2026-10-26_5d305ade328d5f40f5f672f0ce7eba88_amadey_elex_nionspy_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_5d305ade328d5f40f5f672f0ce7eba88_amadey_elex_nionspy_smoke-loader
Size 1.5MB
Sample261027-tx9hfaea53
SHA256 9bd00a353d24a4152203d8005386f0875c1cb14a4489d6cd5bbe1ae271570fbc
MD5 5d305ade328d5f40f5f672f0ce7eba88
SHA1 c9fa46e502ce6083db6a32a5906078ab0ea521a9
SHA512 a683f11b98ee2b4ba8ce84a196fee2dbfad604efea08a09fc453985ce922814864d86b8417059c8a3c7528899746a0b3b78b658d919b0dd7084b498a79e2496b
SSDEEP 24576:tp6xWv9NwsDjHp6xWv9NwsDjLp6xWv9NwsDjHYp6xWv9NwsDjHp6xWv9NwsDjLpz:Dz9C0tz9C0hz9C0Wz9C0tz9C0hz9C0
TLSH
T15F658E00B6E0C4B2D85666B440ABAB760D7D36352F26E5D3F7601E649D603F2BE3436E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_5d305ade328d5f40f5f672f0ce7eba88_amadey_elex_nionspy_smoke-loader

File Explorer

2026-10-26_5d305ade328d5f40f5f672f0ce7eba88_amadey_elex_nionspy_smoke-loader

.exe 1.5MB

2026-10-26_5d305ade328d5f40f5f672f0ce7eba88_amadey_elex_nionspy_smoke-loader

IMPHASH 366ace8a1c8bfddc75a256e571e54824
SHA256 9bd00a353d24a4152203d8005386f0875c1cb14a4489d6cd5bbe1ae271570fbc
MD5 5d305ade328d5f40f5f672f0ce7eba88
SHA1 c9fa46e502ce6083db6a32a5906078ab0ea521a9
SHA512 a683f11b98ee2b4ba8ce84a196fee2dbfad604efea08a09fc453985ce922814864d86b8417059c8a3c7528899746a0b3b78b658d919b0dd7084b498a79e2496b
SSDEEP 24576:tp6xWv9NwsDjHp6xWv9NwsDjLp6xWv9NwsDjHYp6xWv9NwsDjHp6xWv9NwsDjLpz:Dz9C0tz9C0hz9C0Wz9C0tz9C0hz9C0
TLSH
T15F658E00B6E0C4B2D85666B440ABAB760D7D36352F26E5D3F7601E649D603F2BE3436E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocalTime LoadLibraryA GetSystemTime CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GetDriveTypeA GlobalLock GlobalUnlock GetTickCount SetFileAttributesA CreateFileW GetProcessHeap SetEndOfFile GetStringTypeW LCMapStringW GetTimeZoneInformation WriteConsoleW SetEnvironmentVariableA CompareStringW FlushFileBuffers SetStdHandle GetCurrentProcessId QueryPerformanceCounter Sleep GlobalMemoryStatus GetComputerNameA GetVersionExA CreateToolhelp32Snapshot TerminateProcess Process32Next OpenProcess Process32First CloseHandle GetFileTime SetFileTime OpenFile GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameW HeapCreate GetConsoleMode GetConsoleCP MultiByteToWideChar WideCharToMultiByte SetFilePointer InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind DeleteCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError DeleteFileA HeapFree HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType

user32

ReleaseDC GetDC GetWindowRect MessageBoxA DispatchMessageA GetDesktopWindow SetWindowsHookExA CallNextHookEx CloseClipboard GetClipboardData OpenClipboard UnhookWindowsHookEx TranslateMessage GetMessageA GetKeyState

gdi32

DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap GetPixel BitBlt

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

InternetConnectA InternetCloseHandle InternetReadFile HttpOpenRequestA InternetGetConnectedState HttpSendRequestA InternetOpenA

winmm

mciSendStringA mciSendCommandA

wsock32

socket send gethostbyname closesocket htons WSAStartup connect

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_5d305ade328d5f40f5f672f0ce7eba88_amadey_elex_nionspy_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

generic