metasploit | 2026-11-02_575867de7f26da706126ed98fee34159_amadey_elex_mafia_smoke-loader

General

Target
2026-11-02_575867de7f26da706126ed98fee34159_amadey_elex_mafia_smoke-loader
Size 337KB
Sample261103-lfsvcshf42
SHA256 e0800bced324495ed3c36ee36c5515938d85c81d678cf25f30cf43bbc5e6e808
MD5 575867de7f26da706126ed98fee34159
SHA1 af6260a4adc3f35ef092e6ec5c39d92b6af8805b
SHA512 4beba7ed14bd8184e551f0b9b777fbfb65c3d19620838ce56159e2c851b3547775a9052b7513386ec7bb0d0c530ccb1834a3c0c2897f1e339084469d9e62e3b7
SSDEEP 6144:xafZbOhOg5mBADcXd7MeVABdGCXrV38Z:xCTg5nDO7MeVABdGCXB38
TLSH
T13B748E3076A0C0B1F8D351FA4AECA67901ADB8B147A511C779C90BFEC6297E06B3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.8.101:24526

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_575867de7f26da706126ed98fee34159_amadey_elex_mafia_smoke-loader

File Explorer

2026-11-02_575867de7f26da706126ed98fee34159_amadey_elex_mafia_smoke-loader

.exe 337KB

2026-11-02_575867de7f26da706126ed98fee34159_amadey_elex_mafia_smoke-loader

IMPHASH 9a343f209e6ab47800fec426becda0eb
SHA256 e0800bced324495ed3c36ee36c5515938d85c81d678cf25f30cf43bbc5e6e808
MD5 575867de7f26da706126ed98fee34159
SHA1 af6260a4adc3f35ef092e6ec5c39d92b6af8805b
SHA512 4beba7ed14bd8184e551f0b9b777fbfb65c3d19620838ce56159e2c851b3547775a9052b7513386ec7bb0d0c530ccb1834a3c0c2897f1e339084469d9e62e3b7
SSDEEP 6144:xafZbOhOg5mBADcXd7MeVABdGCXrV38Z:xCTg5nDO7MeVABdGCXB38
TLSH
T13B748E3076A0C0B1F8D351FA4AECA67901ADB8B147A511C779C90BFEC6297E06B3534B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

139753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\JOEL\documents\visual studio 2010\Projects\main\Debug\main.pdb

kernel32

VirtualAlloc InterlockedIncrement InterlockedDecrement WideCharToMultiByte EncodePointer DecodePointer Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange MultiByteToWideChar RtlUnwind RaiseException GetLastError HeapFree GetCommandLineA HeapSetInformation HeapAlloc LCMapStringW GetCPInfo IsDebuggerPresent lstrlenA GetProcAddress LoadLibraryW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetCurrentThread HeapCreate HeapDestroy HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime FatalAppExitA GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer CloseHandle GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc SetConsoleCtrlHandler FreeLibrary GetProcessHeap VirtualQuery WriteConsoleW SetStdHandle CreateFileW

Name

.textbss

Size

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

275KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Extracted

Signatures

File Explorer

2026-11-02_575867de7f26da706126ed98fee34159_amadey_elex_mafia_smoke-loader

kernel32

generic