2026-09-01_1df12f0fe87cdc53b2d9c365796bc4f4_amadey_elex_smoke-loader_stop

General

Target
2026-09-01_1df12f0fe87cdc53b2d9c365796bc4f4_amadey_elex_smoke-loader_stop
Size 662KB
Sample260901-znkqlsef95
SHA256 b00e329daa48bd6b30212a7ebbd7bd06c230ddf33603b5f430409e83660b0c09
MD5 1df12f0fe87cdc53b2d9c365796bc4f4
SHA1 88d46ea83dc6627a11f97dbd880b9ebf411a63c8
SHA512 b80f083879cc186296ed5b9b6e97096ed8e7a1e4c66f07610340a7e8ca400bb0514675fc84bbd74dd09455c2bb8bb1eef58f71f649211f728aa032fdbb013f79
SSDEEP 6144:iwetFMr5K9s4OrYq0VTWGgRh574uMdXiQjhYltC4rxplGi61dG5nz:FSFMr4s4OrYXV6GgRh5WdFhYlI4Hx5
TLSH
T151E49D2272C2C4B2D0B662FE599783795E33B532533358D357E11AECAA201F16B3DB85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-01_1df12f0fe87cdc53b2d9c365796bc4f4_amadey_elex_smoke-loader_stop

File Explorer

2026-09-01_1df12f0fe87cdc53b2d9c365796bc4f4_amadey_elex_smoke-loader_stop

.exe 662KB

2026-09-01_1df12f0fe87cdc53b2d9c365796bc4f4_amadey_elex_smoke-loader_stop

IMPHASH 5c4d5775857bdbf9d866f5561890ced2
SHA256 b00e329daa48bd6b30212a7ebbd7bd06c230ddf33603b5f430409e83660b0c09
MD5 1df12f0fe87cdc53b2d9c365796bc4f4
SHA1 88d46ea83dc6627a11f97dbd880b9ebf411a63c8
SHA512 b80f083879cc186296ed5b9b6e97096ed8e7a1e4c66f07610340a7e8ca400bb0514675fc84bbd74dd09455c2bb8bb1eef58f71f649211f728aa032fdbb013f79
SSDEEP 6144:iwetFMr5K9s4OrYq0VTWGgRh574uMdXiQjhYltC4rxplGi61dG5nz:FSFMr4s4OrYXV6GgRh5WdFhYlI4Hx5
TLSH
T151E49D2272C2C4B2D0B662FE599783795E33B532533358D357E11AECAA201F16B3DB85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\p4client\dev\ThirdParties\tcsh\tcsh-x86.pdb

user32

MessageBeep GetMessageA DispatchMessageA TranslateMessage RegisterClassA IsClipboardFormatAvailable GetClipboardData OpenClipboard EmptyClipboard SetClipboardData CloseClipboard DefWindowProcA PostQuitMessage CreateWindowExA UpdateWindow ExitWindowsEx EnumWindows PostMessageA GetWindowThreadProcessId GetWindowTextA wvsprintfA LoadStringA LoadStringW OemToCharA wsprintfA MessageBoxA

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegQueryValueExA RegCloseKey GetUserNameA OpenProcessToken

kernel32

VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsValidLocale EnumSystemLocalesA QueryPerformanceCounter GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetFullPathNameA GetStartupInfoA SetHandleCount GetTimeZoneInformation GetStringTypeW GetStringTypeA CompareStringA CompareStringW HeapSize GetLocaleInfoW FlushFileBuffers GetConsoleOutputCP GetLocaleInfoA HeapReAlloc ExitProcess GetCurrentProcessId Sleep GetLastError ReadFile WriteFile HeapFree ReadConsoleInputA HeapAlloc GetProcessHeap WaitForMultipleObjects WriteConsoleA GetFileType GetStdHandle CloseHandle DuplicateHandle GetCurrentProcess GetBinaryTypeA GetFileAttributesA SetFilePointer SetStdHandle CreatePipe CreateFileA lstrcmpA GetProcAddress LoadLibraryA lstrlenA lstrcmpiA FindFirstFileA FindClose FindNextFileA DeleteCriticalSection SetEvent LeaveCriticalSection EnterCriticalSection WaitForSingleObject CreateThread CreateEventA ResumeThread SuspendThread GetExitCodeProcess GenerateConsoleCtrlEvent TerminateProcess OpenProcess SetThreadPriority GetCurrentThread SetPriorityClass InitializeCriticalSection SetConsoleCtrlHandler SetProcessAffinityMask GetProcessAffinityMask GetCurrentDirectoryA GetSystemInfo GetVersionExA GetComputerNameA FreeLibrary SetEnvironmentVariableA GetWindowsDirectoryA GetEnvironmentVariableA VirtualAlloc DeleteFileA CreateProcessA GetThreadPriority GetPriorityClass WideCharToMultiByte GetConsoleCP GetTickCount GetProcessTimes FillConsoleOutputAttribute CreateConsoleScreenBuffer GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode FillConsoleOutputCharacterA SetConsoleCursorPosition SetConsoleActiveScreenBuffer SetConsoleWindowInfo ScrollConsoleScreenBufferA SetConsoleScreenBufferSize SetConsoleTextAttribute OpenEventA WriteProcessMemory VirtualAllocEx ResetEvent GetModuleFileNameA GetModuleHandleA FormatMessageA SetConsoleTitleA GetConsoleTitleA SetLastError OutputDebugStringA GetOverlappedResult SearchPathA GlobalUnlock GlobalFree GlobalLock GlobalAlloc GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter WriteConsoleW GetModuleFileNameW RtlUnwind InterlockedDecrement GetCPInfo FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetDriveTypeA SetCurrentDirectoryA InterlockedIncrement IsDebuggerPresent GetCommandLineA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId FatalAppExitA InterlockedExchange GetACP GetOEMCP IsValidCodePage LoadLibraryW LCMapStringA MultiByteToWideChar LCMapStringW

Name

.text

Size

492KB

Virtual Size

489KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

48KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fusrdat

Size

20KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_1df12f0fe87cdc53b2d9c365796bc4f4_amadey_elex_smoke-loader_stop

user32

advapi32

kernel32

generic