2026-08-09_42ce7090d437ed4084f222c5ead2ee91_bkransomware_darkgate_elex_floxif_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_42ce7090d437ed4084f222c5ead2ee91_bkransomware_darkgate_elex_floxif_maze
Size 3.5MB
Sample260809-rvxprasyaw
SHA256 2f100cb33f43ed22adda980e39196c8ea982c06008b1da9fcd32ed4edcae4737
MD5 42ce7090d437ed4084f222c5ead2ee91
SHA1 afa80ea18821f1b756df230167a5d28f52794d56
SHA512 77c77215ba424baa80671007cf2bf66e5a5ec7ff5e4bc8d07aca960ef3e9b64462f6fb5e7cae31bfdef6b534719b2ceafaa1d1112c2f944a8b95874d1385ac1b
SSDEEP 98304:IBknPa8c7HvBUfh6cGNrmmlroHUtCSFLOAkGkzdnEVomFHKnPbb:IBUGOIoHUtPFLOyomFHKnPX
TLSH
T1F806D0217EDD40BBD46312319EED7738A67EFD706A35027722903A2E7E713825D29623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_42ce7090d437ed4084f222c5ead2ee91_bkransomware_darkgate_elex_floxif_maze

File Explorer

2026-08-09_42ce7090d437ed4084f222c5ead2ee91_bkransomware_darkgate_elex_floxif_maze

.exe 3.5MB

2026-08-09_42ce7090d437ed4084f222c5ead2ee91_bkransomware_darkgate_elex_floxif_maze

IMPHASH cee7600e350352cfeb6a50f6b5db60db
SHA256 2f100cb33f43ed22adda980e39196c8ea982c06008b1da9fcd32ed4edcae4737
MD5 42ce7090d437ed4084f222c5ead2ee91
SHA1 afa80ea18821f1b756df230167a5d28f52794d56
SHA512 77c77215ba424baa80671007cf2bf66e5a5ec7ff5e4bc8d07aca960ef3e9b64462f6fb5e7cae31bfdef6b534719b2ceafaa1d1112c2f944a8b95874d1385ac1b
SSDEEP 98304:IBknPa8c7HvBUfh6cGNrmmlroHUtCSFLOAkGkzdnEVomFHKnPbb:IBUGOIoHUtPFLOyomFHKnPX
TLSH
T1F806D0217EDD40BBD46312319EED7738A67EFD706A35027722903A2E7E713825D29623
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c7:ab:c3:d3:a5:fe:73:44:30:83:02:2c:7f:24:5a:3e:14:a8:ab:10

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=ASUSTeK Computer Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Quality Testing Department,O=ASUSTeK Computer Inc.,L=Taipei / Peitou,ST=Taiwan,C=TW

Chains

Jun 8, 2015

CN=ASUSTeK Computer Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Quality Testing Department,O=ASUSTeK Computer Inc.,L=Taipei / Peitou,ST=Taiwan,C=TW

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=ASUSTeK Computer Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Quality Testing Department,O=ASUSTeK Computer Inc.,L=Taipei / Peitou,ST=Taiwan,C=TW

Serial Number

7d:08:d9:bc:13:07:26:de:26:ee:4e:f2:8e:13:30:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 31, 2012 - Aug 3, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

1309411

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\aaa\SCD_AutoRun\AsusSetup\Win32\Release\AsusSetup.pdb

