2026-08-03_86ca6e035c982e66497654406c487e0e_darkgate_elex_floxif_hijackloader_mafia_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_86ca6e035c982e66497654406c487e0e_darkgate_elex_floxif_hijackloader_mafia_smoke-loader
Size 2.2MB
Sample260804-m4kpbsdk51
SHA256 1d9fe79920f7ff28d73435b88b3b24f2667470916c9b254826df8fc26537b34f
MD5 86ca6e035c982e66497654406c487e0e
SHA1 6043168995f142f583ffaf154b8c63cdb7cce3a1
SHA512 72c3f2faf89c3843037df40461c18ec0889b1ea42eb02cb8336f9ac92af9d2c8b08cb2ade07e943ce019c35763653dde76bf8ed9991add0b7fa8a26b6a485430
SSDEEP 49152:PvUUyJaWiqzb1vFXdKXnO0K455/Fh4TxNNoTHsyudlJmUC:8JviohGO0K4j/Fh4TxNNhdQ
TLSH
T1BDB58E21A7428536E5E300F6D67D827DA538BA30131190D3F3C42DAD9AF9ED27936A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-03_86ca6e035c982e66497654406c487e0e_darkgate_elex_floxif_hijackloader_mafia_smoke-loader

File Explorer

2026-08-03_86ca6e035c982e66497654406c487e0e_darkgate_elex_floxif_hijackloader_mafia_smoke-loader

.exe 2.2MB

2026-08-03_86ca6e035c982e66497654406c487e0e_darkgate_elex_floxif_hijackloader_mafia_smoke-loader

IMPHASH 357060af10a7773e7655fd99c9996fc3
SHA256 1d9fe79920f7ff28d73435b88b3b24f2667470916c9b254826df8fc26537b34f
MD5 86ca6e035c982e66497654406c487e0e
SHA1 6043168995f142f583ffaf154b8c63cdb7cce3a1
SHA512 72c3f2faf89c3843037df40461c18ec0889b1ea42eb02cb8336f9ac92af9d2c8b08cb2ade07e943ce019c35763653dde76bf8ed9991add0b7fa8a26b6a485430
SSDEEP 49152:PvUUyJaWiqzb1vFXdKXnO0K455/Fh4TxNNoTHsyudlJmUC:8JviohGO0K4j/Fh4TxNNhdQ
TLSH
T1BDB58E21A7428536E5E300F6D67D827DA538BA30131190D3F3C42DAD9AF9ED27936A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

98:2e:eb:f4:0f:47:52:6e:de:a8:d7:fc:78:5b:e1:cf:ad:02:22:2e:2e:28:22:9f:b7:cf:d1:f0:2b:81:f1:c5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Sep 16, 2024

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

44:85:59:e8:d5:9f:e0:56:29:9e:6e:8f

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2023 - Oct 9, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1034386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\16-09-2024\WindowsBuilds\DC_NATIVE\9093392\desktopcentral\ONPREMISE\SA_SRC\native\agent\Release\dcinventory.pdb

setupapi

SetupDiGetDeviceInterfaceDetailW CM_Get_DevNode_Status SetupDiGetClassDescriptionW SetupDiBuildDriverInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiEnumDriverInfoW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDriverInfoList SetupDiGetDriverInfoDetailW SetupDiGetDeviceInstanceIdW

userenv

CreateEnvironmentBlock LoadUserProfileA DestroyEnvironmentBlock UnloadUserProfile ExpandEnvironmentStringsForUserW

crypt32

CertCreateCertificateContext CertAddCertificateContextToStore PFXImportCertStore PFXVerifyPassword CertDeleteCertificateFromStore CertNameToStrW CertGetNameStringW CertGetPublicKeyLength CertGetCertificateContextProperty CertNameToStrA CertVerifyTimeValidity CertOpenStore CertOpenSystemStoreW CryptStringToBinaryA CertFreeCertificateContext CertCloseStore CertEnumCertificatesInStore CryptFindOIDInfo CertGetNameStringA CertFindCertificateInStore

netapi32

NetGetJoinInformation DsRoleFreeMemory DsGetDcNameA NetWkstaUserGetInfo NetShareEnum NetLocalGroupGetMembers NetApiBufferFree DsRoleGetPrimaryDomainInformation

wsock32

WSAGetLastError WSACleanup WSAStartup

psapi

EnumProcessModules EnumProcesses GetModuleBaseNameW

wtsapi32

WTSQuerySessionInformationA WTSEnumerateSessionsA WTSQuerySessionInformationW WTSFreeMemory

iphlpapi

GetAdaptersInfo

winhttp

WinHttpSetCredentials WinHttpWriteData WinHttpQueryOption WinHttpQueryDataAvailable WinHttpSetStatusCallback WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetOption WinHttpSendRequest WinHttpAddRequestHeaders

dcagenthttp

AgentSendRequestEx

dclibxml2

xmlParseMemory xmlTextReaderGetAttribute xmlParseFile xmlDocGetRootElement xmlTextReaderValue xmlTextReaderDepth xmlTextReaderRead xmlFreeTextReader xmlStrcmp xmlNewTextReaderFilename xmlFree xmlNodeListGetString xmlCleanupParser xmlTextReaderAttributeCount xmlFreeDoc xmlTextReaderName

