2026-07-21_0e9accf8f1e8545b78d71a4b7f515ac7_elex_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_0e9accf8f1e8545b78d71a4b7f515ac7_elex_floxif_mafia
Size 339KB
Sample260722-bgaeastvht
SHA256 b6d0aa74a6906c1bae2139736a0e0c0bc869a0587ed21873bcc86145087e4818
MD5 0e9accf8f1e8545b78d71a4b7f515ac7
SHA1 11ad5ef63889ddaf2943cc47b676350a788c1754
SHA512 0af856358945e87838d9ecb7d3fb28b287016e0f396c874c8104ea226e62bc68fb645ad38075c19dd8997c2d5f42b9c9c2808a3ee329a0c14e32d31d31ea321f
SSDEEP 6144:o3SQvqVQeKSJAs4qR4N/mH79HIpViNJnrua0RBV+UdvrEFp7hKvi65M:o3SQvqaSAsR4NOH79sViNJ0RBjvrEH7L
TLSH
T1E374BD213350C7F6C496103075B987AA59F9BC3B0B6A41C3E3883AAD5E7C7D35A7861E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-21_0e9accf8f1e8545b78d71a4b7f515ac7_elex_floxif_mafia

File Explorer

2026-07-21_0e9accf8f1e8545b78d71a4b7f515ac7_elex_floxif_mafia

.exe 339KB

2026-07-21_0e9accf8f1e8545b78d71a4b7f515ac7_elex_floxif_mafia

IMPHASH 416333ed07e4ed6742e90b5c6a8f2c8d
SHA256 b6d0aa74a6906c1bae2139736a0e0c0bc869a0587ed21873bcc86145087e4818
MD5 0e9accf8f1e8545b78d71a4b7f515ac7
SHA1 11ad5ef63889ddaf2943cc47b676350a788c1754
SHA512 0af856358945e87838d9ecb7d3fb28b287016e0f396c874c8104ea226e62bc68fb645ad38075c19dd8997c2d5f42b9c9c2808a3ee329a0c14e32d31d31ea321f
SSDEEP 6144:o3SQvqVQeKSJAs4qR4N/mH79HIpViNJnrua0RBV+UdvrEFp7hKvi65M:o3SQvqaSAsR4NOH79sViNJ0RBjvrEH7L
TLSH
T1E374BD213350C7F6C496103075B987AA59F9BC3B0B6A41C3E3883AAD5E7C7D35A7861E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

07:9d:0d:43:46:59:c2:02:3e:f8:1c:80:0e:4f:08:56:70:21:24:47:53:1f:4a:8f:bf:7f:2c:40:e4:57:66:2c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Chains

Jul 28, 2020

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

35:75:54:3c:c6:c0:3c:4b:8b:47:94:08:5e:25:d9:d3:98:aa:2d:43

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Chains

Jul 28, 2020

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Serial Number

0a:9f:96:aa:bf:b5:da:c0:f2:9f:56:5d:33:ff:1a:f6

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 27, 2020 - Apr 11, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Serial Number

07:bc:d7:f9:30:84:77:c3:84:6b:c9:54:78:fa:65:68

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 27, 2020 - Apr 11, 2022

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

84773

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\slave-jenkins\workspace\DFAppFoundation\drfonetoolkit\ModuleUpgrade\SharpUpgrade\Release\InstallAssistService.pdb

kernel32

MultiByteToWideChar WideCharToMultiByte GetModuleFileNameW Sleep WTSGetActiveConsoleSessionId OpenProcess GetCurrentThread GetCurrentProcess CloseHandle QueueUserWorkItem CreateEventW GetLastError SetEvent WaitForSingleObject CompareStringW GetProcessHeap SetEndOfFile CreateFileW CreateFileA WriteConsoleW SetStdHandle LoadLibraryW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapSize GetLocaleInfoW GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation FlushFileBuffers GetConsoleMode GetConsoleCP WriteFile SetFilePointer ReadFile InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapAlloc GetFileAttributesA CreateDirectoryA GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetCommandLineW HeapSetInformation RaiseException GetCPInfo RtlUnwind LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW HeapCreate ExitProcess SetEnvironmentVariableA

advapi32

GetTokenInformation ControlService QueryServiceStatus StartServiceW ChangeServiceConfig2W OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle CreateServiceW ReportEventW RegisterServiceCtrlHandlerW SetServiceStatus DeregisterEventSource StartServiceCtrlDispatcherW RegisterEventSourceW FreeSid AllocateAndInitializeSid OpenProcessToken OpenThreadToken EqualSid CreateProcessAsUserW SetTokenInformation DuplicateTokenEx

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

wtsapi32

WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

ws2_32

sendto bind socket closesocket setsockopt getsockname ntohs WSAStartup recvfrom htons htonl inet_addr

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_0e9accf8f1e8545b78d71a4b7f515ac7_elex_floxif_mafia

PE Signature issue

PE Signature issue

kernel32

advapi32

ole32

oleaut32

wtsapi32

userenv

ws2_32

generic