2026-09-16_40bc89bcd409408708f03a756080e6a1_amadey_badda_elex_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_40bc89bcd409408708f03a756080e6a1_amadey_badda_elex_smoke-loader_stealc
Size 261KB
Sample260916-15ercswdpd
SHA256 611499d0cfdf49ab4a2bfac6cabbb770d64fa4cc0f732459ce6de614adc873c9
MD5 40bc89bcd409408708f03a756080e6a1
SHA1 6a66cb66ef18194b8e7d4f1dac0580ff4dfaac5e
SHA512 b741655cd035064ff75a323383c0f6873601f7c34816847d50c843b084377906cddf1356f80179ba59e3de770940ab50b8165020c4c7e7b1b750f29beab4b554
SSDEEP 6144:/dkiC5hwHspYalIRnuCC8dLAyzWcWpyo7dv:/dknQMCaCRtjlJz5W5dv
TLSH
T192445A6137E09032E5B3193059BAD731497FBC366971C58E63983A2D2E327D0C9B5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_40bc89bcd409408708f03a756080e6a1_amadey_badda_elex_smoke-loader_stealc

File Explorer

2026-09-16_40bc89bcd409408708f03a756080e6a1_amadey_badda_elex_smoke-loader_stealc

.exe 261KB

2026-09-16_40bc89bcd409408708f03a756080e6a1_amadey_badda_elex_smoke-loader_stealc

IMPHASH 0681a4c7a9b345a39225394cd491fbb0
SHA256 611499d0cfdf49ab4a2bfac6cabbb770d64fa4cc0f732459ce6de614adc873c9
MD5 40bc89bcd409408708f03a756080e6a1
SHA1 6a66cb66ef18194b8e7d4f1dac0580ff4dfaac5e
SHA512 b741655cd035064ff75a323383c0f6873601f7c34816847d50c843b084377906cddf1356f80179ba59e3de770940ab50b8165020c4c7e7b1b750f29beab4b554
SSDEEP 6144:/dkiC5hwHspYalIRnuCC8dLAyzWcWpyo7dv:/dknQMCaCRtjlJz5W5dv
TLSH
T192445A6137E09032E5B3193059BAD731497FBC366971C58E63983A2D2E327D0C9B5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

356352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\re\jdk7u45\229\build\windows-i586\tmp\deploy\jre-image\bin\javaws.pdb

kernel32

LoadLibraryW GetModuleHandleW FreeLibrary GetProcAddress GetTickCount GetThreadLocale ReadFile CloseHandle WaitForSingleObject SetHandleInformation CreatePipe CreateDirectoryW GetSystemWindowsDirectoryW FindClose FindFirstFileW GetModuleFileNameW InterlockedIncrement GlobalMemoryStatusEx GetVersionExW GetCurrentProcess GetNativeSystemInfo GetLastError CreateFileW GetSystemDirectoryW CreateProcessW lstrlenW LocalAlloc FormatMessageW GetLongPathNameW GetShortPathNameW InterlockedDecrement GetWindowsDirectoryW OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetModuleHandleExW GetFileAttributesW lstrlenA GetExitCodeProcess WriteConsoleW FlushFileBuffers HeapSize CompareStringW LCMapStringW QueryPerformanceCounter GetProcessHeap SetEndOfFile SetFilePointer SetStdHandle GetConsoleMode GetConsoleCP SetHandleCount Sleep SetEnvironmentVariableW SetEnvironmentVariableA DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle WriteFile HeapCreate IsProcessorFeaturePresent LocalFree InterlockedExchange LoadLibraryA RaiseException FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW WideCharToMultiByte GetSystemTimeAsFileTime HeapFree HeapReAlloc HeapAlloc GetStringTypeW ExitProcess DecodePointer MultiByteToWideChar RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteFileW GetFileType GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetCommandLineW HeapSetInformation GetStartupInfoW GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError

user32

LoadCursorW DefWindowProcW DispatchMessageW TranslateMessage GetMessageW SetTimer CreateWindowExW RegisterClassW wsprintfW MessageBoxW

ole32

StringFromCLSID CoTaskMemFree

oleaut32

SysFreeString VariantClear SysAllocString SysStringLen SysAllocStringByteLen

wsock32

closesocket WSAAsyncSelect connect htons getsockname ioctlsocket socket bind recv accept ntohs listen WSAStartup send WSAGetLastError

Name

.text

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.BadDay

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_40bc89bcd409408708f03a756080e6a1_amadey_badda_elex_smoke-loader_stealc

kernel32

user32

ole32

oleaut32

wsock32

generic