2026-10-28_644830df1e50bba6c149256263a33dc6_amadey_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_644830df1e50bba6c149256263a33dc6_amadey_elex_smoke-loader_stop
Size 289KB
Sample261030-dqplpadb48
SHA256 b7f358936d150047de6b421c1757c7a0a73b7ecae14f6b5092d63494b1477d8b
MD5 644830df1e50bba6c149256263a33dc6
SHA1 41a490fb19de71da8b8a4afb0d563c3a9fd3cc02
SHA512 844e9d7caa7a1358de1215288f1b827c12ca3879829cb4c9b6bb1b23ef308ab160860bc6e895cf99e54ebee70a5bb6e96312f50006f0875dd1896abe74673ca5
SSDEEP 6144:QAFgY38LGBccDGSGuEqIjAQT99KLmZPg1oWDizYyscY2fB:LFgY3XQu48GWcd5
TLSH
T174547D02BBE5C072E9E626721C7A8B0F963EF9611F3585CBA3641E1E9D313C19D3135A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-28_644830df1e50bba6c149256263a33dc6_amadey_elex_smoke-loader_stop

File Explorer

2026-10-28_644830df1e50bba6c149256263a33dc6_amadey_elex_smoke-loader_stop

.exe 289KB

2026-10-28_644830df1e50bba6c149256263a33dc6_amadey_elex_smoke-loader_stop

IMPHASH f76e76273eb9977fb096fa5dc6c4f784
SHA256 b7f358936d150047de6b421c1757c7a0a73b7ecae14f6b5092d63494b1477d8b
MD5 644830df1e50bba6c149256263a33dc6
SHA1 41a490fb19de71da8b8a4afb0d563c3a9fd3cc02
SHA512 844e9d7caa7a1358de1215288f1b827c12ca3879829cb4c9b6bb1b23ef308ab160860bc6e895cf99e54ebee70a5bb6e96312f50006f0875dd1896abe74673ca5
SSDEEP 6144:QAFgY38LGBccDGSGuEqIjAQT99KLmZPg1oWDizYyscY2fB:LFgY3XQu48GWcd5
TLSH
T174547D02BBE5C072E9E626721C7A8B0F963EF9611F3585CBA3641E1E9D313C19D3135A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

bf:92:45:d1:06:ca:5b:bb:48:39:30:dc:50:37:15:f7:43:9a:d2:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Credant Technologies,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Credant Technologies,L=Addison,ST=Texas,C=US

Chains

Oct 10, 2012

CN=Credant Technologies,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Credant Technologies,L=Addison,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

CN=Credant Technologies,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Credant Technologies,L=Addison,ST=Texas,C=US

Serial Number

0c:53:f2:92:1b:bd:48:4f:0e:99:8b:0f:a0:2a:3d:f2

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2011 - Jun 23, 2014

Minor OS version

Major OS version

Entry point

141916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\src\CmgWinNtShield\artifacts\bin\WinNtR\CMGShieldUI.pdb

comctl32

InitCommonControlsEx PropertySheetW

crypt32

CertCloseStore CertGetCertificateContextProperty CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CertFreeCertificateContext

kernel32

InterlockedExchange InterlockedCompareExchange GetCurrentThreadId GetTimeFormatW GetDateFormatW GetLocalTime WideCharToMultiByte MoveFileW DeleteFileW SetFilePointer OutputDebugStringA MapViewOfFile CreateFileMappingA CreateEventA CreateDirectoryW VirtualAlloc VirtualFree GetSystemDirectoryW GetModuleFileNameA WriteConsoleA SetStdHandle LoadLibraryW GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP LCMapStringW LCMapStringA GetSystemTimeAsFileTime QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings DeviceIoControl HeapCreate HeapDestroy ExitProcess HeapSize IsValidCodePage GetOEMCP GetCPInfo GetStdHandle TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA CreateFileA GetDriveTypeW GetStartupInfoA GetCommandLineA ResumeThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess ExitThread HeapReAlloc RtlUnwind GetVersionExA GetThreadLocale GetLocaleInfoA GetACP lstrlenA GetProcAddress GetProcessHeap HeapAlloc HeapFree GetCurrentThread LocalAlloc OpenProcess LoadLibraryA GetFileAttributesW GetVersionExW GetSystemInfo LoadLibraryExW SizeofResource MultiByteToWideChar FreeLibrary TerminateThread InterlockedDecrement CreateThread lstrcmpiW WaitForMultipleObjects RaiseException lstrlenW InterlockedIncrement GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetModuleHandleW EnterCriticalSection FlushFileBuffers DisconnectNamedPipe ConnectNamedPipe CreateNamedPipeW SetNamedPipeHandleState CancelIo GetOverlappedResult WaitNamedPipeW FreeEnvironmentStringsA LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection ResetEvent Sleep GetCurrentProcessId FormatMessageW LocalFree GetModuleFileNameW GetTickCount SetEvent CloseHandle CreateEventW GetComputerNameExW GetLogicalDriveStringsW GetCurrentProcess GetLastError FindResourceW LoadResource FreeResource LockResource CreateMutexW WaitForSingleObject OutputDebugStringW ReleaseMutex GetConsoleOutputCP WriteConsoleW GetFileSize ReadFile WriteFile GetSystemDefaultLangID CreateFileW Thread32First CreateToolhelp32Snapshot Thread32Next SetLastError

