2026-09-16_25c1b024986fb797d4ee6f742b19839a_amadey_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_25c1b024986fb797d4ee6f742b19839a_amadey_elex_smoke-loader
Size 1.4MB
Sample260916-q38asabb89
SHA256 816c5e1f1bb607f8244ffa088d47411c18899f518d8cb407a5f8c389a5036778
MD5 25c1b024986fb797d4ee6f742b19839a
SHA1 54cd91e19765703dc6b37974486b13ce315d3f8b
SHA512 b7cef96cc5e863ab1ce8d28102f709177233f59faf61702cc87f531c071c22e23398839bcf840c215965f67a50f4eebd437732929ca1939951a998a61b13e29f
SSDEEP 24576:XsheXnSMkCq+Q7jxqitRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:RXXkCqPxqSaNNakJBIs7sH2up
TLSH
T146650125A350D032E56701B5AFAD8B769A2DB5725B5010C7F3CC2E3DDBA03D26A3634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_25c1b024986fb797d4ee6f742b19839a_amadey_elex_smoke-loader

File Explorer

2026-09-16_25c1b024986fb797d4ee6f742b19839a_amadey_elex_smoke-loader

.exe 1.4MB

2026-09-16_25c1b024986fb797d4ee6f742b19839a_amadey_elex_smoke-loader

IMPHASH 9d75aff38830f571bebb051aceb0db67
SHA256 816c5e1f1bb607f8244ffa088d47411c18899f518d8cb407a5f8c389a5036778
MD5 25c1b024986fb797d4ee6f742b19839a
SHA1 54cd91e19765703dc6b37974486b13ce315d3f8b
SHA512 b7cef96cc5e863ab1ce8d28102f709177233f59faf61702cc87f531c071c22e23398839bcf840c215965f67a50f4eebd437732929ca1939951a998a61b13e29f
SSDEEP 24576:XsheXnSMkCq+Q7jxqitRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:RXXkCqPxqSaNNakJBIs7sH2up
TLSH
T146650125A350D032E56701B5AFAD8B769A2DB5725B5010C7F3CC2E3DDBA03D26A3634B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

124002

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Project\LspInstall\installlsp\output\installlsp.pdb

ws2_32

WSAWaitForMultipleEvents WSCEnumProtocols WSCInstallProvider WSCDeinstallProvider WSACloseEvent connect inet_ntoa WSAStartup inet_addr WSAEnumNetworkEvents htons WSAEventSelect WSACleanup socket WSACreateEvent closesocket gethostbyname WSCGetProviderPath

rpcrt4

UuidCreate

kernel32

GetStringTypeW HeapAlloc HeapFree ExpandEnvironmentStringsA InitializeCriticalSection WideCharToMultiByte LoadLibraryW HeapDestroy LeaveCriticalSection HeapCreate GetLastError SetLastError GetProcAddress EnterCriticalSection LoadLibraryA GetCurrentProcessId GetSystemTime ExpandEnvironmentStringsW CreateToolhelp32Snapshot OutputDebugStringA CloseHandle CreateFileA GetCurrentProcess WaitForSingleObject IsBadReadPtr CreateRemoteThread OpenProcess VirtualFreeEx ReadProcessMemory CreateFileW VirtualAllocEx LocalFree FindResourceW LoadResource SizeofResource GetModuleFileNameW LockResource FreeLibrary MoveFileExW InterlockedDecrement GetTimeFormatA GetDateFormatA Sleep GetSystemDirectoryA MultiByteToWideChar MoveFileW CopyFileA GetLocalTime GetModuleFileNameA GetCurrentDirectoryA DeleteCriticalSection MoveFileExA GetTickCount MoveFileA GetTempPathW GetTempPathA GetVersionExA lstrlenA FindFirstFileA DeleteFileA Process32First Process32Next FlushFileBuffers SetStdHandle SetEndOfFile GetProcessHeap GetThreadContext SetThreadContext VirtualQuery InterlockedCompareExchange VirtualFree FlushInstructionCache VirtualAlloc VirtualProtect ResumeThread WriteProcessMemory WriteConsoleW HeapReAlloc GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointer ReadFile LCMapStringW EncodePointer DecodePointer GetCommandLineA HeapSetInformation RtlUnwind RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize GetModuleHandleW ExitProcess InitializeCriticalSectionAndSpinCount WriteFile GetConsoleCP GetConsoleMode SetHandleCount GetStdHandle GetFileType GetStartupInfoW GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId

user32

wvsprintfA

advapi32

GetNamedSecurityInfoA RegSaveKeyA RegCreateKeyExA RegRestoreKeyA GetTokenInformation RegCloseKey RegOpenKeyExA RegQueryValueExA AdjustTokenPrivileges BuildExplicitAccessWithNameA LookupPrivilegeValueA SetNamedSecurityInfoA SetEntriesInAclA OpenProcessToken

ole32

StringFromGUID2

oleaut32

VariantClear SysAllocString SysFreeString

shlwapi

PathFindFileNameA PathFileExistsW

Name

.text

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_25c1b024986fb797d4ee6f742b19839a_amadey_elex_smoke-loader

ws2_32

rpcrt4

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

generic