2026-07-06_8b0dd93d15a05cc70f258a33b371e141_darkgate_elex_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_8b0dd93d15a05cc70f258a33b371e141_darkgate_elex_floxif_mafia
Size 2.5MB
Sample260707-cw7h1sf14v
SHA256 eaa35a4c30c4fb45e36ad70d369175d30cf0a238d1065d2037220b3c6c4cf19a
MD5 8b0dd93d15a05cc70f258a33b371e141
SHA1 6ee8cfc811f11339c6a7609aa8a454eb5329ff4c
SHA512 e4bd61ba570f3fc234401b875c666a0d0e1e48f10005f0a10b0fda46de43a55abe69fec6d9af53d468a4d2f2fd29ac8d8767dada69e29f0ebb34525a3585a273
SSDEEP 49152:tuILKhofs2hPd2l177BTK2VbDsar1YDj7:tjNfs2hPIl1/4
TLSH
T1BBC5AE00FB46D2F2DD47627448FBA31E462996F843141AD7E3580E0F5EAAAD37D3A18D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-06_8b0dd93d15a05cc70f258a33b371e141_darkgate_elex_floxif_mafia

File Explorer

2026-07-06_8b0dd93d15a05cc70f258a33b371e141_darkgate_elex_floxif_mafia

.exe 2.5MB

2026-07-06_8b0dd93d15a05cc70f258a33b371e141_darkgate_elex_floxif_mafia

IMPHASH 97f5c5cdc5e80758b7adff3a733244ad
SHA256 eaa35a4c30c4fb45e36ad70d369175d30cf0a238d1065d2037220b3c6c4cf19a
MD5 8b0dd93d15a05cc70f258a33b371e141
SHA1 6ee8cfc811f11339c6a7609aa8a454eb5329ff4c
SHA512 e4bd61ba570f3fc234401b875c666a0d0e1e48f10005f0a10b0fda46de43a55abe69fec6d9af53d468a4d2f2fd29ac8d8767dada69e29f0ebb34525a3585a273
SSDEEP 49152:tuILKhofs2hPd2l177BTK2VbDsar1YDj7:tjNfs2hPIl1/4
TLSH
T1BBC5AE00FB46D2F2DD47627448FBA31E462996F843141AD7E3580E0F5EAAAD37D3A18D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fb:89:6b:63:30:f4:54:6b:35:51:f2:2b:f0:1f:8f:f8:5f:e4:0f:29

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Oct 10, 2012

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 14, 2011 - Nov 13, 2014

Minor OS version

Major OS version

Entry point

1349317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\p\agents\hpam2.eem\recipes\201152726\base\branches\inputtools_win_release_branch\googleclient\ime\goopy\scons-out\opt\obj\components\win_frontend\ipc_console.pdb

advapi32

RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetLengthSid GetSecurityInfo CopySid GetUserNameW GetTokenInformation OpenProcessToken SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenCurrentUser RegQueryValueExW RegNotifyChangeKeyValue GetSidSubAuthority GetSidSubAuthorityCount SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl IsValidSid

kernel32

TerminateProcess GetModuleFileNameA IsDebuggerPresent GetCurrentThreadId OutputDebugStringA ReleaseMutex CloseHandle DebugBreak GetTempPathA GlobalAlloc LocalFree ResetEvent SetEvent WaitForMultipleObjects CreateThread Sleep GetVersionExW InterlockedCompareExchange GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime QueryPerformanceCounter FindFirstFileW FindNextFileW GetFullPathNameW DeleteFileW RemoveDirectoryW GetSystemTime LockResource FindResourceExW FindClose MulDiv SetProcessWorkingSetSize CreateTimerQueueTimer DeleteTimerQueueTimer CreateFileW GetTickCount WriteFile ExitThread LoadLibraryW GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile HeapAlloc HeapFree GetProcessHeap ConnectNamedPipe CreateNamedPipeW CancelIo ReadFile GetOverlappedResult FlushInstructionCache SetLastError InterlockedExchange EncodePointer DecodePointer HeapDestroy HeapReAlloc HeapSize InterlockedPushEntrySList IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedPopEntrySList UnhandledExceptionFilter SetUnhandledExceptionFilter WideCharToMultiByte HeapSetInformation GetStartupInfoW ExitProcess VirtualProtect VirtualQuery RtlUnwind GetCPInfo LCMapStringW GetStdHandle HeapCreate GetLocaleInfoW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode FlushFileBuffers GetTimeZoneInformation SetFilePointer GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleW SetStdHandle CreateFileA CompareStringW SetEnvironmentVariableA SetEndOfFile GetThreadLocale CopyFileW SetFileAttributesW GetTempPathW GetFileSizeEx CreateDirectoryW GetFileAttributesW GetCurrentDirectoryW CreateMutexW WaitForSingleObject GetCurrentProcess CreateProcessW GlobalFree GlobalLock GlobalUnlock SetThreadPriority ResumeThread OpenThread FormatMessageA GetModuleHandleA AllocConsole LoadLibraryA GetLongPathNameW GetTempFileNameW MoveFileW GetFileAttributesExW GetDiskFreeSpaceExW GetDriveTypeW GetUserDefaultUILanguage VerSetConditionMask VerifyVersionInfoW FindFirstFileExW GetFileInformationByHandle PeekNamedPipe GetDriveTypeA FindFirstFileExA GetFullPathNameA GetCommandLineW InitializeCriticalSection CreateEventW GetCurrentProcessId ProcessIdToSessionId InitializeCriticalSectionAndSpinCount LoadLibraryExW FindResourceW LoadResource GetFileSize SizeofResource RaiseException lstrcmpiW lstrlenW FreeLibrary GetModuleFileNameW GetProcAddress GetModuleHandleW GetLastError InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection DeleteCriticalSection MultiByteToWideChar

