2026-08-09_e34fddb954840108263324b7b286e908_darkgate_elex_floxif_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_e34fddb954840108263324b7b286e908_darkgate_elex_floxif_maze
Size 1.5MB
Sample260809-ffk7ma1alc
SHA256 f58bedfa8270b6f7bdf7231d585654f312b201dc23ad95f5d3be0a0b9e15b830
MD5 e34fddb954840108263324b7b286e908
SHA1 8b8af1af31ca9ea75d25a70512b5103ffdedd258
SHA512 e9dc86f42211349ac5791537023de8eed3b3192497cfa558dd7219a9b6773f606205316ea3c5fd0ceb64dc8e731860bdcfbffac026d47e9c87ce04f5e71ed65a
SSDEEP 49152:Xh0GFlFtT8oFVC9qaVBxoXWwMvZ4xBauI:XdDO9qMRkkp
TLSH
T1A175F123B59591BCE5F222F1ADB97A1459FDBE344132CA4A63C40A4C1EB4990B63F373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_e34fddb954840108263324b7b286e908_darkgate_elex_floxif_maze

File Explorer

2026-08-09_e34fddb954840108263324b7b286e908_darkgate_elex_floxif_maze

.exe 1.5MB

2026-08-09_e34fddb954840108263324b7b286e908_darkgate_elex_floxif_maze

IMPHASH f8af2cc01fdb8b46a419f274f276eb04
SHA256 f58bedfa8270b6f7bdf7231d585654f312b201dc23ad95f5d3be0a0b9e15b830
MD5 e34fddb954840108263324b7b286e908
SHA1 8b8af1af31ca9ea75d25a70512b5103ffdedd258
SHA512 e9dc86f42211349ac5791537023de8eed3b3192497cfa558dd7219a9b6773f606205316ea3c5fd0ceb64dc8e731860bdcfbffac026d47e9c87ce04f5e71ed65a
SSDEEP 49152:Xh0GFlFtT8oFVC9qaVBxoXWwMvZ4xBauI:XdDO9qMRkkp
TLSH
T1A175F123B59591BCE5F222F1ADB97A1459FDBE344132CA4A63C40A4C1EB4990B63F373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

31:1a:f4:b2:29:a0:68:36:02:b8:60:02:de:c8:3d:0d:55:a4:cb:c7:1e:bd:bb:6d:89:37:05:d8:9e:31:f6:11

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Apr 14, 2016

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

e8:69:64:33:64:df:b5:d4:93:16:7c:0e:9f:c6:46:4b:3c:b6:c0:56

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Apr 14, 2016

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 14, 2015 - Dec 14, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 16, 2015 - Dec 16, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

Major OS version

Entry point

366725

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ChromeRecoveryProbe_unsigned.pdb

advapi32

RegDeleteValueW IsTextUnicode SystemFunction036 DeregisterEventSource ReportEventW RegisterEventSourceW ImpersonateLoggedOnUser RegOpenCurrentUser TraceEvent UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle DuplicateTokenEx ImpersonateSelf RevertToSelf ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueW CreateProcessAsUserW FreeSid CheckTokenMembership AllocateAndInitializeSid RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl MakeSelfRelativeSD GetSecurityDescriptorLength GetLengthSid CopySid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired AddAce InitializeAcl SetNamedSecurityInfoW RegOpenKeyExW SetSecurityDescriptorDacl GetAclInformation InitializeSecurityDescriptor MakeAbsoluteSD OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetAce EqualSid ConvertStringSidToSidW OpenThreadToken RegDeleteKeyW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW GetSidIdentifierAuthority GetSidSubAuthorityCount

