2026-07-10_e148fcaa5b54a54f945243f9e20fa906_elex_gazer_helldown_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_e148fcaa5b54a54f945243f9e20fa906_elex_gazer_helldown_mafia
Size 2.8MB
Sample260710-c685ladt71
SHA256 ab7c232cdd267d60b59d4b6557baad5bca5ee8e1070b825f4c19c3b7ad6a4ee4
MD5 e148fcaa5b54a54f945243f9e20fa906
SHA1 e3adfdfd1273854995b5a198b632024413e27697
SHA512 f670c817f3284082bcf6eca91132deeae6dc6cdf5b431a865d36e6987bcf45ac0689d98f43aa0d5cf12d9f1a3293c1cb5fbd1e2f98e140113a0ad1131e24a565
SSDEEP 49152:8rCgfLzDSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwB:8/zDSSSSSSSSSSSSSSSSSSSSSSSSSSSZ
TLSH
T14FD58C21A651FD32D9D501B0CDBCABBA2B287E2813F595E772943DC969302D17A3834F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-10_e148fcaa5b54a54f945243f9e20fa906_elex_gazer_helldown_mafia

.exe 2.8MB

2026-07-10_e148fcaa5b54a54f945243f9e20fa906_elex_gazer_helldown_mafia

IMPHASH 8cce7cca5f7170a63207355c97cad807
SHA256 ab7c232cdd267d60b59d4b6557baad5bca5ee8e1070b825f4c19c3b7ad6a4ee4
MD5 e148fcaa5b54a54f945243f9e20fa906
SHA1 e3adfdfd1273854995b5a198b632024413e27697
SHA512 f670c817f3284082bcf6eca91132deeae6dc6cdf5b431a865d36e6987bcf45ac0689d98f43aa0d5cf12d9f1a3293c1cb5fbd1e2f98e140113a0ad1131e24a565
SSDEEP 49152:8rCgfLzDSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwB:8/zDSSSSSSSSSSSSSSSSSSSSSSSSSSSZ
TLSH
T14FD58C21A651FD32D9D501B0CDBCABBA2B287E2813F595E772943DC969302D17A3834F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

dd:02:0f:f4:e9:cc:fb:08:5c:99:f2:2c:a9:50:6c:6d:7d:f5:80:19:66:02:53:b1:98:d3:a2:36:70:40:cb:4c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1026605606620,CN=AO Proizvodstvennaya Firma SKB Kontur,O=AO Proizvodstvennaya Firma SKB Kontur,STREET=ul Narodnoy voli\, str 19a,L=Yekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#131453766572646c6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 8, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

5d:d8:ba:ec:a2:6f:86:7b:fc:b4:b8:ec

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 20, 2025 - Jun 20, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1551449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\7236625856f3c609\bin\Release_Win32\session.viewer.pdb

comctl32

InitCommonControlsEx CreateToolbarEx ImageList_Create ImageList_ReplaceIcon ImageList_Add ImageList_Destroy

secur32

GetUserNameExW

winmm

timeGetTime

ws2_32

setsockopt WSACleanup recv bind socket closesocket htons listen accept WSAGetLastError inet_addr WSAStringToAddressA WSAAddressToStringA WSASocketA send getservbyport sendto getservbyname WSASetLastError gethostbyaddr ntohl htonl ntohs WSAIoctl WSASocketW WSASend ioctlsocket recvfrom getaddrinfo select getsockname shutdown freeaddrinfo __WSAFDIsSet getsockopt WSAStartup connect gethostbyname inet_ntoa gethostname WSARecv

kernel32

GetProcessTimes SizeofResource CreateFileW GetLastError ProcessIdToSessionId LockResource GlobalMemoryStatusEx GetCurrentProcessId GetSystemTime lstrcpyA InterlockedCompareExchange InterlockedExchange DeleteCriticalSection lstrcpyW ExitProcess CreateMutexW CreateProcessW GetCurrentDirectoryW QueueUserWorkItem QueryPerformanceCounter QueryPerformanceFrequency WriteFile SetLastError ReadFile GetFileSizeEx RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapReAlloc HeapSize InterlockedIncrement WaitForSingleObjectEx ReleaseSemaphore SetThreadPriority CreateSemaphoreW SetConsoleTextAttribute SetEndOfFile SetEnvironmentVariableA CompareStringW WriteConsoleW FlushFileBuffers IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetLocaleInfoW LCMapStringW GetConsoleMode GetConsoleCP GetTickCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo InterlockedDecrement TlsFree TlsSetValue TlsGetValue TlsAlloc HeapCreate IsProcessorFeaturePresent UnhandledExceptionFilter VirtualQuery GetSystemInfo VirtualAlloc GetSystemTimeAsFileTime GetTimeZoneInformation GetFileType SetStdHandle ExitThread RtlUnwind GetStartupInfoW HeapSetInformation DecodePointer EncodePointer TerminateProcess LocalFree FileTimeToLocalFileTime FileTimeToSystemTime GetTimeFormatW GetDateFormatW CopyFileW GetCurrentThread SystemTimeToFileTime SetFilePointer FreeResource ResumeThread WaitForMultipleObjects GetQueuedCompletionStatus GetSystemDirectoryA InterlockedExchangeAdd TryEnterCriticalSection GetStdHandle FreeConsole CreateIoCompletionPort MultiByteToWideChar WideCharToMultiByte FreeLibrary LoadLibraryA FindNextFileW RemoveDirectoryW FindClose MoveFileW SetFileTime CreateDirectoryW SetUnhandledExceptionFilter LoadResource FindResourceW FindResourceExW DeleteFileW lstrcmpiW GetVersionExW GetProcessHeap HeapFree GetNativeSystemInfo GetCommandLineW ExpandEnvironmentStringsW OutputDebugStringA GetCurrentThreadId IsDebuggerPresent RegisterWaitForSingleObject GlobalUnlock lstrlenW lstrcmpW GetEnvironmentVariableA GetModuleFileNameW GetFileAttributesW lstrcpynW GetLogicalDriveStringsW SetErrorMode FindFirstFileW GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileStringW VirtualProtect GetCurrentProcess FormatMessageW GlobalAlloc OpenProcess GetModuleHandleW GlobalLock UnregisterWait GetEnvironmentVariableW CreateThread CloseHandle CreateEventW GetLocalTime ResetEvent EnterCriticalSection GetProcAddress LeaveCriticalSection Sleep LoadLibraryW lstrlenA InitializeCriticalSection SetEvent WaitForSingleObject FormatMessageA