user32

SetWindowPos LoadCursorW DestroyMenu CreatePopupMenu TrackPopupMenu TrackPopupMenuEx GetShellWindow GetDC ReleaseDC AppendMenuW SetMenuItemBitmaps SendMessageW UnregisterClassA MoveWindow GetWindowRect BeginPaint EndPaint InvalidateRect InvalidateRgn ShowWindow IsWindowVisible CharNextW IsWindowEnabled SetCapture SetWindowRgn GetClassInfoExW SetRect TrackMouseEvent GetKeyState ReleaseCapture UpdateLayeredWindow OffsetRect SetCursor IntersectRect MessageBoxA wvsprintfW wsprintfW MessageBoxW IsWindow DispatchMessageW DefWindowProcW CreateWindowExW SetWindowLongW PeekMessageW GetWindowLongW RegisterClassExW TranslateMessage KillTimer PostMessageW PostQuitMessage GetMessageW SetTimer DestroyWindow GetMonitorInfoW SetWindowTextW GetCursorPos EndDialog GetDlgItem SetCursorPos GetForegroundWindow SetFocus DialogBoxParamW MonitorFromPoint ScreenToClient ClientToScreen

ole32

CoInitializeEx CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize CoUninitialize CoCreateGuid CreateStreamOnHGlobal

oleaut32

SysFreeString SysStringLen SysAllocString VarUI4FromStr

gdi32

EnumEnhMetaFile CloseEnhMetaFile CreateEnhMetaFileW GetCurrentObject GetFontUnicodeRanges GetTextMetricsW GetOutlineTextMetricsW GetObjectA AddFontMemResourceEx DeleteEnhMetaFile CreateFontIndirectW CreateRectRgn BitBlt CreateCompatibleDC DeleteDC CombineRgn ExtCreateRegion GetDIBits CreateDCW GetObjectW DeleteObject RemoveFontMemResourceEx SelectObject GetDeviceCaps CreateDIBSection

gdiplus

GdipCreateFromHDC GdipGraphicsClear GdiplusStartup GdipCloneImage GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncodersSize GdipAlloc GdipCreateBitmapFromScan0 GdipFree GdipRestoreGraphics GdiplusShutdown GdipBitmapGetPixel GdipGetImagePixelFormat GdipDrawImageRectRectI GdipPrivateAddFontFile GdipDrawImageI GdipSetClipGraphics GdipCloneFontFamily GdipCreateRegion GdipDeleteRegion GdipSetEmpty GdipCombineRegionRect GdipDeleteGraphics GdipGetImageGraphicsContext GdipSetImageAttributesRemapTable GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipImageRotateFlip GdipGetImageHeight GdipGetImageWidth GdipDeleteFont GdipCreateBitmapFromStream GdipGetFontCollectionFamilyCount GdipGetFontCollectionFamilyList GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawDriverString GdipFillRectangleI GdipCreateFontFamilyFromName GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipCreateTextureIAI GdipSetTextureWrapMode GdipCreatePen1 GdipDeletePen GdipGetPenWidth GdipSetCompositingQuality GdipSetTextRenderingHint GdipSetSmoothingMode GdipResetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipRotateWorldTransform GdipDrawLine GdipFillRectangle GdipDrawImageRectRect GdipSetClipRect GdipSetClipRegion GdipResetClip GdipSaveGraphics GdipCreateTextureIA GdipGetFamilyName GdipSaveImageToStream

winmm

timeGetTime

crypt32

CryptFindOIDInfo

shell32

SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW SHFileOperationW SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW PathCombineW PathFileExistsW StrDupW PathFindExtensionW PathRemoveFileSpecW PathRemoveBackslashW PathIsDirectoryW PathIsRelativeW

secur32

CompleteAuthToken FreeCredentialsHandle AcquireCredentialsHandleA InitializeSecurityContextA DeleteSecurityContext QueryCredentialsAttributesW FreeContextBuffer QueryContextAttributesW DecryptMessage EncryptMessage ApplyControlToken AcquireCredentialsHandleW

usp10

ScriptItemize ScriptBreak ScriptShape ScriptStringFree ScriptStringOut ScriptStringAnalyse ScriptCPtoX ScriptLayout ScriptPlace ScriptFreeCache

ws2_32

getsockopt socket getsockname getpeername bind connect setsockopt send sendto recv recvfrom listen WSACloseEvent closesocket ioctlsocket WSAEnumNetworkEvents WSAGetLastError WSAWaitForMultipleEvents WSAEventSelect WSAStartup WSACleanup WSACreateEvent getaddrinfo freeaddrinfo WSAResetEvent WSASetEvent accept WSCEnumProtocols

wininet

InternetQueryOptionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_8b0dd93d15a05cc70f258a33b371e141_darkgate_elex_floxif_mafia

PE Signature issue

advapi32

kernel32

user32

ole32

oleaut32

gdi32

gdiplus

winmm

crypt32

shell32

shlwapi

secur32

usp10

ws2_32

wininet

generic