2026-07-30_9a6a5fbf7640c07e68217a24253403e1_darkgate_elex_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_9a6a5fbf7640c07e68217a24253403e1_darkgate_elex_floxif_mafia
Size 2.5MB
Sample260730-vtpvasdn2w
SHA256 7a71249d6c657fb81b6d141dfda43b8a6c13af46ac1da7378619cbb4be811056
MD5 9a6a5fbf7640c07e68217a24253403e1
SHA1 d250ba8a9b2b2e7dc861a6f72f70871f108f7158
SHA512 a2c0bebe76d3386c58e0a8a1c738026dd9f62b9a0102e634d3eb97a867f0bdaa1818aa909435e580306f2b5f66486f32b63a8a3ae902c3fb090e103bec0fff43
SSDEEP 49152:tuIIZWofs2hPd2l177BTK2VbDsar1YDjI:tj+fs2hPIl1/L
TLSH
T1CCC59E00FB46D2F2DD47627448FBA31E462996F843141AD7E3580E0F5EAAAD37D3A18D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-30_9a6a5fbf7640c07e68217a24253403e1_darkgate_elex_floxif_mafia

File Explorer

2026-07-30_9a6a5fbf7640c07e68217a24253403e1_darkgate_elex_floxif_mafia

.exe 2.5MB

2026-07-30_9a6a5fbf7640c07e68217a24253403e1_darkgate_elex_floxif_mafia

IMPHASH 97f5c5cdc5e80758b7adff3a733244ad
SHA256 7a71249d6c657fb81b6d141dfda43b8a6c13af46ac1da7378619cbb4be811056
MD5 9a6a5fbf7640c07e68217a24253403e1
SHA1 d250ba8a9b2b2e7dc861a6f72f70871f108f7158
SHA512 a2c0bebe76d3386c58e0a8a1c738026dd9f62b9a0102e634d3eb97a867f0bdaa1818aa909435e580306f2b5f66486f32b63a8a3ae902c3fb090e103bec0fff43
SSDEEP 49152:tuIIZWofs2hPd2l177BTK2VbDsar1YDjI:tj+fs2hPIl1/L
TLSH
T1CCC59E00FB46D2F2DD47627448FBA31E462996F843141AD7E3580E0F5EAAAD37D3A18D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

69:75:9e:07:29:89:73:1d:8e:db:cf:ce:35:72:c1:80:e5:c9:00:98

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Oct 10, 2012

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 14, 2011 - Nov 13, 2014

Minor OS version

Major OS version

Entry point

1349317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\p\agents\hpam2.eem\recipes\201152726\base\branches\inputtools_win_release_branch\googleclient\ime\goopy\scons-out\opt\obj\components\win_frontend\ipc_console.pdb

advapi32

RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetLengthSid GetSecurityInfo CopySid GetUserNameW GetTokenInformation OpenProcessToken SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenCurrentUser RegQueryValueExW RegNotifyChangeKeyValue GetSidSubAuthority GetSidSubAuthorityCount SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl IsValidSid

kernel32

TerminateProcess GetModuleFileNameA IsDebuggerPresent GetCurrentThreadId OutputDebugStringA ReleaseMutex CloseHandle DebugBreak GetTempPathA GlobalAlloc LocalFree ResetEvent SetEvent WaitForMultipleObjects CreateThread Sleep GetVersionExW InterlockedCompareExchange GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime QueryPerformanceCounter FindFirstFileW FindNextFileW GetFullPathNameW DeleteFileW RemoveDirectoryW GetSystemTime LockResource FindResourceExW FindClose MulDiv SetProcessWorkingSetSize CreateTimerQueueTimer DeleteTimerQueueTimer CreateFileW GetTickCount WriteFile ExitThread LoadLibraryW GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile HeapAlloc HeapFree GetProcessHeap ConnectNamedPipe CreateNamedPipeW CancelIo ReadFile GetOverlappedResult FlushInstructionCache SetLastError InterlockedExchange EncodePointer DecodePointer HeapDestroy HeapReAlloc HeapSize InterlockedPushEntrySList IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedPopEntrySList UnhandledExceptionFilter SetUnhandledExceptionFilter WideCharToMultiByte HeapSetInformation GetStartupInfoW ExitProcess VirtualProtect VirtualQuery RtlUnwind GetCPInfo LCMapStringW GetStdHandle HeapCreate GetLocaleInfoW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode FlushFileBuffers GetTimeZoneInformation SetFilePointer GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleW SetStdHandle CreateFileA CompareStringW SetEnvironmentVariableA SetEndOfFile GetThreadLocale CopyFileW SetFileAttributesW GetTempPathW GetFileSizeEx CreateDirectoryW GetFileAttributesW GetCurrentDirectoryW CreateMutexW WaitForSingleObject GetCurrentProcess CreateProcessW GlobalFree GlobalLock GlobalUnlock SetThreadPriority ResumeThread OpenThread FormatMessageA GetModuleHandleA AllocConsole LoadLibraryA GetLongPathNameW GetTempFileNameW MoveFileW GetFileAttributesExW GetDiskFreeSpaceExW GetDriveTypeW GetUserDefaultUILanguage VerSetConditionMask VerifyVersionInfoW FindFirstFileExW GetFileInformationByHandle PeekNamedPipe GetDriveTypeA FindFirstFileExA GetFullPathNameA GetCommandLineW InitializeCriticalSection CreateEventW GetCurrentProcessId ProcessIdToSessionId InitializeCriticalSectionAndSpinCount LoadLibraryExW FindResourceW LoadResource GetFileSize SizeofResource RaiseException lstrcmpiW lstrlenW FreeLibrary GetModuleFileNameW GetProcAddress GetModuleHandleW GetLastError InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection DeleteCriticalSection MultiByteToWideChar

