2026-08-21_6e5bf3d41625ba926cf5ea6cbf5db032_amadey_elex_smoke-loader

General

Target
2026-08-21_6e5bf3d41625ba926cf5ea6cbf5db032_amadey_elex_smoke-loader
Size 450KB
Sample260822-qcdcqagr4x
SHA256 c50845d8f6778d76bc0524205d7be033d8f5153d3b91705b5d213c04cfe77d09
MD5 6e5bf3d41625ba926cf5ea6cbf5db032
SHA1 092bdd4e474fb94de57ae71dc5c9bdb5c118b44f
SHA512 572d94a956db89ed5576ba5ff7c4afb487c79ae2eb54795e9342f79a7c5168493a0a5b25d37400dbbf8dfaac2aac33f0f173bdd1daa553effdcb8c8286d98527
SSDEEP 12288:mKi8mGpzBvZ9wO9X5kOIG+/9e3jqdt3aMPczoZ1m:hrpVvZ9z5pIN9e3ItKO1m
TLSH
T182A4BE00A7A1C035F1B716F449B9A274BA2E7EE16B2491CB53D526FE9B356D0EC3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_6e5bf3d41625ba926cf5ea6cbf5db032_amadey_elex_smoke-loader

File Explorer

2026-08-21_6e5bf3d41625ba926cf5ea6cbf5db032_amadey_elex_smoke-loader

.exe 450KB

2026-08-21_6e5bf3d41625ba926cf5ea6cbf5db032_amadey_elex_smoke-loader

IMPHASH e4b8a20830d5d5ec659fda08d2e209e3
SHA256 c50845d8f6778d76bc0524205d7be033d8f5153d3b91705b5d213c04cfe77d09
MD5 6e5bf3d41625ba926cf5ea6cbf5db032
SHA1 092bdd4e474fb94de57ae71dc5c9bdb5c118b44f
SHA512 572d94a956db89ed5576ba5ff7c4afb487c79ae2eb54795e9342f79a7c5168493a0a5b25d37400dbbf8dfaac2aac33f0f173bdd1daa553effdcb8c8286d98527
SSDEEP 12288:mKi8mGpzBvZ9wO9X5kOIG+/9e3jqdt3aMPczoZ1m:hrpVvZ9z5pIN9e3ItKO1m
TLSH
T182A4BE00A7A1C035F1B716F449B9A274BA2E7EE16B2491CB53D526FE9B356D0EC3031B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

259376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\deyusiyev\wewafihij\fazecivuyej_jasufupaxibufi\sotari\j.pdb

kernel32

GetNamedPipeHandleStateW CreateNamedPipeA CallNamedPipeW TerminateThread GetExitCodeProcess GetVersionExW VerifyVersionInfoW SetConsoleCP GetConsoleAliasesLengthA VerLanguageNameA FindFirstFileExA VerifyVersionInfoA FreeEnvironmentStringsA GetProcessPriorityBoost SetVolumeMountPointW GetLongPathNameA CopyFileA TlsGetValue SetConsoleCursorInfo TzSpecificLocalTimeToSystemTime AddAtomA ReleaseMutex BuildCommDCBAndTimeoutsA GetProcAddress LoadLibraryA LocalAlloc SleepEx TlsSetValue MoveFileA GetCommandLineW InterlockedDecrement DeleteFileW CreateActCtxA SetFileAttributesA GetPrivateProfileIntW GetProcessHeap CreateNamedPipeW ReadConsoleOutputCharacterA GetStartupInfoA GetDiskFreeSpaceExW GetCPInfoExW GetWindowsDirectoryW GetSystemWow64DirectoryA SetLastError GetProfileStringA GetCalendarInfoW FreeUserPhysicalPages GetTickCount GetStringTypeA DebugBreak FindFirstFileA lstrcmpA WriteFile GetConsoleMode lstrcatW SetFirmwareEnvironmentVariableA InterlockedExchange SetCriticalSectionSpinCount DefineDosDeviceW EndUpdateResourceA WriteConsoleW InterlockedIncrement SetSystemTimeAdjustment GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileStructA TryEnterCriticalSection GetPrivateProfileStructW GetFileAttributesExW HeapWalk CreateIoCompletionPort PeekConsoleInputA GetNumberFormatW GetQueuedCompletionStatus FindResourceExW SetLocalTime CreateSemaphoreA GetThreadLocale SetFileShortNameA lstrcpyW ReplaceFileA MoveFileExA GetConsoleCP GetVolumePathNameA FlushConsoleInputBuffer SearchPathA FreeConsole GetConsoleAliasExesLengthW WriteConsoleInputW LocalShrink GetCommState GetSystemTimeAdjustment EnumSystemLocalesW ProcessIdToSessionId SetMessageWaitingIndicator DeleteTimerQueueTimer GetWriteWatch OpenSemaphoreA GetConsoleScreenBufferInfo ClearCommBreak TlsAlloc GetComputerNameW HeapValidate GetLastError WaitForMultipleObjectsEx SignalObjectAndWait GetSystemPowerStatus VirtualLock SetWaitableTimer ChangeTimerQueueTimer GetProcessTimes FatalAppExitA lstrcpynW SetNamedPipeHandleState FillConsoleOutputCharacterA GetCompressedFileSizeW FindNextVolumeMountPointA GetFullPathNameA WriteProfileStringA GlobalAddAtomW LeaveCriticalSection SetCurrentDirectoryW OpenMutexW LockFile InitializeCriticalSection DeleteCriticalSection EnterCriticalSection EncodePointer DecodePointer IsBadReadPtr RtlUnwind RaiseException GetModuleHandleW ExitProcess DeleteFileA HeapSetInformation GetStartupInfoW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo GetModuleFileNameW InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent HeapAlloc GetModuleFileNameA HeapReAlloc HeapSize HeapQueryInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree HeapCreate GetACP GetOEMCP IsValidCodePage GetCurrentThreadId TlsFree GetStdHandle LoadLibraryW GetLocaleInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStringTypeW GetLocaleInfoA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID OutputDebugStringA OutputDebugStringW SetFilePointer SetStdHandle CreateFileW CloseHandle FlushFileBuffers

Name

.text

Size

361KB

Virtual Size

361KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

539KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.panelo

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gepivej

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_6e5bf3d41625ba926cf5ea6cbf5db032_amadey_elex_smoke-loader

kernel32

generic