2026-09-30_6161ddb3b7a3949e3bacac01fdc5031b_amadey_elex_maze_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_6161ddb3b7a3949e3bacac01fdc5031b_amadey_elex_maze_smoke-loader
Size 691KB
Sample260930-m4felszsdv
SHA256 d1d1846e3c510a20ab53ea1590c33087b1f6490f9fa0ba7a89004cc18da94bad
MD5 6161ddb3b7a3949e3bacac01fdc5031b
SHA1 483fa7e00be27077d9fb8af47f5246baacb7f2f3
SHA512 bd676d5bec1ed4b118b5e9dcfdb2e333fe528f8b9720f57df2fd5a919947088096952629b0edfa5c439e70fa473f2d73018e51cc9bcb53d0d3246987de96b718
SSDEEP 12288:k3iNZSIGkIYZV1Thql0vPGeeQ8jbzSMYoabaOivNMe+fI4BH1mmZoM7E5N00HXD:2wmYZDThqiPze9fTYhfp51bZoAE5N0qz
TLSH
T103E47B2276C0C07ED2330136B95C772455BEB97249269947FBC98B1C2EB91D2EF25B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-30_6161ddb3b7a3949e3bacac01fdc5031b_amadey_elex_maze_smoke-loader

File Explorer

2026-09-30_6161ddb3b7a3949e3bacac01fdc5031b_amadey_elex_maze_smoke-loader

.exe 691KB

2026-09-30_6161ddb3b7a3949e3bacac01fdc5031b_amadey_elex_maze_smoke-loader

IMPHASH 24123a0978220f139291a7a73f86ea34
SHA256 d1d1846e3c510a20ab53ea1590c33087b1f6490f9fa0ba7a89004cc18da94bad
MD5 6161ddb3b7a3949e3bacac01fdc5031b
SHA1 483fa7e00be27077d9fb8af47f5246baacb7f2f3
SHA512 bd676d5bec1ed4b118b5e9dcfdb2e333fe528f8b9720f57df2fd5a919947088096952629b0edfa5c439e70fa473f2d73018e51cc9bcb53d0d3246987de96b718
SSDEEP 12288:k3iNZSIGkIYZV1Thql0vPGeeQ8jbzSMYoabaOivNMe+fI4BH1mmZoM7E5N00HXD:2wmYZDThqiPze9fTYhfp51bZoAE5N0qz
TLSH
T103E47B2276C0C07ED2330136B95C772455BEB97249269947FBC98B1C2EB91D2EF25B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

15:ca:b3:27:e7:0c:ef:93:95:78:22:e4:73:b4:da:7f:14:b7:f5:e8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Buy List,O=Buy List,L=San Diego,ST=California,C=US

Chains

Nov 13, 2015

CN=Buy List,O=Buy List,L=San Diego,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Buy List,O=Buy List,L=San Diego,ST=California,C=US

Serial Number

69:d6:35:6d:72:92:8f:66:55:8e:b4:73:b3:f7:cf:8c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 25, 2015 - Sep 24, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

345400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForMultipleObjects Sleep FindClose ConnectNamedPipe CreateEventW CreateWaitableTimerW SetWaitableTimer CancelWaitableTimer GetModuleFileNameW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileExW CreateNamedPipeW WaitNamedPipeW CancelIo GetVersionExW DecodePointer GetACP IsValidCodePage GetOverlappedResult GetCurrentProcess InterlockedIncrement Process32NextW Process32FirstW CreateToolhelp32Snapshot GetComputerNameW GetModuleHandleW OpenMutexW CreateMutexW WaitForSingleObject ReleaseMutex DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException GetExitCodeProcess TerminateProcess OpenProcess LocalFree GetProcAddress InterlockedDecrement WideCharToMultiByte MultiByteToWideChar GetFileAttributesW CreateFileW ResetEvent GetCurrentDirectoryW LocalFileTimeToFileTime SystemTimeToFileTime CloseHandle SetFileTime SetFilePointer ReadFile WriteFile FindResourceExW FindResourceW SizeofResource LoadResource GetLastError GetProcessHeap HeapSize LockResource HeapFree HeapReAlloc HeapAlloc HeapDestroy GetStdHandle EnumSystemLocalesW lstrlenA SetEndOfFile LoadLibraryW SetEnvironmentVariableA ReadConsoleW WriteConsoleW SetStdHandle GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetTimeZoneInformation UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead ReleaseSemaphore VirtualProtect VirtualFree SetEvent CreateDirectoryW SetErrorMode VirtualAlloc GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter FreeLibrary SetFilePointerEx GetFileType GetConsoleMode GetConsoleCP FlushFileBuffers IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection GetCurrentThreadId DuplicateHandle GetCurrentThread GetExitCodeThread GetStringTypeW GetSystemTimeAsFileTime EncodePointer IsProcessorFeaturePresent RtlUnwind GetCPInfo ExitProcess GetModuleHandleExW GetCommandLineW CreateTimerQueue WaitForSingleObjectEx SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority TlsAlloc TlsGetValue TlsSetValue TlsFree GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError GetStartupInfoW GetTickCount CreateSemaphoreW ExitThread LoadLibraryExW GetDateFormatW GetOEMCP

advapi32

CryptGetHashParam CryptDuplicateKey CryptImportKey CryptExportKey CryptGenKey RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey SetNamedSecurityInfoW ConvertSidToStringSidW CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptEncrypt CryptDestroyKey CryptDeriveKey CryptReleaseContext CryptAcquireContextW LookupAccountNameW LookupAccountSidW SetFileSecurityW MakeAbsoluteSD MakeSelfRelativeSD GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityDescriptorDacl SetSecurityDescriptorDacl GetSecurityDescriptorControl GetSecurityDescriptorLength InitializeSecurityDescriptor AddAce GetAclInformation InitializeAcl CopySid GetLengthSid GetSidSubAuthority InitializeSid GetSidLengthRequired IsValidSid GetTokenInformation OpenProcessToken

shell32

ord165 SHGetFolderPathW

ole32

CoUninitialize CoInitializeSecurity CoSetProxyBlanket CoCreateInstance StringFromGUID2 CoCreateGuid CoInitializeEx

oleaut32

SysAllocStringByteLen SysStringLen SysAllocString VariantClear SysFreeString

shlwapi

PathAppendW PathCombineW PathFileExistsW PathCombineA PathFindExtensionW PathFindFileNameW PathMakePrettyW PathRemoveFileSpecW PathRenameExtensionW PathStripPathW

crypt32

CryptStringToBinaryA CryptBinaryToStringA

winhttp

WinHttpOpenRequest WinHttpSendRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpCrackUrl WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_6161ddb3b7a3949e3bacac01fdc5031b_amadey_elex_maze_smoke-loader

PE Signature issue

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

winhttp

version

generic