2025-11-09_74811d77e231c6b61add14e1c3547594_elex_mafia_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2025-11-09_74811d77e231c6b61add14e1c3547594_elex_mafia_smoke-loader
Size 1.8MB
Sample251109-rfdy4awnbt
SHA256 a0760bbc1e458f5912b0f6dc07187a1cf00cc9b8fd6cb571459c6d6759aa0bf6
MD5 74811d77e231c6b61add14e1c3547594
SHA1 85d0f81ecc3edb3bcdb933c0caf16a038870b204
SHA512 b25d05189b57b9a9302dd34fd1ab81f5fc48ce01635f83b1c51d6618ee3b68f7b88f5b1ebd91d296718a06481dc8e9957974adeb36aa95e3bef3eeead9a06ee6
SSDEEP 49152:y0NS6cQN7/TjB6OocUaRJA9c7KCqL9XbOZHypt:y0Yp+Bqcb+NgBypt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2025-11-09_74811d77e231c6b61add14e1c3547594_elex_mafia_smoke-loader

.exe 1.8MB

2025-11-09_74811d77e231c6b61add14e1c3547594_elex_mafia_smoke-loader

IMPHASH 5beb291ae6544664f7c8c89434aaa3fa
SHA256 a0760bbc1e458f5912b0f6dc07187a1cf00cc9b8fd6cb571459c6d6759aa0bf6
MD5 74811d77e231c6b61add14e1c3547594
SHA1 85d0f81ecc3edb3bcdb933c0caf16a038870b204
SHA512 b25d05189b57b9a9302dd34fd1ab81f5fc48ce01635f83b1c51d6618ee3b68f7b88f5b1ebd91d296718a06481dc8e9957974adeb36aa95e3bef3eeead9a06ee6
SSDEEP 49152:y0NS6cQN7/TjB6OocUaRJA9c7KCqL9XbOZHypt:y0Yp+Bqcb+NgBypt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

a1:e1:08:07:f9:7f:99:80:fc:58:c9:5a:c4:8b:18:1a:15:a3:d3:a8:a5:21:c4:b3:f8:1e:83:bc:f9:80:11:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gianpaolo Bottin,O=Gianpaolo Bottin,ST=Torino,C=IT,1.2.840.113549.1.9.1=#0c146769616e70616f6c6f40626f7474696e2e636f6d

Chains

Nov 6, 2025

CN=Gianpaolo Bottin,O=Gianpaolo Bottin,ST=Torino,C=IT,1.2.840.113549.1.9.1=#0c146769616e70616f6c6f40626f7474696e2e636f6d

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Gianpaolo Bottin,O=Gianpaolo Bottin,ST=Torino,C=IT,1.2.840.113549.1.9.1=#0c146769616e70616f6c6f40626f7474696e2e636f6d

Serial Number

53:f9:3f:59:2b:77:9d:de:b0:bf:81:69:4d:7a:6b:29

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 14, 2024 - Jan 13, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2025,O=Asseco Data Systems S.A.,C=PL

Serial Number

9e:9c:04:f6:55:a8:b4:a7:02:6d:49:8c:6c:78:8d:aa

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 9, 2025 - Jan 7, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

571850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnterCriticalSection VirtualProtectEx GetLastError CreateMutexA ContinueDebugEvent ResumeThread OutputDebugStringA OutputDebugStringW SetThreadContext GetThreadContext WaitForDebugEvent WriteProcessMemory UnmapViewOfFile InitializeCriticalSection FreeConsole CreateThread SuspendThread DebugActiveProcess SetEnvironmentVariableA GetCurrentProcessId MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA GetVersionExA GetProcAddress LoadLibraryA GetEnvironmentVariableA VirtualProtect VirtualAlloc SetLastError ReleaseMutex WaitForSingleObject OpenMutexA SetErrorMode GetShortPathNameA GetModuleFileNameA GetShortPathNameW GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GlobalFree GlobalGetAtomNameA GlobalDeleteAtom GlobalGetAtomNameW SetFilePointer CreateFileA ExitProcess GetLocalTime MultiByteToWideChar SearchPathA GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW GetWindowsDirectoryA ReadProcessMemory WritePrivateProfileStringA DeleteFileA MoveFileA CreateProcessA GetStartupInfoA GetCurrentThreadId ReadFile GetFileSize GetProcessHeap WriteConsoleW SetStdHandle FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation LoadLibraryW FreeLibrary SetConsoleCtrlHandler FatalAppExitA IsValidCodePage GetOEMCP GetACP IsProcessorFeaturePresent QueryPerformanceCounter HeapDestroy HeapCreate GetStartupInfoW GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize GetLocaleInfoW GetStdHandle CompareStringW WriteFile TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringW HeapAlloc GetDateFormatA GetTimeFormatA GetModuleHandleW HeapFree GetSystemTimeAsFileTime RaiseException RtlUnwind LeaveCriticalSection GetExitCodeProcess GetCurrentThread SetThreadPriority Sleep GetTickCount VirtualQueryEx CreateEventA CloseHandle GetModuleHandleA SetEvent GetCommandLineA GetPrivateProfileStringA GetCommandLineW FormatMessageA LocalFree InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange DeleteCriticalSection SetEndOfFile SetFilePointerEx CreateFileW FindClose RemoveDirectoryW DeleteFileW DeviceIoControl GetFullPathNameW FindFirstFileW FindNextFileW GetFileAttributesW CreateDirectoryExW CopyFileW GetCurrentDirectoryW SetCurrentDirectoryW GetFileInformationByHandle GetFileAttributesExW GetFileTime SetFileTime MoveFileExW GetDiskFreeSpaceExW CreateDirectoryW AreFileApisANSI

user32

BeginPaint EndPaint KillTimer GetAsyncKeyState DefDlgProcA DrawTextA CreateDialogParamA RegisterClassExA DialogBoxParamA GetWindowTextLengthA GetWindowTextA SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow InSendMessage UnpackDDElParam DefWindowProcW DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA CreateWindowExA GetWindowThreadProcessId SendMessageW PeekMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW PostMessageA IsWindow LoadStringA LoadStringW FindWindowA DestroyWindow GetDesktopWindow GetSystemMetrics MoveWindow MessageBoxA SendMessageA SetPropA EnumThreadWindows GetPropA WaitForInputIdle SetTimer GetMessageA TranslateMessage DispatchMessageA FreeDDElParam

gdi32

SelectObject BitBlt DeleteObject CreatePalette CreateDCA SelectPalette RealizePalette CreateDIBitmap DeleteDC CreateCompatibleDC

comdlg32

GetOpenFileNameA GetSaveFileNameA

shell32

SHGetSpecialFolderPathA

Name

.osdqi

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rfmd

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xabd

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bumrap

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dxtw

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.tvozk

Size

752KB

Virtual Size

768KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.konldm

Size

52KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qyruz

Size

132KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.oldv

Size

40KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.jrenaz

Size

888KB

Virtual Size

896KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kofyws

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2025-11-09_74811d77e231c6b61add14e1c3547594_elex_mafia_smoke-loader

kernel32

user32

gdi32

comdlg32

shell32

generic