kernel32

GetCurrentThreadId GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount CreateSemaphoreW FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo RtlUnwind LCMapStringW GetStringTypeW FlushFileBuffers GetConsoleCP GetCurrentThread SetStdHandle WriteConsoleW GetLocalTime OutputDebugStringA GetPrivateProfileIntW GetPrivateProfileStringW ReleaseMutex lstrcmpW lstrlenW SetFilePointer LocalFree GetFileAttributesW WaitForMultipleObjects LoadLibraryW DuplicateHandle GetEnvironmentVariableW FormatMessageW VirtualQuery GetTempPathW GetFileAttributesExW CopyFileW MoveFileExW GetFileTime ReadFile GetFileSize CompareFileTime FileTimeToSystemTime GetStringTypeExW SystemTimeToFileTime ResetEvent LocalAlloc OpenProcess VerifyVersionInfoW VerSetConditionMask DeviceIoControl GlobalMemoryStatusEx SetPriorityClass CreateProcessW ProcessIdToSessionId GetSystemPowerStatus CreatePipe SetHandleInformation CreateMutexW InitializeCriticalSection TryEnterCriticalSection SetEvent lstrcpynW GetLongPathNameW WaitForMultipleObjectsEx WaitForSingleObjectEx CreateToolhelp32Snapshot Process32FirstW Process32NextW ReadProcessMemory GetThreadLocale GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetLogicalDriveStringsW QueryDosDeviceW GetPrivateProfileSectionNamesW CreateThread GetComputerNameExW GetSystemDefaultLangID GetUserDefaultLangID GetStringTypeExA lstrcmpA CreateFileMappingW MapViewOfFileEx UnmapViewOfFile WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW ExitProcess IsProcessorFeaturePresent EncodePointer LeaveCriticalSection EnterCriticalSection OutputDebugStringW IsDebuggerPresent InitializeSListHead FlushInstructionCache WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState GetProcessId VirtualQueryEx RtlCaptureContext ReleaseSemaphore UnregisterWaitEx QueryPerformanceFrequency QueueUserWorkItem GetFileSizeEx VirtualProtect VirtualAlloc GetSystemInfo InterlockedPopEntrySList InterlockedPushEntrySList VirtualFree GetProcAddress GetModuleHandleW SetLastError GetCommandLineW DeleteFileW CloseHandle RemoveDirectoryW CreateFileW GetExitCodeProcess WriteFile WaitForSingleObject CreateDirectoryW SetFilePointerEx GetTempFileNameW DeleteCriticalSection FindNextFileW lstrcmpiW DecodePointer LockResource FindClose HeapSize GetLastError RaiseException HeapDestroy SizeofResource InitializeCriticalSectionAndSpinCount GetProcessHeap HeapFree HeapAlloc LoadResource FindResourceW FindResourceExW FindFirstFileW HeapReAlloc GetConsoleMode

ole32

CoCreateGuid StringFromGUID2 IIDFromString CoTaskMemFree CoGetObject CoGetCallContext CoRevertToSelf CoImpersonateClient ReadClassStm CoSetProxyBlanket CoRegisterPSClsid CoTaskMemRealloc OleSaveToStream CoCreateInstance CoTaskMemAlloc CoInitializeEx CoUninitialize WriteClassStm

oleaut32

SafeArrayGetLBound SafeArrayCopy SafeArrayGetVartype VariantInit VariantClear SysAllocString LoadTypeLi SafeArrayGetUBound SysAllocStringLen SysStringLen LoadRegTypeLi SysStringByteLen SysAllocStringByteLen SafeArrayDestroy SafeArrayRedim SafeArrayCreate VariantChangeType VarUI4FromStr SysReAllocStringLen SafeArrayUnlock SafeArrayLock VarBstrCmp SysFreeString

shell32

SHGetDesktopFolder SHGetFolderLocation ShellExecuteExW CommandLineToArgvW ord680 SHGetFolderPathW

user32

CharLowerBuffW CharUpperW CharLowerW DestroyWindow AllowSetForegroundWindow DispatchMessageW TranslateMessage PostQuitMessage GetMessageW PeekMessageW SetForegroundWindow GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect MapWindowPoints SetWindowPos CreateWindowExW MessageBoxW wvsprintfW UnregisterClassW wsprintfW CharNextA CharLowerBuffA IsWindow LoadStringW CharUpperBuffW CharNextW OpenClipboard EnumWindows IsWindowVisible GetWindowThreadProcessId CloseClipboard SetClipboardData EmptyClipboard KillTimer SetTimer RegisterClassExW GetClassInfoExW LoadCursorW DefWindowProcW SetWindowLongW CallWindowProcW

netapi32

NetWkstaGetInfo NetWkstaUserGetInfo NetGetJoinInformation NetApiBufferFree

shlwapi

PathAddExtensionW PathFindExtensionW UrlIsW UrlCombineW StrRetToStrW PathFindFileNameW PathStripPathW PathRemoveFileSpecW PathRemoveExtensionW PathCommonPrefixW PathCanonicalizeW PathAppendW SHQueryValueExW UrlEscapeW PathCreateFromUrlW PathIsRelativeW PathAddBackslashW

iphlpapi

GetIfTable

msi

ord141 ord238 ord175

psapi

GetModuleFileNameExW EnumProcesses EnumProcessModules

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock ExpandEnvironmentStringsForUserW UnloadUserProfile

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQuerySessionInformationW

crypt32

CryptQueryObject CryptHashCertificate CertDuplicateCertificateContext CryptUnprotectData CertGetNameStringW CertEnumCertificatesInStore CertFreeCertificateContext CertCloseStore CryptProtectData

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_e34fddb954840108263324b7b286e908_darkgate_elex_floxif_maze

PE Signature issue

PE Signature issue

advapi32

kernel32

ole32

oleaut32

shell32

user32

netapi32

shlwapi

iphlpapi

msi

psapi

version

userenv

wtsapi32

crypt32

wintrust

generic