dnscat2 | 2026-08-28_e78eafd758ec04cbd92f6e422f61b825_amadey_elex_smoke-loader_stealc_stop

General

Target
2026-08-28_e78eafd758ec04cbd92f6e422f61b825_amadey_elex_smoke-loader_stealc_stop
Size 152KB
Sample260829-df32bseg45
SHA256 ba45410d73116682434ae80675aa04370b60970daa9064cc447c169caf6ea5ca
MD5 e78eafd758ec04cbd92f6e422f61b825
SHA1 c3dd74c27c9599b0039667b4ba7bdc8cdeb6d6f1
SHA512 eaaac2d0afe3b4509ac4ad4b4ab08640bfc9b7009c43ca8f958df31dca689066b7fe7bb6815568469840fa511d78fa2ff50bfe82070cce46e440b59804968db7
SSDEEP 3072:bDzHW4j9fpvOgexhyiqcqKvuPrWO9wITeQKvr:b/Nj9veBqcqKvuPlTeQ
TLSH
T100E39D617680C032C157147019D9C7B2EF7ABA3117758A43FFAC1BAE9F717A0DA2A349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor dnscat2

Malware Config

Signatures

Family: dnscat2
Tool used to achieve encrypted command-and-control (C&C) channel over the DNS protocol.
backdoor dnscat2

Detects dnscat2 1 IoCs

resource	yara_rule
sample	tool_dnscat2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-28_e78eafd758ec04cbd92f6e422f61b825_amadey_elex_smoke-loader_stealc_stop

File Explorer

2026-08-28_e78eafd758ec04cbd92f6e422f61b825_amadey_elex_smoke-loader_stealc_stop

.exe 152KB

2026-08-28_e78eafd758ec04cbd92f6e422f61b825_amadey_elex_smoke-loader_stealc_stop

IMPHASH 1a9692da0262a03a450e20c7d80d4a7e
SHA256 ba45410d73116682434ae80675aa04370b60970daa9064cc447c169caf6ea5ca
MD5 e78eafd758ec04cbd92f6e422f61b825
SHA1 c3dd74c27c9599b0039667b4ba7bdc8cdeb6d6f1
SHA512 eaaac2d0afe3b4509ac4ad4b4ab08640bfc9b7009c43ca8f958df31dca689066b7fe7bb6815568469840fa511d78fa2ff50bfe82070cce46e440b59804968db7
SSDEEP 3072:bDzHW4j9fpvOgexhyiqcqKvuPrWO9wITeQKvr:b/Nj9veBqcqKvuPlTeQ
TLSH
T100E39D617680C032C157147019D9C7B2EF7ABA3117758A43FFAC1BAE9F717A0DA2A349
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects dnscat2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

54529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

setsockopt sendto WSAGetLastError ioctlsocket connect WSAStartup inet_addr bind socket closesocket gethostbyname send gethostname inet_ntoa recvfrom select ntohs recv __WSAFDIsSet getsockopt WSAStringToAddressA ntohl ntohs

dnsapi

DnsQueryConfig

kernel32

GetStringTypeW GetStringTypeA GetTimeZoneInformation WriteConsoleW GetConsoleOutputCP SetStdHandle CreateFileA SetFilePointer GetLocaleInfoA FlushFileBuffers CompareStringW GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WriteConsoleA CompareStringA WriteFile CreateProcessA TerminateProcess CreatePipe CloseHandle PeekNamedPipe Sleep ReadFile GetStdHandle GetLastError CreateThread GetSystemTimeAsFileTime FormatMessageA SetEnvironmentVariableA SetEndOfFile GetCurrentProcessId SetHandleCount UnhandledExceptionFilter SetUnhandledExceptionFilter EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetProcAddress ExitProcess FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA HeapFree HeapAlloc HeapReAlloc GetCommandLineA GetCurrentProcess IsDebuggerPresent GetModuleFileNameA GetProcessHeap GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement LoadLibraryA InitializeCriticalSectionAndSpinCount HeapSize RtlUnwind MultiByteToWideChar WideCharToMultiByte GetConsoleCP GetConsoleMode GetFullPathNameA GetCurrentDirectoryA GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW HeapCreate VirtualFree VirtualAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

Sharing