2026-09-27_811158ed220b72ad4840d2020c09adcc_amadey_elex_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_811158ed220b72ad4840d2020c09adcc_amadey_elex_smoke-loader_stealc
Size 258KB
Sample260928-eekzssvzf1
SHA256 35747573eb59ac88351599f1b0bd0b4b910a411facad248315ad810f6d0b38b7
MD5 811158ed220b72ad4840d2020c09adcc
SHA1 53a9da3b4cbe7cc080645b08f04b853fafac7fc1
SHA512 01899eb0516122d94ab95fe86ff0790ce3f4ecf47bb67ff4cdcfb1981c7b18a0ed65887d94bbb416ac875db95a0c345fc93fa88b2f236042c19b3ee2d0ec341d
SSDEEP 6144:9dkiC5hwHspYalIRnuCC8dLAyzWcWpyo7dv:9dknQMCaCRtjlJz5W5dv
TLSH
T122445A6133E09031E5B31A3059B9DB31497FBC766971C58E63A83A2D1E327D0C9B5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_811158ed220b72ad4840d2020c09adcc_amadey_elex_smoke-loader_stealc

File Explorer

2026-09-27_811158ed220b72ad4840d2020c09adcc_amadey_elex_smoke-loader_stealc

.exe 258KB

2026-09-27_811158ed220b72ad4840d2020c09adcc_amadey_elex_smoke-loader_stealc

IMPHASH 0681a4c7a9b345a39225394cd491fbb0
SHA256 35747573eb59ac88351599f1b0bd0b4b910a411facad248315ad810f6d0b38b7
MD5 811158ed220b72ad4840d2020c09adcc
SHA1 53a9da3b4cbe7cc080645b08f04b853fafac7fc1
SHA512 01899eb0516122d94ab95fe86ff0790ce3f4ecf47bb67ff4cdcfb1981c7b18a0ed65887d94bbb416ac875db95a0c345fc93fa88b2f236042c19b3ee2d0ec341d
SSDEEP 6144:9dkiC5hwHspYalIRnuCC8dLAyzWcWpyo7dv:9dknQMCaCRtjlJz5W5dv
TLSH
T122445A6133E09031E5B31A3059B9DB31497FBC766971C58E63A83A2D1E327D0C9B5B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

355328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\re\jdk7u45\229\build\windows-i586\tmp\deploy\jre-image\bin\javaws.pdb

kernel32

LoadLibraryW GetModuleHandleW FreeLibrary GetProcAddress GetTickCount GetThreadLocale ReadFile CloseHandle WaitForSingleObject SetHandleInformation CreatePipe CreateDirectoryW GetSystemWindowsDirectoryW FindClose FindFirstFileW GetModuleFileNameW InterlockedIncrement GlobalMemoryStatusEx GetVersionExW GetCurrentProcess GetNativeSystemInfo GetLastError CreateFileW GetSystemDirectoryW CreateProcessW lstrlenW LocalAlloc FormatMessageW GetLongPathNameW GetShortPathNameW InterlockedDecrement GetWindowsDirectoryW OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetModuleHandleExW GetFileAttributesW lstrlenA GetExitCodeProcess WriteConsoleW FlushFileBuffers HeapSize CompareStringW LCMapStringW QueryPerformanceCounter GetProcessHeap SetEndOfFile SetFilePointer SetStdHandle GetConsoleMode GetConsoleCP SetHandleCount Sleep SetEnvironmentVariableW SetEnvironmentVariableA DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle WriteFile HeapCreate IsProcessorFeaturePresent LocalFree InterlockedExchange LoadLibraryA RaiseException FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW WideCharToMultiByte GetSystemTimeAsFileTime HeapFree HeapReAlloc HeapAlloc GetStringTypeW ExitProcess DecodePointer MultiByteToWideChar RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteFileW GetFileType GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetCommandLineW HeapSetInformation GetStartupInfoW GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError

user32

LoadCursorW DefWindowProcW DispatchMessageW TranslateMessage GetMessageW SetTimer CreateWindowExW RegisterClassW wsprintfW MessageBoxW

ole32

StringFromCLSID CoTaskMemFree

oleaut32

SysFreeString VariantClear SysAllocString SysStringLen SysAllocStringByteLen

wsock32

closesocket WSAAsyncSelect connect htons getsockname ioctlsocket socket bind recv accept ntohs listen WSAStartup send WSAGetLastError

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_811158ed220b72ad4840d2020c09adcc_amadey_elex_smoke-loader_stealc

kernel32

user32

ole32

oleaut32

wsock32

generic