2026-10-01_253fd7248f0d0c6e2ce987a3e19839e1_amadey_darkgate_elex_floxif_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_253fd7248f0d0c6e2ce987a3e19839e1_amadey_darkgate_elex_floxif_stop
Size 451KB
Sample261002-wqvrtavakb
SHA256 561ff5a19f561589863a172c3bbcc253aa3f6d8c00d732df694b45ed33429d9c
MD5 253fd7248f0d0c6e2ce987a3e19839e1
SHA1 610b3dce0c592a7f024eab60d516bb7cb74bea6d
SHA512 d199986951f2247492d420fb6f528dd84018cf1ebad0afb9495d956007ff3d448e1cbc51ade9bfacf3e34550a32629f92ab5a3e5f36859d0f98b3d56cead0d70
SSDEEP 12288:kSFMlkXTWpvmaMBshopIam1biTdbGFaBjvrEH7WJV:ksYmkmaMl1Ab8NGFsrEH7WD
TLSH
T16FA49E1173D0D2B6C2A231716A66E7706AEDBC385E75438777C02B7D9E381C29A3871B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-01_253fd7248f0d0c6e2ce987a3e19839e1_amadey_darkgate_elex_floxif_stop

File Explorer

2026-10-01_253fd7248f0d0c6e2ce987a3e19839e1_amadey_darkgate_elex_floxif_stop

.exe 451KB

2026-10-01_253fd7248f0d0c6e2ce987a3e19839e1_amadey_darkgate_elex_floxif_stop

IMPHASH cc50bc11c112d01154ce3385b76d7d36
SHA256 561ff5a19f561589863a172c3bbcc253aa3f6d8c00d732df694b45ed33429d9c
MD5 253fd7248f0d0c6e2ce987a3e19839e1
SHA1 610b3dce0c592a7f024eab60d516bb7cb74bea6d
SHA512 d199986951f2247492d420fb6f528dd84018cf1ebad0afb9495d956007ff3d448e1cbc51ade9bfacf3e34550a32629f92ab5a3e5f36859d0f98b3d56cead0d70
SSDEEP 12288:kSFMlkXTWpvmaMBshopIam1biTdbGFaBjvrEH7WJV:ksYmkmaMl1Ab8NGFsrEH7WD
TLSH
T16FA49E1173D0D2B6C2A231716A66E7706AEDBC385E75438777C02B7D9E381C29A3871B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ca:57:20:08:d0:2a:a7:84:d3:dd:0f:78:64:fc:7d:c5:6d:fb:5b:d1:5f:3b:e5:14:02:9d:93:f9:95:57:c7:f8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tonec Inc.,OU=Internet Download Manager,O=Tonec Inc.,L=New York,ST=New York,C=US

Chains

Mar 13, 2020

CN=Tonec Inc.,OU=Internet Download Manager,O=Tonec Inc.,L=New York,ST=New York,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

13:a4:19:e4:14:94:f6:88:0a:1d:0d:fe:c8:52:cc:04:20:65:03:e9

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Chains

Mar 13, 2020

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Subject

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Serial Number

06:c5:07:8a:a5:28:bb:d3:b8:66:8a:b1:0b:03:5f:94

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2019 - Aug 3, 2022

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tonec Inc.,OU=Internet Download Manager,O=Tonec Inc.,L=New York,ST=New York,C=US

Serial Number

09:96:cb:38:36:ac:ef:b7:37:c2:12:d1:55:41:7e:f1

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2019 - Aug 3, 2022

Minor OS version

Major OS version

Entry point

147463

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSizeEx GetFileTime RtlUnwind GetTimeZoneInformation GetSystemTimeAsFileTime Sleep HeapFree GetCommandLineA GetStartupInfoA HeapAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode GetStdHandle InitializeCriticalSectionAndSpinCount GetFileAttributesA VirtualFree GetACP IsValidCodePage FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetProcessHeap CompareStringW SetEnvironmentVariableA FileTimeToLocalFileTime SetErrorMode FileTimeToSystemTime GetOEMCP GetCPInfo GetModuleHandleW CreateFileA GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection GlobalFlags WritePrivateProfileStringA GlobalGetAtomNameA GlobalFindAtomA lstrcmpW GetModuleFileNameW FormatMessageA MulDiv lstrlenA GetTickCount GlobalUnlock GlobalFree FreeResource GetCurrentProcessId SetLastError GlobalAddAtomA GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA CompareStringA GlobalLock lstrcmpA GlobalAlloc RaiseException InterlockedExchange LocalFree LocalAlloc ExitProcess lstrcpynA FreeLibrary InterlockedDecrement GetVersionExA LoadLibraryW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource ReleaseMutex CloseHandle CreateMutexA GetLastError GetProcAddress GetModuleHandleA HeapCreate GetModuleFileNameA

user32

SetRect IsRectEmpty CopyAcceleratorTableA CharNextA PostThreadMessageA CharUpperA GetSysColorBrush ReleaseCapture LoadCursorA SetCapture EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA RegisterWindowMessageA SendDlgItemMessageA WinHelpA GetCapture GetClassLongA SetPropA GetPropA RemovePropA SetFocus GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcA CallWindowProcA GetMenu SetWindowLongA OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect UnhookWindowsHookEx DrawIcon SendMessageA PostMessageA IsIconic GetMenuItemID GetMenuItemCount GetSubMenu GetWindow SetWindowContextHelpId MapDialogRect SetWindowPos RegisterClipboardFormatA GetDesktopWindow SetActiveWindow CreateDialogIndirectParamA DestroyMenu UnregisterClassA MessageBeep GetNextDlgGroupItem InvalidateRgn GetWindowTextA InvalidateRect GetClientRect SetTimer KillTimer LoadIconA GetSystemMetrics EnableWindow GetKeyboardState GetKeyState GetClassNameA PostQuitMessage CheckMenuItem EnableMenuItem GetMenuState ModifyMenuA GetParent GetFocus LoadBitmapA GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageA IsWindowVisible GetActiveWindow DispatchMessageA TranslateMessage GetMessageA CallNextHookEx SetWindowsHookExA SetCursor MessageBoxA IsWindowEnabled GetLastActivePopup GetWindowLongA GetWindowThreadProcessId EndDialog GetNextDlgTabItem GetDlgItem DestroyWindow IsWindow IsChild

gdi32

GetStockObject GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode ExtSelectClipRgn DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx CreateBitmap SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC GetObjectA SetBkColor SetTextColor GetClipBox GetDeviceCaps SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegCreateKeyExA RegQueryValueA RegOpenKeyA RegEnumKeyA RegDeleteKeyA RegSetValueExA RegQueryValueExW RegOpenKeyExA RegCloseKey RegQueryValueExA

shlwapi

PathFindFileNameA PathStripToRootA PathIsUNCA PathFindExtensionA

oledlg

ord8

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject CoGetClassObject CoTaskMemAlloc CoTaskMemFree CLSIDFromString CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysAllocStringByteLen SysStringByteLen VariantClear SysAllocStringLen SysAllocString VariantInit SafeArrayUnaccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData VariantChangeType VariantCopy OleCreateFontIndirect VariantTimeToSystemTime SystemTimeToVariantTime SafeArrayDestroy GetErrorInfo SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_253fd7248f0d0c6e2ce987a3e19839e1_amadey_darkgate_elex_floxif_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oledlg

ole32

oleaut32

generic