2026-08-20_e6443a96c667107559c644b0b3f4455c_amadey_elex_mafia_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_e6443a96c667107559c644b0b3f4455c_amadey_elex_mafia_smoke-loader
Size 491KB
Sample260820-xdg6matcph
SHA256 f8a8d2edcdeec332b7838ce6b0c05bd5e02be8479da177755f1d3017eb49e72d
MD5 e6443a96c667107559c644b0b3f4455c
SHA1 479a730867d640a977aaff52b770db8ee86fa278
SHA512 42763ca542d4878b6c6448c78950af226513db85a68615bd602904aaef394af5ccc6a47adaa69ac42439cf1502201ded217dd9cf8d41036ce0bfc5aa41af9355
SSDEEP 6144:rhGib/+3pk4crU/zaqW+zufG6+/ZO5mzL5:rhGib/+3KnrULzW+zuO6+/ZeSL
TLSH
T115B4F6411A9CD461E4866A35592FCBAB4C79B033BF75D8D7BB9008A065409E2EE3C73F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_e6443a96c667107559c644b0b3f4455c_amadey_elex_mafia_smoke-loader

File Explorer

2026-08-20_e6443a96c667107559c644b0b3f4455c_amadey_elex_mafia_smoke-loader

.exe 491KB

2026-08-20_e6443a96c667107559c644b0b3f4455c_amadey_elex_mafia_smoke-loader

IMPHASH 12a30b523ac71a3cbe9145c89400dd7f
SHA256 f8a8d2edcdeec332b7838ce6b0c05bd5e02be8479da177755f1d3017eb49e72d
MD5 e6443a96c667107559c644b0b3f4455c
SHA1 479a730867d640a977aaff52b770db8ee86fa278
SHA512 42763ca542d4878b6c6448c78950af226513db85a68615bd602904aaef394af5ccc6a47adaa69ac42439cf1502201ded217dd9cf8d41036ce0bfc5aa41af9355
SSDEEP 6144:rhGib/+3pk4crU/zaqW+zufG6+/ZO5mzL5:rhGib/+3KnrULzW+zuO6+/ZeSL
TLSH
T115B4F6411A9CD461E4866A35592FCBAB4C79B033BF75D8D7BB9008A065409E2EE3C73F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

488146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\derek\dr\build_package\build_drmemory-release-32\dynamorio\bin32\DRkill.pdb

Name

.text

Size

360KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-08-20_e6443a96c667107559c644b0b3f4455c_amadey_elex_mafia_smoke-loader

kernel32

user32

generic