2026-07-06_c5f333e43712ca911b679be43e22c563_darkgate_elex_floxif_hijackloader_mafia_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_c5f333e43712ca911b679be43e22c563_darkgate_elex_floxif_hijackloader_mafia_magniber
Size 3.3MB
Sample260707-bem8dabz2p
SHA256 96a77652216ec73fd48a455fdb51abb2f9ab9336d54d9abb2fd3e1f1a4fb3b03
MD5 c5f333e43712ca911b679be43e22c563
SHA1 4839dd4da70db3b5b645cfcaf412953032bdd8e9
SHA512 06428603077d5c0420419448213202bcfe3d49482b2947cd4e570628e44d8f6cf435a62d40796494fd609a0d4e023784a069f7aa296fcc4f5010a1f22527b265
SSDEEP 98304:bhQ8oM/Jn4Y32vFEVbAWGHZrMrLqP2EoBF4oj9ghi1RebMIg9Cbk/V8TCgKcCa1E:byypVYZrOqP2EoBF4ojDIg9Cbk/V8FhW
TLSH
T130F5B0217FBD4079D4A23171899DEB7CE66ABD706B3502B712503E3ABF317824D2861B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-06_c5f333e43712ca911b679be43e22c563_darkgate_elex_floxif_hijackloader_mafia_magniber

File Explorer

2026-07-06_c5f333e43712ca911b679be43e22c563_darkgate_elex_floxif_hijackloader_mafia_magniber

.exe 3.3MB

2026-07-06_c5f333e43712ca911b679be43e22c563_darkgate_elex_floxif_hijackloader_mafia_magniber

IMPHASH ad4cfd330f57757c1604c0f8137feda5
SHA256 96a77652216ec73fd48a455fdb51abb2f9ab9336d54d9abb2fd3e1f1a4fb3b03
MD5 c5f333e43712ca911b679be43e22c563
SHA1 4839dd4da70db3b5b645cfcaf412953032bdd8e9
SHA512 06428603077d5c0420419448213202bcfe3d49482b2947cd4e570628e44d8f6cf435a62d40796494fd609a0d4e023784a069f7aa296fcc4f5010a1f22527b265
SSDEEP 98304:bhQ8oM/Jn4Y32vFEVbAWGHZrMrLqP2EoBF4oj9ghi1RebMIg9Cbk/V8TCgKcCa1E:byypVYZrOqP2EoBF4ojDIg9Cbk/V8FhW
TLSH
T130F5B0217FBD4079D4A23171899DEB7CE66ABD706B3502B712503E3ABF317824D2861B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a1:c7:21:d6:e9:ce:1a:66:19:a7:97:0f:56:c3:52:48:35:92:1b:71

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Mar 12, 2025

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

11:b1:8b:fb:d8:e8:bf:81:6b:44:7b:98:9b:f2:d9:b4:7a:a7:d3:70:ec:f9:4f:06:3c:2b:f3:92:05:4e:ad:ad

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Mar 12, 2025

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Serial Number

07:de:92:56:75:ef:b1:50:cb:1c:bb:0a:4e:d8:76:71

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 13, 2024 - Sep 14, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1247494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\Jenkins\workspace\buildDriverWithParameter\Windows\Core\Release\ES2Launcher.pdb

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey InitializeSecurityDescriptor SetSecurityDescriptorDacl RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCreateKeyExW

