2026-08-03_0841997825a70df30a206908407fc362_elex_mafia_smoke-loader_wapomi

General

Target
2026-08-03_0841997825a70df30a206908407fc362_elex_mafia_smoke-loader_wapomi
Size 656KB
Sample260804-qetsgs1epc
SHA256 1f5b766254f5537af6a737a7abcf7f13b2a364b2d4c39b1e9c75da42e1de9b10
MD5 0841997825a70df30a206908407fc362
SHA1 6d4d41247f77a290426fa2eaf885b11b524ad6e2
SHA512 f6624adc9246feb0915237da04ba8110b34ab64e0348b23564fe2459b11ca309f4cf27110366d563a8dd63589dcb979983d677f700d02c16b094303f7f2179bf
SSDEEP 12288:2+LonB/3aK2+c/oq50Lwabhl5NQiP8HCDJGQqANUCwj0/64nIiUvpKaL83sd2+Qp:2+2B/3aEbLqANULj0y45U8p3sd2+WjiG
TLSH
T160E49D22B782C27BD5B320B04D69979A147BF5704F2659C7E3D40B6E0F249C36E3626B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_0841997825a70df30a206908407fc362_elex_mafia_smoke-loader_wapomi

File Explorer

2026-08-03_0841997825a70df30a206908407fc362_elex_mafia_smoke-loader_wapomi

.exe 656KB

2026-08-03_0841997825a70df30a206908407fc362_elex_mafia_smoke-loader_wapomi

IMPHASH ed42db10b3c1bb69db439b51470b9726
SHA256 1f5b766254f5537af6a737a7abcf7f13b2a364b2d4c39b1e9c75da42e1de9b10
MD5 0841997825a70df30a206908407fc362
SHA1 6d4d41247f77a290426fa2eaf885b11b524ad6e2
SHA512 f6624adc9246feb0915237da04ba8110b34ab64e0348b23564fe2459b11ca309f4cf27110366d563a8dd63589dcb979983d677f700d02c16b094303f7f2179bf
SSDEEP 12288:2+LonB/3aK2+c/oq50Lwabhl5NQiP8HCDJGQqANUCwj0/64nIiUvpKaL83sd2+Qp:2+2B/3aEbLqANULj0y45U8p3sd2+WjiG
TLSH
T160E49D22B782C27BD5B320B04D69979A147BF5704F2659C7E3D40B6E0F249C36E3626B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

684032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Develop\My\ssr2\Release\rxrepl.pdb

kernel32

FindFirstFileW FindNextFileW FindClose WideCharToMultiByte MultiByteToWideChar ReadFile GetLastError WriteFile CreateFileW SetFilePointer GetStdHandle CloseHandle SetLastError FormatMessageW LocalFree GetModuleHandleW InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer DeleteFileW DeviceIoControl GetFileAttributesW CreateDirectoryW GetProcAddress GetModuleHandleA AreFileApisANSI FormatMessageA HeapFree MoveFileW GetCommandLineW HeapSetInformation HeapAlloc HeapReAlloc RtlUnwind LCMapStringW GetCPInfo RaiseException ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetModuleFileNameW GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW WriteConsoleW SetStdHandle GetTimeFormatA GetDateFormatA CompareStringW GetTimeZoneInformation SetEnvironmentVariableA

user32

LoadStringW

Name

.text

Size

486KB

Virtual Size

485KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

4�꼣u.

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_0841997825a70df30a206908407fc362_elex_mafia_smoke-loader_wapomi

kernel32

user32

generic