2026-07-20_2ff6e6c5e8f6c6f7c24f1de7ba67919e_darkgate_elex_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_2ff6e6c5e8f6c6f7c24f1de7ba67919e_darkgate_elex_maze
Size 256KB
Sample260720-wketeaav3l
SHA256 aed271d40f83101381432b8755a45a3a9adfd13f70e385ebc77cf4c79181d560
MD5 2ff6e6c5e8f6c6f7c24f1de7ba67919e
SHA1 8885d101669761d3862b9bd5d63c0de8693d234e
SHA512 69d7430aee865fe07ca23628fe962a841666d2e5ad3cdc6cef4c1b7e14b29a9fcd7332a8f7dff145b216a3688b65df52801269c32fd85e7a18112f1b4a9100d8
SSDEEP 6144:29u0rfEmToCMgJA1AE0MHDzg2sRdiOItVGiu2U6tt0:SRrMm1M4A1AE0MH9sn
TLSH
T13E448E20BAC5D173DEAB013111F5EB3D54BA7A215B6189C7B388072A19317D1BB33F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_2ff6e6c5e8f6c6f7c24f1de7ba67919e_darkgate_elex_maze

File Explorer

2026-07-20_2ff6e6c5e8f6c6f7c24f1de7ba67919e_darkgate_elex_maze

.exe 256KB

2026-07-20_2ff6e6c5e8f6c6f7c24f1de7ba67919e_darkgate_elex_maze

IMPHASH 617a7ae13bb745c75afd4645e9dd037c
SHA256 aed271d40f83101381432b8755a45a3a9adfd13f70e385ebc77cf4c79181d560
MD5 2ff6e6c5e8f6c6f7c24f1de7ba67919e
SHA1 8885d101669761d3862b9bd5d63c0de8693d234e
SHA512 69d7430aee865fe07ca23628fe962a841666d2e5ad3cdc6cef4c1b7e14b29a9fcd7332a8f7dff145b216a3688b65df52801269c32fd85e7a18112f1b4a9100d8
SSDEEP 6144:29u0rfEmToCMgJA1AE0MHDzg2sRdiOItVGiu2U6tt0:SRrMm1M4A1AE0MH9sn
TLSH
T13E448E20BAC5D173DEAB013111F5EB3D54BA7A215B6189C7B388072A19317D1BB33F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7b:dc:ae:8d:71:06:04:76:cb:f2:45:62:a9:18:65:95:11:e8:60:04:1e:32:33:3e:df:2e:45:44:05:ae:f9:3a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Mar 18, 2021

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

4e:dc:d5:7e:cd:94:6b:a6:96:86:76:d3:7e:72:e9:0a:53:51:0f:1d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

Chains

Mar 18, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

Serial Number

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

Serial Number

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9e

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

Major OS version

Entry point

68991

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeLibrary GetPrivateProfileStringW LoadLibraryW GetModuleFileNameW GetLastError GetProcAddress GetModuleHandleW GetFileAttributesW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetVersionExW GetFileSizeEx CloseHandle SetFilePointer SetEndOfFile WriteFile ReadFile DeleteFileW CreateFileW GetFileAttributesExW WaitForSingleObject GetCurrentProcessId LocalFree CreateMutexW Sleep ReleaseMutex CreateDirectoryW GetFileSize HeapAlloc HeapFree GetProcessHeap GetCurrentThreadId FormatMessageW GetCurrentProcess WriteConsoleW SetStdHandle EncodePointer DecodePointer GetCommandLineW IsDebuggerPresent IsProcessorFeaturePresent GetSystemTimeAsFileTime IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError MultiByteToWideChar ExitProcess GetModuleHandleExW WideCharToMultiByte HeapSize RaiseException GetStdHandle GetFileType GetStartupInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStringTypeW LCMapStringW RtlUnwind LoadLibraryExW HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx OutputDebugStringW FlushFileBuffers

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_2ff6e6c5e8f6c6f7c24f1de7ba67919e_darkgate_elex_maze

PE Signature issue

PE Signature issue

kernel32

generic