kernel32

IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetConsoleMode GetStringTypeW GetTimeZoneInformation GetLocaleInfoA EnumSystemLocalesA IsDebuggerPresent WriteConsoleW SetEnvironmentVariableA HeapCreate SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle SetUnhandledExceptionFilter VirtualQuery GetSystemInfo GetSystemTimeAsFileTime HeapSize HeapQueryInformation UnhandledExceptionFilter TerminateProcess IsValidLocale QueryPerformanceCounter CreateThread ExitThread ExitProcess GetFileType SetStdHandle RaiseException RtlUnwind EncodePointer DecodePointer GetStartupInfoW HeapSetInformation GetCommandLineW FindResourceExW GetUserDefaultLCID VirtualProtect SearchPathW GetProfileIntW GetNumberFormatW GetWindowsDirectoryW GlobalFlags GetSystemDirectoryW GetCurrentDirectoryW SetErrorMode GetFileTime GetFileSizeEx FileTimeToLocalFileTime GetFileAttributesExW FileTimeToSystemTime lstrlenA GlobalGetAtomNameW TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle TlsGetValue LocalAlloc InterlockedIncrement ResumeThread SetThreadPriority GlobalAddAtomW GlobalFindAtomW CompareStringW InitializeCriticalSectionAndSpinCount lstrcpyW FreeResource InterlockedDecrement ReleaseActCtx CreateActCtxW lstrcmpA GlobalDeleteAtom GetCurrentThread GetUserDefaultUILanguage ConvertDefaultLocale GetSystemDefaultUILanguage CompareStringA lstrcmpW GetLocaleInfoW LoadLibraryExW InterlockedExchange GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile ActivateActCtx DeactivateActCtx CreateFileW lstrcmpiW GetThreadLocale SetLastError CopyFileW GlobalSize GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW MulDiv VerifyVersionInfoW VerSetConditionMask VirtualAlloc GlobalReAlloc GlobalFree GlobalAlloc HeapReAlloc HeapFree HeapAlloc GetProcessHeap WaitForSingleObject OpenMutexW GetLastError CreateMutexW CloseHandle WideCharToMultiByte MultiByteToWideChar GetCurrentProcessId GetCurrentThreadId GetLocalTime GetTickCount GetVersionExW GlobalMemoryStatusEx GetCurrentProcess GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileStringW GetFileAttributesW FindNextFileW DeleteFileW FindClose FindFirstFileW CreateDirectoryW GetTempFileNameW GetTempPathW GetModuleFileNameW GetProcAddress LoadLibraryW FreeLibrary DeleteCriticalSection InitializeCriticalSection Sleep LeaveCriticalSection EnterCriticalSection WritePrivateProfileStringW FindResourceW LoadResource LockResource SizeofResource GetConsoleCP InterlockedCompareExchange

user32

InflateRect MessageBeep GetNextDlgTabItem GetNextDlgGroupItem ReleaseCapture SetCapture InvalidateRgn IntersectRect SetRect IsRectEmpty CopyAcceleratorTableW OffsetRect CharNextW UnregisterClassW KillTimer SetTimer InvalidateRect RealChildWindowFromPoint EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect SetLayeredWindowAttributes EnumDisplayMonitors SystemParametersInfoW SetRectEmpty DeleteMenu LoadCursorW GetDC ReleaseDC GetSysColorBrush GetWindowThreadProcessId ShowOwnedPopups SetCursor GetMessageW TranslateMessage GetActiveWindow GetCursorPos SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem IsWindowEnabled ShowWindow MoveWindow SetWindowTextW IsDialogMessageW CheckDlgButton LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW RemovePropW GetMenuItemInfoW IsWindow SetFocus GetWindowTextLengthW CloseClipboard GetForegroundWindow SetActiveWindow DispatchMessageW BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos PeekMessageW MonitorFromWindow GetMonitorInfoW MapWindowPoints ScrollWindow TrackPopupMenu GetKeyState SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos EnableWindow ShowScrollBar RedrawWindow IsWindowVisible ValidateRect UpdateWindow GetClientRect MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx GetWindowRect ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu GetWindowLongW SetClipboardData OpenClipboard GetUpdateRect SetWindowLongW CopyRect GetWindow GetDesktopWindow GetPropW UnionRect IsIconic DestroyMenu CopyImage DestroyIcon IsZoomed SetWindowRgn SetParent DestroyAcceleratorTable CreatePopupMenu WindowFromPoint NotifyWinEvent GetAsyncKeyState PtInRect RegisterWindowMessageW SendMessageW SetWindowContextHelpId GetParent MapDialogRect SetWindowPos UnhookWindowsHookEx PostMessageW PostQuitMessage CharUpperW GetWindowRgn DestroyCursor DrawIcon SubtractRect MapVirtualKeyExW GetKeyNameTextW IsCharLowerW GetDoubleClickTime CharUpperBuffW CopyIcon GetFocus EmptyClipboard SetForegroundWindow GetLastActivePopup RemoveMenu GetSubMenu GetMenuItemCount InsertMenuW GetMenuItemID AppendMenuW GetMenuStringW GetMenuState GetSystemMetrics FrameRect IsClipboardFormatAvailable SetMenuDefaultItem WaitMessage PostThreadMessageW CreateMenu IsMenu UpdateLayeredWindow SetClassLongW MonitorFromPoint TranslateMDISysAccel DrawMenuBar DefMDIChildProcW DefFrameProcW UnpackDDElParam ReuseDDElParam InsertMenuItemW TranslateAcceleratorW CreateDialogIndirectParamW EndDialog LoadImageW GetIconInfo EnableScrollBar HideCaret InvertRect GetMenuDefaultItem RegisterClipboardFormatW LockWindowUpdate BringWindowToTop SetCursorPos CreateAcceleratorTableW LoadAcceleratorsW GetKeyboardState GetKeyboardLayout MapVirtualKeyW ToUnicodeEx DrawFocusRect DrawFrameControl DrawEdge DrawIconEx DrawStateW GetSystemMenu GetWindowTextW LoadMenuW