kernel32

GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx OutputDebugStringW GetCPInfo WriteConsoleW SetEnvironmentVariableA GetOEMCP GetACP IsValidCodePage TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStartupInfoW GetStdHandle GetFileType SetStdHandle VirtualQuery VirtualAlloc GetSystemTimeAsFileTime HeapQueryInformation ExitThread GetSystemDefaultLangID CreateThread AreFileApisANSI GetModuleHandleExW ExitProcess RtlUnwind IsProcessorFeaturePresent IsDebuggerPresent FindResourceExW VirtualProtect GetTempPathW GetTimeZoneInformation GetProfileIntW SearchPathW GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime SetErrorMode GetFileAttributesW VerifyVersionInfoW VerSetConditionMask lstrcmpiW DuplicateHandle UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose DeleteFileW GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW CompareStringW GetCurrentDirectoryW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc GetThreadLocale GlobalGetAtomNameW InitializeCriticalSection GetStringTypeW GetTempFileNameW GlobalFlags GlobalFindAtomW GetSystemDirectoryW EncodePointer CopyFileW MulDiv GlobalSize GlobalUnlock lstrcpyW ResumeThread SuspendThread SetThreadPriority CreateEventW SetEvent GlobalFree FreeResource OutputDebugStringA SetLastError GlobalAddAtomW GetCurrentProcessId WritePrivateProfileStringW GetPrivateProfileIntW GetModuleHandleW lstrcmpW GlobalDeleteAtom GlobalLock GlobalAlloc LoadLibraryExW GetModuleFileNameW GetCurrentThreadId GetCurrentThread LocalFree FormatMessageW lstrcpyA GetWindowsDirectoryW GetSystemInfo SetFileAttributesA SearchPathA CreateFileW SizeofResource WideCharToMultiByte WriteFile lstrlenA GetFileAttributesA GetWindowsDirectoryA Process32NextW LockResource Process32FirstW LoadLibraryW LoadResource FindResourceW Sleep OpenProcess GetTickCount lstrcmpA lstrlenW FileTimeToSystemTime DeleteCriticalSection DecodePointer EnterCriticalSection HeapSize RaiseException LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapFree HeapAlloc HeapReAlloc GetCommandLineW GetModuleHandleA CloseHandle LoadLibraryA GetProcAddress GetLastError CreateProcessA GetVersionExW WaitForSingleObject GetCurrentProcess FreeLibrary GetPrivateProfileSectionNamesA GetModuleFileNameA WritePrivateProfileStringA GetPrivateProfileStringA MultiByteToWideChar GetPrivateProfileIntA GetPrivateProfileStringW LCMapStringW

user32

CloseClipboard OpenClipboard SetParent EnumDisplayMonitors SetLayeredWindowAttributes MonitorFromPoint UnionRect EnableScrollBar DestroyMenu UpdateLayeredWindow IsMenu SetMenuDefaultItem GetMenuDefaultItem GetMenuItemInfoW CreatePopupMenu NotifyWinEvent IntersectRect SetRectEmpty MessageBeep GetSystemMenu GetAsyncKeyState IsZoomed TrackMouseEvent CharUpperW DestroyIcon WindowFromPoint ReleaseCapture SetCapture WaitMessage KillTimer SetTimer DeleteMenu SystemParametersInfoW CopyImage LoadCursorW RealChildWindowFromPoint IsDialogMessageW SetWindowTextW CheckDlgButton MoveWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetTopWindow GetClassLongW SetWindowLongW EqualRect CopyRect AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow SetForegroundWindow GetForegroundWindow SetClipboardData SetMenu GetKeyboardLayout GetCapture SetFocus EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement IsChild CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos InvalidateRect UpdateWindow EndPaint BeginPaint ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringW SetActiveWindow GetNextDlgTabItem GetDlgItem EndDialog CreateDialogIndirectParamW DestroyWindow ValidateRect GetKeyState GetActiveWindow TranslateMessage GetMessageW MapDialogRect SetWindowContextHelpId DrawIconEx IsRectEmpty OffsetRect InflateRect FillRect DrawFocusRect GetSysColorBrush GetSysColor MapWindowPoints RedrawWindow SetWindowRgn DrawStateW IsWindowVisible DrawFrameControl DrawEdge RegisterWindowMessageW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW PtInRect ScreenToClient EmptyClipboard LoadImageW SetCursorPos SetRect BringWindowToTop LockWindowUpdate GetDoubleClickTime GetIconInfo CopyIcon ModifyMenuW DestroyAcceleratorTable SetClassLongW CharNextW CopyAcceleratorTableW InvalidateRgn GetNextDlgGroupItem SendDlgItemMessageA GetUpdateRect ClientToScreen GetCursorPos LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam RegisterClipboardFormatW CharUpperBuffW TrackPopupMenu ToUnicodeEx GetLastActivePopup GetWindowLongW IsWindowEnabled GetKeyboardState MapVirtualKeyW CreateAcceleratorTableW FrameRect PostThreadMessageW GetKeyNameTextW SubtractRect IsClipboardFormatAvailable IsCharLowerW MapVirtualKeyExW DrawMenuBar InvertRect HideCaret GetWindowRgn CreateMenu DestroyCursor GetComboBoxInfo TranslateMDISysAccel DefMDIChildProcW GetMenu DefFrameProcW SetCursor ShowOwnedPopups PostQuitMessage LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetFocus wsprintfW MessageBoxW SetWindowPos SetDlgItemTextW GetWindowRect GetParent FindWindowW EnumWindows GetClassNameW EnumChildWindows ShowWindow IsWindow GetDlgCtrlID GetClassNameA RegisterWindowMessageA GetWindowTextA MessageBoxA PeekMessageW GetDesktopWindow GetWindowThreadProcessId GetWindow DispatchMessageW IsIconic PostMessageW DrawIcon GetClientRect LoadIconW GetSystemMetrics SendMessageW EnableWindow UnregisterClassW LoadMenuW