user32

UpdateWindow IsWindow SetWindowLongW UnregisterClassA GetWindowLongW EndPaint DrawTextW FillRect GetClientRect wsprintfA MsgWaitForMultipleObjectsEx GetSystemMetrics RegisterClassW FindWindowW FindWindowExW SetCursorPos GetSubMenu GetCursorPos DefWindowProcW InflateRect BeginPaint SetTimer TrackPopupMenu DestroyMenu MsgWaitForMultipleObjects PeekMessageW CharNextW CreateDialogParamW IsDialogMessageW LoadImageW SetActiveWindow SetRect GetKeyState GetWindowTextLengthW IsWindowEnabled GetDlgItemTextW SetFocus GetWindowTextW EnableWindow GetSystemMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard SendDlgItemMessageW SetClassLongW GetDlgItem GetWindowRect GetParent SetDlgItemTextW DrawEdge ClientToScreen UnregisterClassW LoadCursorW SetWindowTextW GetScrollInfo GetCaretPos MoveWindow PostQuitMessage GetMenuItemInfoW DeleteMenu CheckMenuItem InsertMenuW EnumWindows PostMessageW GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW RegisterWindowMessageW LoadAcceleratorsW ExitWindowsEx MessageBoxW SetMenuItemInfoW EnableMenuItem SetMenuDefaultItem wsprintfW IsWindowVisible SetForegroundWindow EnumChildWindows GetClassNameW LoadMenuW SendMessageW LoadStringW DestroyWindow SystemParametersInfoW CreateWindowExW LoadIconW RegisterClassExW SetWindowPos ShowWindow KillTimer

gdi32

SetTextColor CreateSolidBrush GetStockObject SelectObject SetBkMode StretchDIBits DeleteObject CreateFontIndirectW

comdlg32

GetSaveFileNameW

advapi32

GetSidSubAuthorityCount GetSidIdentifierAuthority GetSidSubAuthority RegQueryValueExW ImpersonateSelf GetNamedSecurityInfoW SetFileSecurityW RegOpenKeyExA OpenThreadToken AllocateAndInitializeSid InitializeSecurityDescriptor GetLengthSid InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner IsValidSecurityDescriptor AccessCheck RevertToSelf FreeSid GetTokenInformation LookupAccountSidW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW LogonUserW DuplicateToken OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges ConvertSidToStringSidW CopySid RegQueryValueExA RegSetValueExA

shell32

ShellExecuteExW Shell_NotifyIconW SHGetPathFromIDListW SHBrowseForFolderW SHGetMalloc

ole32

CoRegisterClassObject CoTaskMemFree CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoInitializeEx CoQueryProxyBlanket CoUninitialize CoSetProxyBlanket CoTaskMemRealloc

oleaut32

VariantClear VarUI4FromStr RegisterTypeLi SysAllocString LoadTypeLi SysAllocStringByteLen SysFreeString SysStringLen

shlwapi

PathFileExistsW

userenv

ExpandEnvironmentStringsForUserW

psapi

EnumProcesses EnumProcessModules GetModuleBaseNameW GetModuleFileNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_644830df1e50bba6c149256263a33dc6_amadey_elex_smoke-loader_stop

PE Signature issue

comctl32

crypt32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

userenv

psapi

generic