2026-07-19_5edddc199bd6cec1b30515cdebd74ac5_bkransomware_darkgate_elex_floxif_hijackloader_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_5edddc199bd6cec1b30515cdebd74ac5_bkransomware_darkgate_elex_floxif_hijackloader_maze
Size 2.0MB
Sample260719-2ed8kses2j
SHA256 2f5d2d3258a794bed61d444e8b4fc66edfd1bf751d299597ef0095eee635ac39
MD5 5edddc199bd6cec1b30515cdebd74ac5
SHA1 0c9f14640f41699336405bfcb9fe63683f61e949
SHA512 d2e24bbb85a2485a497056ba5c1e9cff8a9ef0d1bed97ef8a2ae89bf821773cce374fb1ec018a370f3abe4a0c0a8e98fd14f488d68642523a8b38aa970e371a9
SSDEEP 49152:Dk0eo5nJIioHlq+c6gqwR92IISNbecXxHDoVf3M7sSZOZVVNa6Z3:Dk25nHoHlq+c6ZQ92IBRecXxHUVf3M7G
TLSH
T161A59E3235D09066D97317339A6F732CB5BDBE784E35414B22D47EAD2DB0C829A28763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-19_5edddc199bd6cec1b30515cdebd74ac5_bkransomware_darkgate_elex_floxif_hijackloader_maze

File Explorer

2026-07-19_5edddc199bd6cec1b30515cdebd74ac5_bkransomware_darkgate_elex_floxif_hijackloader_maze

.exe 2.0MB

2026-07-19_5edddc199bd6cec1b30515cdebd74ac5_bkransomware_darkgate_elex_floxif_hijackloader_maze

IMPHASH c5b6a202b57a8452be9c90f3cc9d8d2b
SHA256 2f5d2d3258a794bed61d444e8b4fc66edfd1bf751d299597ef0095eee635ac39
MD5 5edddc199bd6cec1b30515cdebd74ac5
SHA1 0c9f14640f41699336405bfcb9fe63683f61e949
SHA512 d2e24bbb85a2485a497056ba5c1e9cff8a9ef0d1bed97ef8a2ae89bf821773cce374fb1ec018a370f3abe4a0c0a8e98fd14f488d68642523a8b38aa970e371a9
SSDEEP 49152:Dk0eo5nJIioHlq+c6gqwR92IISNbecXxHDoVf3M7sSZOZVVNa6Z3:Dk25nHoHlq+c6ZQ92IBRecXxHUVf3M7G
TLSH
T161A59E3235D09066D97317339A6F732CB5BDBE784E35414B22D47EAD2DB0C829A28763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ca:4f:c9:ed:91:55:24:21:1c:02:37:c7:2b:a2:0f:82:af:34:11:b1:ac:44:79:30:68:1a:ed:58:a4:fc:21:54

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130b53656f6e676e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Nov 6, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:7d:2b:6a:b3:ae:1c:4d:9e:62:4e:c8:66:41:c0:11

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 26, 2023 - Sep 29, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1219919

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\HOffice130\install\Installer\Setup\Release_KOR\Setup_KOR.pdb

kernel32

OutputDebugStringW GetTimeZoneInformation GetStringTypeW SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP GetCPInfo GetOEMCP GetACP IsValidCodePage TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime SizeofResource VirtualQuery VirtualAlloc GetSystemInfo HeapQueryInformation GetFileType SetStdHandle ExitThread CreateThread RtlUnwind IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleExW ExitProcess GetCommandLineW WriteConsoleW QueryPerformanceCounter SetEnvironmentVariableA FindResourceExW VirtualProtect GetProfileIntW GetTickCount GetTempPathW GetTempFileNameW SearchPathW SetErrorMode GetWindowsDirectoryW GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime lstrcmpiW DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW FlushFileBuffers FindClose GetFileSize CreateFileW VerifyVersionInfoW VerSetConditionMask DeleteFileW GetCurrentDirectoryW LCMapStringW GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW CompareStringW FileTimeToSystemTime GlobalGetAtomNameW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GlobalFlags ResumeThread SetThreadPriority CompareStringA lstrcmpA GetVersionExW GetCurrentThread GlobalFindAtomW GlobalAddAtomW LoadLibraryA lstrcmpW GlobalDeleteAtom LoadLibraryExW FreeLibrary GetCurrentThreadId EncodePointer CopyFileW GlobalSize GlobalAlloc GetCurrentProcessId MulDiv LoadLibraryW GlobalFree GlobalUnlock GlobalLock GetModuleHandleW FreeResource SetLastError OutputDebugStringA DeleteCriticalSection DecodePointer EnterCriticalSection HeapSize RaiseException LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapFree HeapAlloc HeapReAlloc GetLocalTime GetFileAttributesW GetSystemDirectoryW CloseHandle GetUserDefaultLCID GetModuleHandleA GetProcAddress GetCurrentProcess GetExitCodeProcess GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetModuleFileNameW Process32NextW Process32FirstW CreateToolhelp32Snapshot Sleep WaitForSingleObject WinExec FindFirstFileW SetThreadUILanguage lstrcpyW LocalFree FormatMessageW GetLastError MultiByteToWideChar WideCharToMultiByte FindResourceW LoadResource LockResource

