7a61c0c57291613202ba43911484c19661cf4ddc8870c545fc9fa2d99263f4f1d47827595dc16a358d96b162135b342b5eb70cf7515d97184511780f2030d710
SSDEEP 6144:/dkiC5hwHspYalIRnuCC8dLAyzWcWpyo7dv:/dknQMCaCRtjlJz5W5dv
TLSH
T11D445A6137E09032E5B3193059BAD731497FBC366971C58E63983A2D2E327D0C9B5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

356352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\re\jdk7u45\229\build\windows-i586\tmp\deploy\jre-image\bin\javaws.pdb

kernel32

LoadLibraryW GetModuleHandleW FreeLibrary GetProcAddress GetTickCount GetThreadLocale ReadFile CloseHandle WaitForSingleObject SetHandleInformation CreatePipe CreateDirectoryW GetSystemWindowsDirectoryW FindClose FindFirstFileW GetModuleFileNameW InterlockedIncrement GlobalMemoryStatusEx GetVersionExW GetCurrentProcess GetNativeSystemInfo GetLastError CreateFileW GetSystemDirectoryW CreateProcessW lstrlenW LocalAlloc FormatMessageW GetLongPathNameW GetShortPathNameW InterlockedDecrement GetWindowsDirectoryW OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetModuleHandleExW GetFileAttributesW lstrlenA GetExitCodeProcess WriteConsoleW FlushFileBuffers HeapSize CompareStringW LCMapStringW QueryPerformanceCounter GetProcessHeap SetEndOfFile SetFilePointer SetStdHandle GetConsoleMode GetConsoleCP SetHandleCount Sleep SetEnvironmentVariableW SetEnvironmentVariableA DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle WriteFile HeapCreate IsProcessorFeaturePresent LocalFree InterlockedExchange LoadLibraryA RaiseException FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW WideCharToMultiByte GetSystemTimeAsFileTime HeapFree HeapReAlloc HeapAlloc GetStringTypeW ExitProcess DecodePointer MultiByteToWideChar RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteFileW GetFileType GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetCommandLineW HeapSetInformation GetStartupInfoW GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError

user32

LoadCursorW DefWindowProcW DispatchMessageW TranslateMessage GetMessageW SetTimer CreateWindowExW RegisterClassW wsprintfW MessageBoxW

ole32

StringFromCLSID CoTaskMemFree

oleaut32

SysFreeString VariantClear SysAllocString SysStringLen SysAllocStringByteLen

wsock32

closesocket WSAAsyncSelect connect htons getsockname ioctlsocket socket bind recv accept ntohs listen WSAStartup send WSAGetLastError

Name

.text

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.BadDay

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_9fa3925018e1f6cd00fbe833087866f1_amadey_badda_elex_smoke-loader_stealc

kernel32

user32

ole32

oleaut32

wsock32

generic