2026-09-21_dbabd7c1726326ef763326914c5fa523_amadey_elex_maze_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_dbabd7c1726326ef763326914c5fa523_amadey_elex_maze_smoke-loader
Size 6.6MB
Sample260922-lpr97axybw
SHA256 7617a360120e33de5b3bec9c9e4be29090f48daa51e0bcb1dc18c7418f6ebcb9
MD5 dbabd7c1726326ef763326914c5fa523
SHA1 bda38f4df6ac0e4d29e4ffc33f4b4af5bcb1df82
SHA512 34cec1f6e1028009108ef74fd50952d03cbcca452dab4145859fec757a9e5eea89c23949e5fd24f2373ce791bbadc5bb67081157cac24f24bbe4b1e3ec04d78a
SSDEEP 196608:BGYfwT3jljyTgKeq7BFeeKftQyFySVZGbeli51E:qjljyTgI7zCfxFDpl
TLSH
T102660213B740D122E54B0074791EE3D661A8BA30466AC883B7C4BB1FB9B1BD6E935F47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_dbabd7c1726326ef763326914c5fa523_amadey_elex_maze_smoke-loader

File Explorer

2026-09-21_dbabd7c1726326ef763326914c5fa523_amadey_elex_maze_smoke-loader

.exe 6.6MB

2026-09-21_dbabd7c1726326ef763326914c5fa523_amadey_elex_maze_smoke-loader

IMPHASH 6e038a94da7889265feba388c008dc88
SHA256 7617a360120e33de5b3bec9c9e4be29090f48daa51e0bcb1dc18c7418f6ebcb9
MD5 dbabd7c1726326ef763326914c5fa523
SHA1 bda38f4df6ac0e4d29e4ffc33f4b4af5bcb1df82
SHA512 34cec1f6e1028009108ef74fd50952d03cbcca452dab4145859fec757a9e5eea89c23949e5fd24f2373ce791bbadc5bb67081157cac24f24bbe4b1e3ec04d78a
SSDEEP 196608:BGYfwT3jljyTgKeq7BFeeKftQyFySVZGbeli51E:qjljyTgI7zCfxFDpl
TLSH
T102660213B740D122E54B0074791EE3D661A8BA30466AC883B7C4BB1FB9B1BD6E935F47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

266572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpynW GetFileAttributesW CreateProcessA FileTimeToSystemTime GetSystemDirectoryA GetTimeZoneInformation ExitThread MultiByteToWideChar SetThreadPriority GlobalUnlock RaiseException GetPrivateProfileIntW VerifyVersionInfoW SetThreadLocale SetLastError VirtualAlloc IsValidCodePage EnterCriticalSection GlobalFree FindClose LoadLibraryA CreateFileMappingA GetFileType RemoveDirectoryW DeviceIoControl CreatePipe EnumResourceTypesW GetOEMCP GetModuleHandleA FindNextFileW VirtualProtect WinExec FileTimeToLocalFileTime GetThreadTimes LocalFree GetSystemTime SuspendThread ResumeThread HeapCreate DeleteFileA ExpandEnvironmentStringsW CloseHandle WriteConsoleW SetStdHandle ReadConsoleW ReadFile FlushFileBuffers GetStringTypeW OutputDebugStringW SetFilePointerEx GetConsoleMode GetConsoleCP LCMapStringW HeapReAlloc GetCPInfo GetACP GetModuleHandleW TlsFree TlsGetValue TlsAlloc TerminateProcess Sleep SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW CreateFileW GetEnvironmentStringsW HeapDestroy ReadProcessMemory InitializeCriticalSectionAndSpinCount LoadLibraryW GetSystemDirectoryW TlsSetValue GetProcessTimes SetCommTimeouts GetPrivateProfileStringW GetSystemTimeAsFileTime ExpandEnvironmentStringsA ConnectNamedPipe SetCommBreak SignalObjectAndWait GetUserDefaultLCID GlobalLock InitializeSListHead GetCurrentProcess VerSetConditionMask EnumCalendarInfoW LoadLibraryExW SystemTimeToFileTime SetErrorMode FreeLibrary VirtualQuery GetDriveTypeW RtlCaptureContext SetFilePointer FindFirstFileW CreateFileA EnumResourceNamesW GetDateFormatW GetEnvironmentVariableW EncodePointer GetCommandLineW lstrcpyW ExitProcess GetCurrentProcessId QueryPerformanceCounter WriteFile GetModuleFileNameW GetProcessHeap GetCurrentThreadId GetStartupInfoW DeleteCriticalSection GetStdHandle LeaveCriticalSection IsDebuggerPresent HeapAlloc HeapFree HeapSize DecodePointer RtlUnwind IsProcessorFeaturePresent GetLastError GetModuleHandleExW GetProcAddress WideCharToMultiByte

user32

CheckMenuItem IsRectEmpty ClientToScreen GetDlgItemInt DestroyAcceleratorTable IsIconic PostMessageW DrawIconEx LoadStringA GetWindowInfo GetMenuItemInfoW EnumWindows CreateIconIndirect GetDC InflateRect CheckMenuRadioItem LoadMenuW GetWindowTextW SystemParametersInfoW SetWindowLongW GetDesktopWindow GetSysColorBrush DrawMenuBar GetKeyboardType MessageBoxW SetDlgItemTextW SendMessageW MapWindowPoints DestroyMenu GetDlgCtrlID ToUnicode DestroyIcon SetMenuItemInfoW GetMonitorInfoW EndPaint

gdi32

PolyPolygon SetLayout Arc GetTextExtentPoint32W SetViewportOrgEx GetMetaFileBitsEx CreateHatchBrush Polygon CreateFontIndirectW StretchBlt GetEnhMetaFileHeader GetRegionData OffsetRgn ExtCreateRegion StretchDIBits GetTextExtentPointW GetBkColor SetViewportExtEx SetWinMetaFileBits CloseEnhMetaFile CreatePolygonRgn

comdlg32

GetSaveFileNameW

advapi32

RegLoadKeyW AdjustTokenPrivileges RegSetKeySecurity RegDeleteValueA RegConnectRegistryW StartServiceW LookupPrivilegeValueW RegDeleteKeyA RegQueryInfoKeyW RegQueryValueExW OpenServiceW RegUnLoadKeyW

shell32

ExtractIconExW SHGetFileInfoW

ole32

CoInitialize

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayPtrOfIndex SysAllocStringLen VariantInit SafeArrayCreate VariantCopy VariantClear SysReAllocStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_dbabd7c1726326ef763326914c5fa523_amadey_elex_maze_smoke-loader

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic