General
- Target 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee
- Size 6.0MB
- Sample261002-weshbatbjb
- SHA256 009e03f6ba889ca4bb0350f6abb058692304b84bd4e05ffda8023cebab5b8115
- MD5 29143b10b8f7d4ca7d0df554b9ef27c8
- SHA1 db42fa9f39e9f9a59f817cbc102a84f015b1a7e1
- SHA512 9ffd788b6cca61948cf870b523ce2e8afa67648200b7ce4601d6e4bf341bdf4088ac6e46c94b6419f93f9bdb8cacce3b1d17f2b0d6d4261f06d0a1ce84b98d71
- SSDEEP 98304:tJBtN0A0AZ4lBkCOXKojkzBAw7uirZ2ans8GVoLd+GnABc/lw++NU023W:94FECEhw7ui12ansBGdPnkctd+Np4W
- TLSH T1E4561220A3C48A74E2A34778D5B9F64D9634F8902775D0CF639886BC08F56C189FA79F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260911-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee
- Size 6.0MB
- SHA256 009e03f6ba889ca4bb0350f6abb058692304b84bd4e05ffda8023cebab5b8115
- MD5 29143b10b8f7d4ca7d0df554b9ef27c8
- SHA1 db42fa9f39e9f9a59f817cbc102a84f015b1a7e1
- SHA512 9ffd788b6cca61948cf870b523ce2e8afa67648200b7ce4601d6e4bf341bdf4088ac6e46c94b6419f93f9bdb8cacce3b1d17f2b0d6d4261f06d0a1ce84b98d71
- SSDEEP 98304:tJBtN0A0AZ4lBkCOXKojkzBAw7uirZ2ans8GVoLd+GnABc/lw++NU023W:94FECEhw7ui12ansBGdPnkctd+Np4W
- TLSH T1E4561220A3C48A74E2A34778D5B9F64D9634F8902775D0CF639886BC08F56C189FA79F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1