2026-08-27_9caf19c745b8725098136eb0f950f17d_amadey_elex_mafia_smoke-loader_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_9caf19c745b8725098136eb0f950f17d_amadey_elex_mafia_smoke-loader_wapomi
Size 310KB
Sample260827-n1frmsgp5w
SHA256 72b7cf126851819436c8aa897ebf1505aad92816bf31bb266843a72c6fe60711
MD5 9caf19c745b8725098136eb0f950f17d
SHA1 2e90d22c37ad1779c79c460149ae9ab77f005cd9
SHA512 cc98b07daf6a8b855a4194ee51360f4449a00c83d7086b51084e08c21729b0d5eaebb3f58b60656955c87b4af1e78738be0ee71ac600a0e3ac88a65aac667ae4
SSDEEP 6144:XhItQUyP6Cwt4AFnUTH86BEUCqqSGQYZOq4onaBzFYvGF:XFP6Cwt0TH8uCPSGHZOq/naBza
TLSH
T10E649D1077D1D032D8A310748A6A8BAB8D7DA4622B6568C7B7DC0B7D5F603C2EB3574E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_9caf19c745b8725098136eb0f950f17d_amadey_elex_mafia_smoke-loader_wapomi

File Explorer

2026-08-27_9caf19c745b8725098136eb0f950f17d_amadey_elex_mafia_smoke-loader_wapomi

.exe 310KB

2026-08-27_9caf19c745b8725098136eb0f950f17d_amadey_elex_mafia_smoke-loader_wapomi

IMPHASH d580c8945048fcd3c31a9e045f02457c
SHA256 72b7cf126851819436c8aa897ebf1505aad92816bf31bb266843a72c6fe60711
MD5 9caf19c745b8725098136eb0f950f17d
SHA1 2e90d22c37ad1779c79c460149ae9ab77f005cd9
SHA512 cc98b07daf6a8b855a4194ee51360f4449a00c83d7086b51084e08c21729b0d5eaebb3f58b60656955c87b4af1e78738be0ee71ac600a0e3ac88a65aac667ae4
SSDEEP 6144:XhItQUyP6Cwt4AFnUTH86BEUCqqSGQYZOq4onaBzFYvGF:XFP6Cwt0TH8uCPSGHZOq/naBza
TLSH
T10E649D1077D1D032D8A310748A6A8BAB8D7DA4622B6568C7B7DC0B7D5F603C2EB3574E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

323584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Projects\Visual Studio 2010\KMSEmulator_UpdatedToV6_7_mod_1_0_8\KMS Server Service\bin\x86\Release\KMSSS.pdb

advapi32

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW CryptHashData CryptDestroyHash CryptCreateHash CryptGetHashParam CryptSetHashParam CryptDecrypt CryptDestroyKey CryptEncrypt CryptImportKey CryptReleaseContext CryptSetKeyParam CryptAcquireContextW CloseEventLog AdjustTokenPrivileges ReportEventW LookupPrivilegeValueW OpenEventLogW OpenProcessToken CryptGenRandom

rpcrt4

RpcServerRegisterIfEx NdrServerCall2 RpcServerUseProtseqEpW RpcStringFreeW RpcBindingFree RpcBindingToStringBindingW RpcStringBindingParseW RpcServerListen RpcBindingServerFromClient

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

kernel32

Sleep TerminateProcess FileTimeToSystemTime CompareStringW GetLocalTime CloseHandle GetSystemTime GetSystemDefaultLCID InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCommandLineW HeapSetInformation GetLastError HeapFree HeapAlloc HeapReAlloc GetProcAddress GetModuleHandleW ExitProcess GetSystemTimeAsFileTime GetCPInfo RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteFile GetStdHandle GetTickCount FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount WideCharToMultiByte GetFileType GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapCreate QueryPerformanceCounter GetCurrentProcessId IsProcessorFeaturePresent ReadFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize GetACP GetOEMCP IsValidCodePage LoadLibraryW GetLocaleInfoW GetTimeZoneInformation GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleW CreateFileW SetEndOfFile GetProcessHeap SetEnvironmentVariableA GetCurrentProcess SystemTimeToTzSpecificLocalTime InitializeCriticalSectionAndSpinCount OpenProcess GetModuleFileNameW

Name

.text

Size

198KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

��,��uR

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_9caf19c745b8725098136eb0f950f17d_amadey_elex_mafia_smoke-loader_wapomi

advapi32

rpcrt4

iphlpapi

ws2_32

kernel32

generic