user32

SetWindowPos LoadCursorW DestroyMenu CreatePopupMenu TrackPopupMenu TrackPopupMenuEx GetShellWindow GetDC ReleaseDC AppendMenuW SetMenuItemBitmaps SendMessageW UnregisterClassA MoveWindow GetWindowRect BeginPaint EndPaint InvalidateRect InvalidateRgn ShowWindow IsWindowVisible CharNextW IsWindowEnabled SetCapture SetWindowRgn GetClassInfoExW SetRect TrackMouseEvent GetKeyState ReleaseCapture UpdateLayeredWindow OffsetRect SetCursor IntersectRect MessageBoxA wvsprintfW wsprintfW MessageBoxW IsWindow DispatchMessageW DefWindowProcW CreateWindowExW SetWindowLongW PeekMessageW GetWindowLongW RegisterClassExW TranslateMessage KillTimer PostMessageW PostQuitMessage GetMessageW SetTimer DestroyWindow GetMonitorInfoW SetWindowTextW GetCursorPos EndDialog GetDlgItem SetCursorPos GetForegroundWindow SetFocus DialogBoxParamW MonitorFromPoint ScreenToClient ClientToScreen

ole32

CoInitializeEx CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize CoUninitialize CoCreateGuid CreateStreamOnHGlobal

oleaut32

SysFreeString SysStringLen SysAllocString VarUI4FromStr

gdi32

EnumEnhMetaFile CloseEnhMetaFile CreateEnhMetaFileW GetCurrentObject GetFontUnicodeRanges GetTextMetricsW GetOutlineTextMetricsW GetObjectA AddFontMemResourceEx DeleteEnhMetaFile CreateFontIndirectW CreateRectRgn BitBlt CreateCompatibleDC DeleteDC CombineRgn ExtCreateRegion GetDIBits CreateDCW GetObjectW DeleteObject RemoveFontMemResourceEx SelectObject GetDeviceCaps CreateDIBSection

gdiplus

GdipCreateFromHDC GdipGraphicsClear GdiplusStartup GdipCloneImage GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncodersSize GdipAlloc GdipCreateBitmapFromScan0 GdipFree GdipRestoreGraphics GdiplusShutdown GdipBitmapGetPixel GdipGetImagePixelFormat GdipDrawImageRectRectI GdipPrivateAddFontFile GdipDrawImageI GdipSetClipGraphics GdipCloneFontFamily GdipCreateRegion GdipDeleteRegion GdipSetEmpty GdipCombineRegionRect GdipDeleteGraphics GdipGetImageGraphicsContext GdipSetImageAttributesRemapTable GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipImageRotateFlip GdipGetImageHeight GdipGetImageWidth GdipDeleteFont GdipCreateBitmapFromStream GdipGetFontCollectionFamilyCount GdipGetFontCollectionFamilyList GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawDriverString GdipFillRectangleI GdipCreateFontFamilyFromName GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipCreateTextureIAI GdipSetTextureWrapMode GdipCreatePen1 GdipDeletePen GdipGetPenWidth GdipSetCompositingQuality GdipSetTextRenderingHint GdipSetSmoothingMode GdipResetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipRotateWorldTransform GdipDrawLine GdipFillRectangle GdipDrawImageRectRect GdipSetClipRect GdipSetClipRegion GdipResetClip GdipSaveGraphics GdipCreateTextureIA GdipGetFamilyName GdipSaveImageToStream

winmm

timeGetTime

crypt32

CryptFindOIDInfo

shell32

SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW SHFileOperationW SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW PathCombineW PathFileExistsW StrDupW PathFindExtensionW PathRemoveFileSpecW PathRemoveBackslashW PathIsDirectoryW PathIsRelativeW

secur32

CompleteAuthToken FreeCredentialsHandle AcquireCredentialsHandleA InitializeSecurityContextA DeleteSecurityContext QueryCredentialsAttributesW FreeContextBuffer QueryContextAttributesW DecryptMessage EncryptMessage ApplyControlToken AcquireCredentialsHandleW

usp10

ScriptItemize ScriptBreak ScriptShape ScriptStringFree ScriptStringOut ScriptStringAnalyse ScriptCPtoX ScriptLayout ScriptPlace ScriptFreeCache

ws2_32

getsockopt socket getsockname getpeername bind connect setsockopt send sendto recv recvfrom listen WSACloseEvent closesocket ioctlsocket WSAEnumNetworkEvents WSAGetLastError WSAWaitForMultipleEvents WSAEventSelect WSAStartup WSACleanup WSACreateEvent getaddrinfo freeaddrinfo WSAResetEvent WSASetEvent accept WSCEnumProtocols

wininet

InternetQueryOptionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_9a6a5fbf7640c07e68217a24253403e1_darkgate_elex_floxif_mafia

PE Signature issue

advapi32

kernel32

user32

ole32

oleaut32

gdi32

gdiplus

winmm

crypt32

shell32

shlwapi

secur32

usp10

ws2_32

wininet

generic