advapi32

RegisterEventSourceA ReportEventA DeregisterEventSource LookupPrivilegeNameA GetTokenInformation LookupAccountSidA LookupAccountNameA GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority LookupPrivilegeValueA CreateProcessAsUserW LogonUserA CreateProcessAsUserA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam RegEnumKeyA RegDeleteKeyA RegDeleteValueW RegDeleteValueA RegCreateKeyExA RegQueryInfoKeyA RegEnumKeyExA RegEnumValueA ControlService CryptAcquireContextA CryptGetUserKey CryptGenKey CryptReleaseContext CryptDestroyKey AllocateAndInitializeSid RegSetValueExA QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle ConvertSidToStringSidW RegOpenKeyA RevertToSelf ImpersonateLoggedOnUser RegEnumValueW RegOpenKeyExA RegQueryValueExA RegUnLoadKeyW RegSetValueExW RegCloseKey RegLoadKeyW AdjustTokenPrivileges RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW LookupPrivilegeValueW SetNamedSecurityInfoW RegDeleteKeyW RegQueryInfoKeyW RegQueryValueExW RegCreateKeyExW RegEnumKeyW OpenProcessToken GetLengthSid IsValidSecurityDescriptor IsValidSid GetNamedSecurityInfoW LookupAccountSidW GetExplicitEntriesFromAclW

winspool.drv

EnumPrintersW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc FindFirstFileW GetCommandLineW HeapSize HeapSetInformation DeleteTimerQueue GetLocaleInfoW CreateTimerQueue CreateTimerQueueTimer RtlUnwind PeekNamedPipe RaiseException GetDriveTypeA FindFirstFileExA ExitThread LCMapStringW CompareStringW GetProcessHeap SetUnhandledExceptionFilter IsDebuggerPresent SetHandleCount GetStartupInfoW HeapCreate GetConsoleCP CreateDirectoryA GetConsoleMode GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree FreeEnvironmentStringsW GetEnvironmentStringsW SetStdHandle GetUserDefaultLCID EnumSystemLocalesA IsValidLocale DeleteFileW SetEndOfFile FlushFileBuffers GetSystemTimeAsFileTime CopyFileW GetCPInfo DuplicateHandle FormatMessageA GetFileType GlobalFree GetStdHandle GlobalAlloc DisconnectNamedPipe lstrcmpW GetDriveTypeW VirtualQuery QueryPerformanceCounter GetModuleFileNameW GetTimeFormatA GetDateFormatA InitializeCriticalSectionAndSpinCount ExitProcess UnhandledExceptionFilter SetEnvironmentVariableA GetFileAttributesExA GetFullPathNameA SuspendThread ResumeThread TerminateThread GetVersion lstrcmpiA MoveFileExA LocalLock LocalUnlock WriteConsoleW DecodePointer EncodePointer GetStringTypeW InterlockedExchange InterlockedCompareExchange InterlockedIncrement GetSystemInfo SetPriorityClass GetPriorityClass GetLocaleInfoA FindResourceExW FindResourceW LoadResource SizeofResource MultiByteToWideChar GetLastError LockResource FreeLibrary WaitForSingleObject LoadLibraryW CreateProcessA TerminateProcess ReadFile GetProcAddress CreatePipe CloseHandle GetWindowsDirectoryW FileTimeToSystemTime CreateFileW GetBinaryTypeW GetFileTime FileTimeToLocalFileTime WideCharToMultiByte FormatMessageW LocalFree lstrlenA GetFileSizeEx CreateMutexW MapViewOfFile UnmapViewOfFile GetCurrentProcess SetEvent GetModuleHandleW GetTickCount OpenProcess GetFileAttributesA Sleep lstrlenW GetLocalTime CreateFileMappingW CreateEventW WaitForMultipleObjects OpenFileMappingW ReleaseMutex CreateThread SystemTimeToFileTime InterlockedDecrement CreateDirectoryW WriteFile LocalAlloc GetSystemTime CreateProcessW SetHandleInformation GetFirmwareEnvironmentVariableA GetExitCodeProcess GetCurrentProcessId GetNativeSystemInfo IsProcessorFeaturePresent InitializeCriticalSection LeaveCriticalSection EnterCriticalSection lstrcpyW GetCurrentThreadId GetModuleHandleA LoadLibraryA Process32Next Process32First CreateToolhelp32Snapshot GetVersionExA GetFileSize CreateFileA RemoveDirectoryA FindClose DeleteFileA FindNextFileA FindFirstFileA SetDllDirectoryA GetComputerNameExW CreateMutexA SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetFileInformationByHandle GetModuleFileNameA ConnectNamedPipe CreateNamedPipeA SetCurrentDirectoryA GetCurrentDirectoryA SetFilePointer SetCurrentDirectoryW ProcessIdToSessionId SetLastError GetCurrentDirectoryW GetSystemDirectoryA CopyFileA GetEnvironmentVariableA

user32

wsprintfA GetSystemMetrics wsprintfW MessageBoxA

shell32

SHCreateDirectoryExA SHCreateDirectoryExW

ole32

CoCreateInstance CoSetProxyBlanket CoUninitialize CLSIDFromString CoInitializeEx CoInitializeSecurity OleRun CoInitialize

oleaut32

SysAllocStringByteLen VariantInit VariantClear SafeArrayGetUBound SafeArrayAccessData SafeArrayGetLBound GetErrorInfo VariantChangeType SysFreeString SysAllocString SysStringLen SafeArrayGetElement

odbc32

ord2 ord20 ord31 ord41 ord9 ord39 ord1 ord12 ord19 ord3 ord49 ord48 ord72 ord26 ord13 ord4 ord8 ord18 ord11 ord43 ord36 ord29 ord16

shlwapi

StrTrimA PathFindExtensionA PathIsDirectoryW StrStrIA PathFileExistsW StrStrIW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_86ca6e035c982e66497654406c487e0e_darkgate_elex_floxif_hijackloader_mafia_smoke-loader

PE Signature issue

setupapi

userenv

crypt32

netapi32

wsock32

psapi

wtsapi32

iphlpapi

winhttp

dcagenthttp

dclibxml2

advapi32

winspool.drv

version

kernel32

user32

shell32

ole32

oleaut32

odbc32

shlwapi

generic