2026-08-27_ea421a9994e87e85d9d0a1657c7457a7_amadey_elex_mafia_smoke-loader_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_ea421a9994e87e85d9d0a1657c7457a7_amadey_elex_mafia_smoke-loader_wapomi
Size 310KB
Sample260827-gp615azdke
SHA256 7e03a41b35ed470408f960b3ebcebb9cf1d137df3bf9dd45c3c36377bbbbb7a6
MD5 ea421a9994e87e85d9d0a1657c7457a7
SHA1 c28a12c6ed18524b6f1f302541f5928c63888013
SHA512 29dbac69d900d3aa3db17310efc1b1c71d09dddefc7da9372c9892f816bcf33011238f6c8ba0239488774024e207acf0393dd7561d41a6c9476dea9ff24352e8
SSDEEP 6144:XhItQUyP6Cwt4AFnUTH86BEUCqqSGQYZOq4onaBzFYvGL:XFP6Cwt0TH8uCPSGHZOq/naBza
TLSH
T195649D1077D1D032D8A310748A6A8BAB8D7DA0622B6568C7B7DC4B7D5F603C2EB3574E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_ea421a9994e87e85d9d0a1657c7457a7_amadey_elex_mafia_smoke-loader_wapomi

File Explorer

2026-08-27_ea421a9994e87e85d9d0a1657c7457a7_amadey_elex_mafia_smoke-loader_wapomi

.exe 310KB

2026-08-27_ea421a9994e87e85d9d0a1657c7457a7_amadey_elex_mafia_smoke-loader_wapomi

IMPHASH d580c8945048fcd3c31a9e045f02457c
SHA256 7e03a41b35ed470408f960b3ebcebb9cf1d137df3bf9dd45c3c36377bbbbb7a6
MD5 ea421a9994e87e85d9d0a1657c7457a7
SHA1 c28a12c6ed18524b6f1f302541f5928c63888013
SHA512 29dbac69d900d3aa3db17310efc1b1c71d09dddefc7da9372c9892f816bcf33011238f6c8ba0239488774024e207acf0393dd7561d41a6c9476dea9ff24352e8
SSDEEP 6144:XhItQUyP6Cwt4AFnUTH86BEUCqqSGQYZOq4onaBzFYvGL:XFP6Cwt0TH8uCPSGHZOq/naBza
TLSH
T195649D1077D1D032D8A310748A6A8BAB8D7DA0622B6568C7B7DC4B7D5F603C2EB3574E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

323584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Projects\Visual Studio 2010\KMSEmulator_UpdatedToV6_7_mod_1_0_8\KMS Server Service\bin\x86\Release\KMSSS.pdb

advapi32

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW CryptHashData CryptDestroyHash CryptCreateHash CryptGetHashParam CryptSetHashParam CryptDecrypt CryptDestroyKey CryptEncrypt CryptImportKey CryptReleaseContext CryptSetKeyParam CryptAcquireContextW CloseEventLog AdjustTokenPrivileges ReportEventW LookupPrivilegeValueW OpenEventLogW OpenProcessToken CryptGenRandom

rpcrt4

RpcServerRegisterIfEx NdrServerCall2 RpcServerUseProtseqEpW RpcStringFreeW RpcBindingFree RpcBindingToStringBindingW RpcStringBindingParseW RpcServerListen RpcBindingServerFromClient

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

kernel32

Sleep TerminateProcess FileTimeToSystemTime CompareStringW GetLocalTime CloseHandle GetSystemTime GetSystemDefaultLCID InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCommandLineW HeapSetInformation GetLastError HeapFree HeapAlloc HeapReAlloc GetProcAddress GetModuleHandleW ExitProcess GetSystemTimeAsFileTime GetCPInfo RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteFile GetStdHandle GetTickCount FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount WideCharToMultiByte GetFileType GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapCreate QueryPerformanceCounter GetCurrentProcessId IsProcessorFeaturePresent ReadFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize GetACP GetOEMCP IsValidCodePage LoadLibraryW GetLocaleInfoW GetTimeZoneInformation GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleW CreateFileW SetEndOfFile GetProcessHeap SetEnvironmentVariableA GetCurrentProcess SystemTimeToTzSpecificLocalTime InitializeCriticalSectionAndSpinCount OpenProcess GetModuleFileNameW

Name

.text

Size

198KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

��,��uR

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_ea421a9994e87e85d9d0a1657c7457a7_amadey_elex_mafia_smoke-loader_wapomi

advapi32

rpcrt4

iphlpapi

ws2_32

kernel32

generic