2026-10-27_fa084e8bbf1762980e93eac025f44ed9_darkgate_elex_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_fa084e8bbf1762980e93eac025f44ed9_darkgate_elex_floxif_mafia
Size 1.8MB
Sample261027-zdq5msgw5n
SHA256 ce9956aa611ec710a8a05567a1d6437f20319ebea3dc37a2e0a19cb4d30adcd8
MD5 fa084e8bbf1762980e93eac025f44ed9
SHA1 c42856640b4ddf2c440df1415cf8d78de3dc80cc
SHA512 592976d70d5e11e2067253710d89370d3352b364f1eabc7705a657857dbab81b83b36d12abe99eeb6d3c75cfbb1e429e61ac80cceddac3d7fa19e8b513ac3a9d
SSDEEP 49152:Bp1Rgw14kZV2HXsMnmjEREseBSsxHnfXsrHYi2Yijiq:zwYJYI
TLSH
T1E0958D2177E902B4F2B3CA709975C222D5B5B8665F32D7CF43911A1D1E37AD08E36B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-27_fa084e8bbf1762980e93eac025f44ed9_darkgate_elex_floxif_mafia

File Explorer

2026-10-27_fa084e8bbf1762980e93eac025f44ed9_darkgate_elex_floxif_mafia

.exe 1.8MB

2026-10-27_fa084e8bbf1762980e93eac025f44ed9_darkgate_elex_floxif_mafia

IMPHASH 136bea86936e01e1f983ef31dafa8b2a
SHA256 ce9956aa611ec710a8a05567a1d6437f20319ebea3dc37a2e0a19cb4d30adcd8
MD5 fa084e8bbf1762980e93eac025f44ed9
SHA1 c42856640b4ddf2c440df1415cf8d78de3dc80cc
SHA512 592976d70d5e11e2067253710d89370d3352b364f1eabc7705a657857dbab81b83b36d12abe99eeb6d3c75cfbb1e429e61ac80cceddac3d7fa19e8b513ac3a9d
SSDEEP 49152:Bp1Rgw14kZV2HXsMnmjEREseBSsxHnfXsrHYi2Yijiq:zwYJYI
TLSH
T1E0958D2177E902B4F2B3CA709975C222D5B5B8665F32D7CF43911A1D1E37AD08E36B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables referencing many IR and analysis tools
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

52:de:a4:78:59:98:49:5e:93:36:cb:e4:70:22:d5:39:1d:8d:a8:10:b4:50:e5:5c:25:21:df:4c:90:b5:b6:03

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,POSTALCODE=11747,STREET=273 Walt Whitman Road #255,L=Huntington Station,ST=New York,C=US,2.5.4.18=#13053131373437

Chains

Mar 13, 2018

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,POSTALCODE=11747,STREET=273 Walt Whitman Road #255,L=Huntington Station,ST=New York,C=US,2.5.4.18=#13053131373437

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

4f:cc:41:5e:ce:06:d2:d7:d2:7d:85:04:9b:7c:8a:bb:92:93:93:37

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,POSTALCODE=11747,STREET=273 Walt Whitman Road #255,L=Huntington Station,ST=New York,C=US,2.5.4.18=#13053131373437

Chains

Mar 13, 2018

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,POSTALCODE=11747,STREET=273 Walt Whitman Road #255,L=Huntington Station,ST=New York,C=US,2.5.4.18=#13053131373437

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,POSTALCODE=11747,STREET=273 Walt Whitman Road #255,L=Huntington Station,ST=New York,C=US,2.5.4.18=#13053131373437

Serial Number

37:76:9e:e4:0a:db:40:b3:25:f0:1c:aa:a6:cf:1a:66

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 13, 2018 - Mar 12, 2021

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

Major OS version

Entry point

339131

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LockResource SizeofResource CreateFileMappingW MapViewOfFile UnmapViewOfFile GetShortPathNameW SetLastError GetFileAttributesW SetFileAttributesW LoadResource LocalFree GetProcessHeap SetEndOfFile CreateProcessA GetExitCodeProcess FindResourceW GetEnvironmentVariableW CreateDirectoryW Sleep Process32NextW TerminateProcess OpenProcess Process32FirstW CreateToolhelp32Snapshot WaitForSingleObject CreateProcessW GetTickCount lstrlenW GetLastError FileTimeToSystemTime FileTimeToLocalFileTime CloseHandle DeviceIoControl CreateFileW FindClose FindNextFileW FindFirstFileW GetCurrentProcessId GetNativeSystemInfo GetCurrentProcess GetVersionExW WriteConsoleW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapSize QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesA SetStdHandle LoadLibraryW SetEnvironmentVariableA GetTimeZoneInformation FlushFileBuffers InterlockedIncrement InterlockedDecrement WideCharToMultiByte InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLocaleInfoW HeapFree GetCPInfo HeapAlloc GetSystemTimeAsFileTime GetProcAddress GetModuleHandleW ExitProcess DeleteFileW GetTimeFormatW GetDateFormatW HeapReAlloc GetCommandLineW HeapSetInformation RaiseException RtlUnwind LCMapStringW CompareStringW GetTimeFormatA GetDateFormatA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetACP GetOEMCP IsValidCodePage ReadFile WriteFile GetModuleFileNameW GetConsoleCP GetConsoleMode SetFilePointer

user32

MessageBoxW GetSystemMetrics

advapi32

AllocateAndInitializeSid SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken ControlService QueryServiceStatus RegDeleteValueW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegEnumValueW CloseServiceHandle OpenServiceW OpenSCManagerW RegCloseKey RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW FreeSid

shell32

SHGetFolderPathW

psapi

GetModuleFileNameExW EnumProcessModules

shlwapi

StrStrIW

wintrust

CryptCATAdminReleaseCatalogContext CryptCATAdminAcquireContext CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle WinVerifyTrust CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_fa084e8bbf1762980e93eac025f44ed9_darkgate_elex_floxif_mafia

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

psapi

shlwapi

wintrust

generic