gdi32

CreateRoundRectRgn CreateCompatibleBitmap CreateDIBSection CreateFontIndirectW GetMapMode SetRectRgn DPtoLP CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo RealizePalette SetPixel StretchBlt SetDIBColorTable Rectangle GetRgnBox OffsetRgn RoundRect CreatePalette GetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries ExtFloodFill ScaleWindowExtEx EnumFontFamiliesExW FillRgn FrameRgn GetBoundsRect PtInRegion GetViewportOrgEx LPtoDP GetWindowOrgEx SetPixelV GetTextFaceW SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx TextOutW MoveToEx GetObjectW SetTextAlign SetBkColor SetTextColor SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetPaletteEntries DeleteDC SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape DeleteObject CreatePatternBrush CreatePen CreateCompatibleDC BitBlt GetTextMetricsW GetDeviceCaps CreateDCW CopyMetaFileW Polyline Polygon CreatePolygonRgn ExtTextOutW PatBlt GetTextExtentPoint32W GetTextColor GetBkColor Ellipse CreateSolidBrush CreateRectRgnIndirect CreateRectRgn CreateHatchBrush CreateEllipticRgn CombineRgn CreateBitmap SetBkMode

msimg32

AlphaBlend TransparentBlt

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegQueryValueExW RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW GetLengthSid AllocateAndInitializeSid DuplicateTokenEx SetTokenInformation OpenProcessToken RegCloseKey RegQueryInfoKeyA RegOpenKeyExA RegEnumKeyExA RegQueryInfoKeyW RegQueryValueExA InitiateSystemShutdownW AdjustTokenPrivileges LookupPrivilegeValueW

shell32

SHAppBarMessage ShellExecuteExA SHFileOperationA SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation SHBrowseForFolderW DragFinish DragQueryFileW ShellExecuteW SHGetFileInfoW SHGetDesktopFolder

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW PathFileExistsA PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW PathRemoveFileSpecW StrFormatKBSizeW

uxtheme

GetThemeSysColor IsThemeBackgroundPartiallyTransparent GetThemePartSize GetWindowTheme DrawThemeText OpenThemeData CloseThemeData DrawThemeBackground DrawThemeParentBackground GetThemeColor GetCurrentThemeName IsAppThemed

ole32

CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CreateStreamOnHGlobal CoDisconnectObject ReleaseStgMedium DoDragDrop OleGetClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop OleLockRunning CoFreeUnusedLibraries OleInitialize OleUninitialize OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleFlushClipboard OleDuplicateData CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID CoInitialize CoCreateInstance CoCreateGuid CLSIDFromString CoInitializeEx CoUninitialize OleIsCurrentClipboard CoRegisterMessageFilter CoRevokeClassObject

oleaut32

SysFreeString LoadTypeLi OleCreateFontIndirect VarBstrFromDate VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen VariantChangeType VariantClear VariantInit SysAllocStringLen SysAllocString

oledlg

OleUIBusyW

gdiplus

GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo CM_Reenumerate_DevNode_Ex SetupDiGetClassDevsW SetupGetStringFieldA SetupFindFirstLineA SetupCloseInfFile SetupGetMultiSzFieldA SetupOpenInfFileA SetupFindNextLine CM_Locate_DevNode_ExW

psapi

GetModuleBaseNameA EnumProcesses EnumProcessModules

userenv

CreateEnvironmentBlock

newdev

UpdateDriverForPlugAndPlayDevicesA

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_42ce7090d437ed4084f222c5ead2ee91_bkransomware_darkgate_elex_floxif_maze

PE Signature issue

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

setupapi

psapi

userenv

newdev

oleacc

imm32

winmm

generic