gdi32

SetROP2 SetMapMode GetClipBox ExcludeClipRect IntersectClipRect LineTo MoveToEx SetTextAlign GetLayout SetLayout SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC SelectPalette GetObjectType CreatePatternBrush CreateHatchBrush SetPolyFillMode GetTextColor GetRgnBox GetTextExtentPoint32W CreateDIBSection CreateRoundRectRgn CreatePolygonRgn CombineRgn PatBlt CreateEllipticRgn Polyline Ellipse Polygon SetRectRgn GetMapMode DPtoLP CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries OffsetRgn SetDIBColorTable StretchBlt SetPixel Rectangle EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries GetTextFaceW SetPixelV RestoreDC SetBkMode SaveDC DeleteObject GetTextCharsetInfo EnumFontFamiliesW GetTextMetricsW BitBlt CreateCompatibleDC CreateRectRgnIndirect CreateCompatibleBitmap GetBkColor CreateFontIndirectW CreateSolidBrush CreatePen GetStockObject CreateDIBitmap CreateBitmap GetObjectW SetBkColor SetTextColor CreateDCW CopyMetaFileW GetDeviceCaps

msimg32

AlphaBlend TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

shell32

SHGetFileInfoW SHGetDesktopFolder SHGetSpecialFolderLocation SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW DragFinish DragQueryFileW SHAppBarMessage SHGetSpecialFolderPathW

comctl32

ImageList_GetIconSize InitCommonControlsEx

shlwapi

PathIsDirectoryW PathFileExistsW PathFindFileNameW PathFindExtensionW PathStripToRootW PathIsUNCW PathRemoveFileSpecW

ole32

CreateStreamOnHGlobal OleLockRunning IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoInitializeEx OleInitialize OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CoLockObjectExternal CoInitialize CoCreateInstance CLSIDFromString RegisterDragDrop OleGetClipboard OleIsCurrentClipboard OleFlushClipboard DoDragDrop CoRevokeClassObject CoRegisterMessageFilter CoFreeUnusedLibraries RevokeDragDrop CLSIDFromProgID CoCreateGuid OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree CoUninitialize

oleaut32

VariantCopy VariantInit SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen VarBstrFromDate OleCreateFontIndirect VariantChangeType VariantClear SysAllocString SysAllocStringLen SysFreeString

oledlg

OleUIBusyW

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipDrawImageI

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_c5f333e43712ca911b679be43e22c563_darkgate_elex_floxif_hijackloader_mafia_magniber

PE Signature issue

PE Signature issue

advapi32

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

version

oleacc

imm32

winmm

generic