user32

CharUpperBuffW SetCursorPos DrawFrameControl DrawEdge SetRect UnionRect GetKeyNameTextW InvertRect HideCaret EnableScrollBar GetIconInfo DrawIconEx DrawFocusRect GetNextDlgGroupItem GetMenuDefaultItem SetClassLongW LockWindowUpdate RegisterClipboardFormatW EnumChildWindows CopyAcceleratorTableW DestroyAcceleratorTable CreateAcceleratorTableW MapVirtualKeyW GetKeyboardState GetKeyboardLayout ToUnicodeEx WaitMessage PostThreadMessageW ModifyMenuW IsMenu NotifyWinEvent WindowFromPoint SetWindowRgn GetSystemMenu SetCapture GetAsyncKeyState CharUpperW TrackMouseEvent IsRectEmpty DrawStateW EmptyClipboard SetClipboardData CloseClipboard OpenClipboard EnumDisplayMonitors SetLayeredWindowAttributes MonitorFromPoint SetParent ReuseDDElParam UnpackDDElParam LoadImageW DestroyIcon SetRectEmpty InsertMenuItemW CreatePopupMenu LoadAcceleratorsW ReleaseCapture BringWindowToTop InvalidateRect KillTimer SetTimer DeleteMenu CopyImage GetMenuItemInfoW DestroyMenu LoadCursorW GetSysColorBrush IntersectRect InflateRect RealChildWindowFromPoint SetCursor ShowOwnedPopups GetCursorPos GetMessageW OffsetRect MessageBeep IsZoomed PostQuitMessage SendDlgItemMessageA LoadBitmapW UpdateLayeredWindow GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW SetWindowTextW SendDlgItemMessageW CheckDlgButton MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetTopWindow GetClassNameW GetClassLongW SetWindowLongW PtInRect EqualRect CopyRect MapWindowPoints AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow ValidateRect SetForegroundWindow GetForegroundWindow UpdateWindow TrackPopupMenu SetMenu GetMenu GetCapture GetKeyState GetFocus SetFocus GetDlgCtrlID IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos IsChild CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW PostMessageW GetMessageTime GetMessagePos RegisterWindowMessageW GetWindowRect LoadMenuW RemoveMenu AppendMenuW InsertMenuW SetMenuDefaultItem CopyIcon FrameRect IsClipboardFormatAvailable DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel IsCharLowerW MapVirtualKeyExW SubtractRect GetUpdateRect GetComboBoxInfo GetDoubleClickTime CreateMenu GetWindowRgn MapDialogRect SetMenuItemInfoW DestroyCursor GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringW GetLastActivePopup GetWindowThreadProcessId FillRect GetSysColor ScreenToClient ClientToScreen EndPaint BeginPaint ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetParent GetDesktopWindow GetWindowLongW SetActiveWindow IsWindowEnabled GetActiveWindow GetNextDlgTabItem GetDlgItem EndDialog CreateDialogIndirectParamW DestroyWindow IsWindow UnregisterClassW ExitWindowsEx DispatchMessageW TranslateMessage PeekMessageW MessageBoxW DrawIcon GetClientRect GetSystemMetrics IsIconic SendMessageW SystemParametersInfoW LoadIconW EnableWindow TranslateAcceleratorW

gdi32

DPtoLP CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetDIBits RealizePalette SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateRoundRectRgn GetRgnBox OffsetRgn GetTextColor CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries GetBkColor CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline Rectangle SetRectRgn ExtFloodFill SetPaletteEntries GetViewportOrgEx LPtoDP GetWindowOrgEx FillRgn FrameRgn GetBoundsRect PtInRegion GetTextFaceW SetPixelV SetROP2 SetPolyFillMode PatBlt CreateRectRgnIndirect CombineRgn GetTextMetricsW GetTextExtentPoint32W CreateDCW CopyMetaFileW SetTextColor ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW MoveToEx RoundRect CreateSolidBrush GetLayout SetLayout SetMapMode SetBkMode SetBkColor SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetDeviceCaps GetClipBox ExcludeClipRect Escape DeleteObject CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateBitmap BitBlt DeleteDC EnumFontFamiliesExW CreateCompatibleDC CreateFontIndirectW GetObjectW GetStockObject SetTextAlign

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegCreateKeyExW CheckTokenMembership CreateWellKnownSid GetTokenInformation RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCreateKeyW RegOpenKeyExW RegQueryValueExW RegOpenKeyW

shell32

SHGetDesktopFolder ShellExecuteExW ord680 DragQueryFileW DragFinish SHAppBarMessage SHGetMalloc ShellExecuteW SHGetFileInfoW SHGetFolderPathW SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW

shlwapi

PathRemoveFileSpecW PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW PathFileExistsW StrFormatKBSizeW

uxtheme

GetWindowTheme GetThemeSysColor GetCurrentThemeName DrawThemeText DrawThemeParentBackground DrawThemeBackground IsThemeBackgroundPartiallyTransparent OpenThemeData IsAppThemed GetThemePartSize CloseThemeData GetThemeColor

ole32

ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoUninitialize CoCreateGuid CoCreateInstance CoInitialize CoDisconnectObject CreateStreamOnHGlobal DoDragDrop OleGetClipboard OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoInitializeEx

oleaut32

SysFreeString VarBstrFromDate VariantCopy VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen LoadTypeLi SysAllocString VariantChangeType VariantClear VariantInit SysAllocStringLen

gdiplus

GdipBitmapLockBits GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdiplusShutdown GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette

msi

ord92 ord32 ord159 ord160 ord118 ord7 ord8

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_5edddc199bd6cec1b30515cdebd74ac5_bkransomware_darkgate_elex_floxif_hijackloader_maze

PE Signature issue

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

msi

oleacc

imm32

winmm

generic