2026-08-20_1873a9d336b17378e2d23c50f23b2a6f_amadey_badda_elex_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_1873a9d336b17378e2d23c50f23b2a6f_amadey_badda_elex_smoke-loader_stealc
Size 261KB
Sample260820-wt9edawvbx
SHA256 abb50cf0756f07c78b53fcdb2c836d1853016bc7f592823a984bb44fb4bedb78
MD5 1873a9d336b17378e2d23c50f23b2a6f
SHA1 48dce22a40a983ce35ca2da155418bf70a20c119
SHA512 b11a3ccfe3521858a3d50d881111ae56272bb724d09e18b565aa238de2074e0f886bf3c7da98b941999c2874c3d00c87b224254276fc08d64dd40b9cff7cb41e
SSDEEP 6144:/dkiC5hwHspYalIRnuCC8dLAyzWcWpyo7dv+:/dknQMCaCRtjlJz5W5dv
TLSH
T159445A6137E09031E5B3193059BAD731497FBC366971C58E63983A2D2E32BD0C9B5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_1873a9d336b17378e2d23c50f23b2a6f_amadey_badda_elex_smoke-loader_stealc

File Explorer

2026-08-20_1873a9d336b17378e2d23c50f23b2a6f_amadey_badda_elex_smoke-loader_stealc

.exe 261KB

2026-08-20_1873a9d336b17378e2d23c50f23b2a6f_amadey_badda_elex_smoke-loader_stealc

IMPHASH 0681a4c7a9b345a39225394cd491fbb0
SHA256 abb50cf0756f07c78b53fcdb2c836d1853016bc7f592823a984bb44fb4bedb78
MD5 1873a9d336b17378e2d23c50f23b2a6f
SHA1 48dce22a40a983ce35ca2da155418bf70a20c119
SHA512 b11a3ccfe3521858a3d50d881111ae56272bb724d09e18b565aa238de2074e0f886bf3c7da98b941999c2874c3d00c87b224254276fc08d64dd40b9cff7cb41e
SSDEEP 6144:/dkiC5hwHspYalIRnuCC8dLAyzWcWpyo7dv+:/dknQMCaCRtjlJz5W5dv
TLSH
T159445A6137E09031E5B3193059BAD731497FBC366971C58E63983A2D2E32BD0C9B5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

356352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\re\jdk7u45\229\build\windows-i586\tmp\deploy\jre-image\bin\javaws.pdb

kernel32

LoadLibraryW GetModuleHandleW FreeLibrary GetProcAddress GetTickCount GetThreadLocale ReadFile CloseHandle WaitForSingleObject SetHandleInformation CreatePipe CreateDirectoryW GetSystemWindowsDirectoryW FindClose FindFirstFileW GetModuleFileNameW InterlockedIncrement GlobalMemoryStatusEx GetVersionExW GetCurrentProcess GetNativeSystemInfo GetLastError CreateFileW GetSystemDirectoryW CreateProcessW lstrlenW LocalAlloc FormatMessageW GetLongPathNameW GetShortPathNameW InterlockedDecrement GetWindowsDirectoryW OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetModuleHandleExW GetFileAttributesW lstrlenA GetExitCodeProcess WriteConsoleW FlushFileBuffers HeapSize CompareStringW LCMapStringW QueryPerformanceCounter GetProcessHeap SetEndOfFile SetFilePointer SetStdHandle GetConsoleMode GetConsoleCP SetHandleCount Sleep SetEnvironmentVariableW SetEnvironmentVariableA DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle WriteFile HeapCreate IsProcessorFeaturePresent LocalFree InterlockedExchange LoadLibraryA RaiseException FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW WideCharToMultiByte GetSystemTimeAsFileTime HeapFree HeapReAlloc HeapAlloc GetStringTypeW ExitProcess DecodePointer MultiByteToWideChar RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteFileW GetFileType GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetCommandLineW HeapSetInformation GetStartupInfoW GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError

user32

LoadCursorW DefWindowProcW DispatchMessageW TranslateMessage GetMessageW SetTimer CreateWindowExW RegisterClassW wsprintfW MessageBoxW

ole32

StringFromCLSID CoTaskMemFree

oleaut32

SysFreeString VariantClear SysAllocString SysStringLen SysAllocStringByteLen

wsock32

closesocket WSAAsyncSelect connect htons getsockname ioctlsocket socket bind recv accept ntohs listen WSAStartup send WSAGetLastError

Name

.text

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.BadDay

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_1873a9d336b17378e2d23c50f23b2a6f_amadey_badda_elex_smoke-loader_stealc

kernel32

user32

ole32

oleaut32

wsock32

generic