2026-09-24_cca6327c8087b837c4bb6ad38f0969b7_amadey_elex_smoke-loader

General

Target
2026-09-24_cca6327c8087b837c4bb6ad38f0969b7_amadey_elex_smoke-loader
Size 805KB
Sample260924-1713datbrg
SHA256 06baf0a7ff6326ad01cbd207832abf3ec41a7cd64314b18b8fddb4634ef12a7c
MD5 cca6327c8087b837c4bb6ad38f0969b7
SHA1 24b95918f2abcf2a5838680711400f777d1c318f
SHA512 463966dcbc552c90c4e0d8c4fd22c85c240caff8f20752b568f8028843c6edb1a29c629bd30a77a95aa6687e3ca5971cf5b2278396e1627636da92942e626072
SSDEEP 24576:6Quq2j0l/+GVvlOpqsmPYrOuboTcgU1K:6T8+GplOwbArmI1
TLSH
T123050230B7E0C039F5B712F489BAD274A92DBA716B7880CB62E516E907785E4DC31397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_cca6327c8087b837c4bb6ad38f0969b7_amadey_elex_smoke-loader

File Explorer

2026-09-24_cca6327c8087b837c4bb6ad38f0969b7_amadey_elex_smoke-loader

.exe 805KB

2026-09-24_cca6327c8087b837c4bb6ad38f0969b7_amadey_elex_smoke-loader

IMPHASH b3447c394869d3e708c4373cd10a2b6b
SHA256 06baf0a7ff6326ad01cbd207832abf3ec41a7cd64314b18b8fddb4634ef12a7c
MD5 cca6327c8087b837c4bb6ad38f0969b7
SHA1 24b95918f2abcf2a5838680711400f777d1c318f
SHA512 463966dcbc552c90c4e0d8c4fd22c85c240caff8f20752b568f8028843c6edb1a29c629bd30a77a95aa6687e3ca5971cf5b2278396e1627636da92942e626072
SSDEEP 24576:6Quq2j0l/+GVvlOpqsmPYrOuboTcgU1K:6T8+GplOwbArmI1
TLSH
T123050230B7E0C039F5B712F489BAD274A92DBA716B7880CB62E516E907785E4DC31397
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\fupecumune87-boven3\vira\jukayoc-55\wucul-h.pdb

kernel32

TlsGetValue InterlockedIncrement GetCommState GetProfileStringW UnlockFile CallNamedPipeW FreeEnvironmentStringsA GetNumberFormatA FindResourceExA GlobalAlloc GetPrivateProfileIntA GetConsoleAliasExesLengthW HeapDestroy CreateSemaphoreA EnumResourceLanguagesA GetModuleFileNameW GetCompressedFileSizeA GetSystemDirectoryA CreateActCtxA GetBinaryTypeW lstrlenW LCMapStringA GetStartupInfoA SetThreadLocale GetStdHandle CopyFileExW FreeLibraryAndExitThread GetLastError GetProcAddress CreateNamedPipeA EnterCriticalSection LoadLibraryA OpenMutexA WritePrivateProfileStringA SetThreadIdealProcessor FindAtomA SetSystemTime FindNextFileA WriteProfileStringA CreateIoCompletionPort GetModuleHandleA FindFirstChangeNotificationA HeapSetInformation GetCurrentDirectoryA SetFileShortNameA FindAtomW UnregisterWaitEx GetSystemTime DeleteFileA GetVolumeInformationW LocalFileTimeToFileTime GetThreadContext GetCPInfoExW GetCommandLineW WideCharToMultiByte EncodePointer DecodePointer GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InterlockedDecrement GetACP GetOEMCP GetCPInfo IsValidCodePage TlsAlloc TlsSetValue GetCurrentThreadId TlsFree GetModuleHandleW SetLastError HeapValidate IsBadReadPtr ExitProcess LeaveCriticalSection SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate WriteFile IsProcessorFeaturePresent OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW RtlUnwind LCMapStringW MultiByteToWideChar GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode HeapAlloc GetModuleFileNameA HeapReAlloc HeapSize HeapQueryInformation HeapFree SetStdHandle FlushFileBuffers RaiseException CreateFileW CloseHandle

advapi32

InitiateSystemShutdownA AbortSystemShutdownA

winhttp

WinHttpOpen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_cca6327c8087b837c4bb6ad38f0969b7_amadey_elex_smoke-loader

kernel32

advapi32

winhttp

generic