user32

PostQuitMessage IsDialogMessageW LoadAcceleratorsW GetKeyboardLayout ToUnicodeEx ReleaseDC GetParent CloseDesktop LoadBitmapW SetScrollInfo SetThreadDesktop GetSystemMenu GetMenuItemID InsertMenuItemW EnableMenuItem GetMenuItemCount DestroyMenu CheckMenuItem GetClipboardSequenceNumber UnhookWindowsHookEx OpenInputDesktop ShowScrollBar GetScrollInfo SetCursor TrackMouseEvent DialogBoxParamW EndDialog SetWindowsHookExW CallNextHookEx EnumClipboardFormats IsClipboardFormatAvailable GetDC wvsprintfA SetWindowPlacement SetTimer IsIconic KillTimer MessageBeep GetWindowPlacement GetAsyncKeyState MonitorFromWindow GetDesktopWindow RegisterHotKey GetMonitorInfoW MoveWindow GetSysColor BringWindowToTop GetSystemMetrics DestroyWindow ScreenToClient GetWindowRect TrackPopupMenu FillRect SetCapture GetKeyState CreateMenu RegisterClassExW AppendMenuW SystemParametersInfoW GetCursorPos CreateWindowExW ReleaseCapture UpdateWindow EndPaint CloseClipboard TranslateAcceleratorW RemovePropW SetActiveWindow MapDialogRect GetMessageW GetPriorityClipboardFormat UnregisterClassW PostMessageW DrawTextW DefDlgProcW SetForegroundWindow AttachThreadInput LoadCursorW IsWindowEnabled GetClientRect SetFocus BeginPaint wsprintfW SetPropW GetIconInfo TranslateMessage GetForegroundWindow LoadIconW GetWindowTextA InvalidateRect GetWindowLongW GetClipboardData GetWindowTextW SetClassLongW EmptyClipboard SetWindowLongW RedrawWindow SetWindowPos ShowWindow GetSysColorBrush GetActiveWindow OpenClipboard RegisterClassW IsWindowVisible SetWindowTextA SendMessageW MapWindowPoints EnableWindow SetClipboardData GetDlgCtrlID SetWindowTextW GetPropW CallWindowProcW DefWindowProcW GetWindowThreadProcessId GetWindow DispatchMessageW GetDlgItem MessageBoxW wsprintfA IsWindow CreateDialogParamW

gdi32

GetCurrentObject SetStretchBltMode StretchBlt CreateDIBSection GetDIBits BitBlt DeleteDC CreateCompatibleBitmap SetTextColor SetBkMode DeleteObject SelectObject CreateCompatibleDC Rectangle CreateFontW GetObjectW CreatePen CreateSolidBrush

comdlg32

GetSaveFileNameW

advapi32

CryptReleaseContext RegOpenKeyExW RegDeleteValueW ImpersonateSelf RegCloseKey GetUserNameW DuplicateToken ImpersonateLoggedOnUser RevertToSelf CreateProcessAsUserW DuplicateTokenEx RegDeleteKeyW RegEnumKeyW CryptDecrypt CryptDestroyKey CryptEncrypt CryptImportKey CryptSetKeyParam CryptAcquireContextW GetFileSecurityW CryptGenRandom OpenThreadToken MapGenericMask AccessCheck RegCreateKeyExW RegQueryValueExW RegSetValueExW

shell32

ShellExecuteW SHCreateDirectoryExW CommandLineToArgvW DragFinish SHGetFileInfoW DragQueryFileW SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteA

ole32

CoInitialize CoUninitialize CoCreateInstance CoCreateGuid

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

crypt32

CryptUnprotectData CryptProtectData

shlwapi

PathCanonicalizeW PathRemoveFileSpecW StrStrIW StrStrIA PathFileExistsW PathFindFileNameW PathFindExtensionW

iphlpapi

GetAdaptersAddresses

gdiplus

GdiplusStartup GdiplusShutdown GdipCreateBitmapFromScan0 GdipGetImageEncodersSize GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipGetImageEncoders

msimg32

AlphaBlend

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_e148fcaa5b54a54f945243f9e20fa906_elex_gazer_helldown_mafia

comctl32

secur32

winmm

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

version

crypt32

shlwapi

iphlpapi

gdiplus

msimg32

generic