2026-10-31_793a1873faae2c8f1270d4581ef30997_coinminer_darkgate_elex_floxif_mafia_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_793a1873faae2c8f1270d4581ef30997_coinminer_darkgate_elex_floxif_mafia_remcos
Size 4.8MB
Sample261101-3wt6ssdf48
SHA256 d475724c1ac5e8e954fc7de8ec16167b6c131ef6f52f80bd950339d96dbf426e
MD5 793a1873faae2c8f1270d4581ef30997
SHA1 5e59b0d3f188c7bbccd3d157dcdb727ea50bc734
SHA512 5b886942e2a4e35e431869d508219c17c180890f8cf8bb7ccf205fb69ba217e8b13ff5a374641e6946c0a239c57574d8ae4335f95dea0e38efe48766ecb000dc
SSDEEP 98304:7usnV9dgpDFb5LEd4MnfgG8SOGp8Q1Y1jRmmaX7g0AAacGwu01GPiNgh1OiwqtKF:7xndgpDDACGzYzmmaXU0AYGwu01GPiNj
TLSH
T1713692329D657811E1B3873280E69F24F28DFD1C26AE12FA45D43824BDF505A6E3EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-31_793a1873faae2c8f1270d4581ef30997_coinminer_darkgate_elex_floxif_mafia_remcos

File Explorer

2026-10-31_793a1873faae2c8f1270d4581ef30997_coinminer_darkgate_elex_floxif_mafia_remcos

.exe 4.8MB

2026-10-31_793a1873faae2c8f1270d4581ef30997_coinminer_darkgate_elex_floxif_mafia_remcos

IMPHASH 336c10a72f2ee9438fec4977f5fbd08d
SHA256 d475724c1ac5e8e954fc7de8ec16167b6c131ef6f52f80bd950339d96dbf426e
MD5 793a1873faae2c8f1270d4581ef30997
SHA1 5e59b0d3f188c7bbccd3d157dcdb727ea50bc734
SHA512 5b886942e2a4e35e431869d508219c17c180890f8cf8bb7ccf205fb69ba217e8b13ff5a374641e6946c0a239c57574d8ae4335f95dea0e38efe48766ecb000dc
SSDEEP 98304:7usnV9dgpDFb5LEd4MnfgG8SOGp8Q1Y1jRmmaX7g0AAacGwu01GPiNgh1OiwqtKF:7xndgpDDACGzYzmmaXU0AYGwu01GPiNj
TLSH
T1713692329D657811E1B3873280E69F24F28DFD1C26AE12FA45D43824BDF505A6E3EF25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

10:cb:51:9f:9d:27:6a:e7:bc:de:cd:fc:2b:22:f1:d8:3b:28:d7:ca

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

Chains

Jul 21, 2015

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

OU=Starfield Class 2 Certification Authority,O=Starfield Technologies\, Inc.,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

39:14:84

Issuer

OU=Starfield Class 2 Certification Authority,O=Starfield Technologies\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jan 1, 2014 - May 30, 2031

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 3, 2011 - May 3, 2031

Subject

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

Serial Number

28:0f:0a:44:45:2b:0f

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 25, 2014 - Aug 25, 2017

Minor OS version

Major OS version

Entry point

1322980

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount HeapCreate QueryPerformanceCounter IsProcessorFeaturePresent UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetOEMCP IsValidCodePage GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleW GetDriveTypeW SetEnvironmentVariableA GetProcessHeap SizeofResource LockResource LoadResource FindResourceW MultiByteToWideChar GetModuleFileNameW GlobalAlloc GetStdHandle GetSystemInfo lstrcmpW GetModuleHandleW Sleep FindClose SetFileAttributesW CreateDirectoryW FindFirstFileW GetVersion SetStdHandle RemoveDirectoryW DeleteFileW CopyFileW FreeLibrary GetProcAddress LoadLibraryW GetCurrentThreadId ReleaseMutex WaitForSingleObject GetLastError SetLastError CreateMutexW ResumeThread SuspendThread CreateEventW CloseHandle SetEvent GetExitCodeThread GetTickCount lstrcpyW WinExec lstrlenW lstrcatW CreateFileA SetUnhandledExceptionFilter GetTimeZoneInformation VirtualQuery CreateFileW ReadFile WriteFile SetFilePointer HeapQueryInformation HeapSize GetFileType HeapReAlloc ExitProcess GetDateFormatW GetTimeFormatW GetSystemTimeAsFileTime ExitThread HeapFree HeapAlloc DecodePointer EncodePointer RaiseException RtlUnwind GetStartupInfoW HeapSetInformation GetCommandLineW FindResourceExW GetUserDefaultLCID VirtualProtect SearchPathW GetProfileIntW GetNumberFormatW SetErrorMode GetCurrentDirectoryW GlobalFlags GetFileTime GetFileSizeEx GetFileSize VirtualAlloc VirtualFree GetFileAttributesExW GlobalGetAtomNameW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GetCurrentProcessId GetFullPathNameW GetVolumeInformationW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers lstrcmpiW GetThreadLocale FindNextFileW WritePrivateProfileStringW GetPrivateProfileIntW GetCurrentThread ConvertDefaultLocale GetLocaleInfoW LoadLibraryExW InterlockedExchange InterlockedDecrement ReleaseActCtx CreateActCtxW FreeResource GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW InitializeCriticalSectionAndSpinCount ActivateActCtx DeactivateActCtx SetThreadPriority GetVersionExW lstrlenA lstrcmpA GlobalFree GlobalSize GlobalLock GlobalUnlock FormatMessageW MulDiv LocalAlloc LocalFree OutputDebugStringW GetModuleHandleA GetSystemDirectoryW LoadLibraryA CreateProcessW GetWindowsDirectoryW GetUserDefaultUILanguage lstrcpynW GetSystemDefaultUILanguage FileTimeToLocalFileTime FileTimeToSystemTime WideCharToMultiByte GetFileAttributesW GetExitCodeProcess GetACP GetPrivateProfileStringW GetTempFileNameW CreateToolhelp32Snapshot Process32FirstW TerminateProcess Process32NextW GetTempPathW GetCurrentProcess CreateThread GetShortPathNameW TerminateThread InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW ResetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection

user32

UnionRect MonitorFromPoint TranslateMDISysAccel DrawMenuBar DefMDIChildProcW DefFrameProcW RegisterClipboardFormatW UnpackDDElParam ReuseDDElParam InsertMenuItemW TranslateAcceleratorW GetIconInfo EnableScrollBar HideCaret InvertRect GetMenuDefaultItem LockWindowUpdate BringWindowToTop SetCursorPos CreateAcceleratorTableW LoadAcceleratorsW GetKeyboardState GetKeyboardLayout ToUnicodeEx DrawFocusRect DrawFrameControl DrawEdge DrawIconEx DrawStateW SetClassLongW GetAsyncKeyState NotifyWinEvent CreatePopupMenu DestroyAcceleratorTable SetParent SetWindowRgn IsZoomed GetNextDlgGroupItem InvalidateRgn SetRect IsRectEmpty CopyAcceleratorTableW OffsetRect CharNextW DestroyIcon IsIconic WaitMessage KillTimer SetTimer DeleteMenu UnregisterClassW SetLayeredWindowAttributes EnumDisplayMonitors SetRectEmpty CopyImage RealChildWindowFromPoint GetSysColorBrush IntersectRect DestroyMenu CharUpperW MapVirtualKeyW WindowFromPoint SetWindowContextHelpId MapDialogRect ShowOwnedPopups PostQuitMessage GetDesktopWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog UpdateLayeredWindow ShowWindow MoveWindow IsDialogMessageW CheckRadioButton CheckDlgButton SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW CheckMenuItem RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus GetWindowTextLengthW GetWindowTextW GetLastActivePopup BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime MonitorFromWindow GetMonitorInfoW MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos ShowScrollBar CreateWindowExW GetClassInfoExW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement DefWindowProcW CallWindowProcW GetMenu GetWindowLongW CopyRect EndPaint BeginPaint GetWindowDC IsMenu CreateMenu PostThreadMessageW SetMenuDefaultItem IsClipboardFormatAvailable FrameRect GetUpdateRect OpenClipboard SetClipboardData CloseClipboard EmptyClipboard CharUpperBuffW GetDoubleClickTime ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect CallNextHookEx GetMessageW TranslateMessage DispatchMessageW IsCharLowerW MapVirtualKeyExW SubtractRect DrawIcon GetWindowRgn IsWindowEnabled GetActiveWindow IsWindowVisible GetKeyState PeekMessageW ValidateRect GetMenuState AppendMenuW GetMenuItemID InsertMenuW RemoveMenu SetFocus DestroyCursor EnumChildWindows GetDlgCtrlID SetWindowTextW SetWindowPos GetMenuItemCount wsprintfW GetMenuItemInfoW SetMenuItemInfoW GetWindow ScreenToClient LoadBitmapW GetForegroundWindow GetWindowThreadProcessId AttachThreadInput GetMessagePos SystemParametersInfoW LoadMenuW GetSubMenu GetMenuStringW GetSystemMenu EnableMenuItem MessageBeep SetWindowLongW LoadCursorW CopyIcon GetSysColor SetCursor ReleaseCapture GetParent SetCapture RedrawWindow InvalidateRect ReleaseDC GetWindowRect InflateRect PtInRect GetClassInfoW IsWindow SetWindowsHookExW MessageBoxW SetDlgItemTextW UnhookWindowsHookEx FindWindowW GetDC GetCursorPos GetSystemMetrics LoadImageW PostMessageW LoadIconW SetForegroundWindow SetActiveWindow UpdateWindow GetClientRect SendMessageW EnableWindow GetKeyNameTextW

gdi32

MoveToEx SetTextAlign GetLayout SetLayout SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutW ExtTextOutW Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC CreatePatternBrush CreateBitmap SelectPalette GetObjectType CreatePen CreateSolidBrush CreateHatchBrush PatBlt SetRectRgn CombineRgn IntersectClipRect LineTo CreateDIBitmap GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo GetTextColor GetRgnBox CreateDIBSection CreateRoundRectRgn CreatePolygonRgn CreateEllipticRgn Polyline Ellipse Polygon CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries OffsetRgn SetDIBColorTable SetPixel Rectangle EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries GetTextFaceW SetPixelV DPtoLP ExcludeClipRect GetClipBox SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode SetBkColor RestoreDC SaveDC CreateDCW CopyMetaFileW StretchBlt BitBlt GetBkColor CreateCompatibleDC CreateRectRgnIndirect CreateCompatibleBitmap CreateFontIndirectW GetDeviceCaps GetObjectW GetStockObject GetTextExtentPoint32W DeleteObject SelectObject GetMapMode CreateFontW

msimg32

AlphaBlend TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegCloseKey RegOpenKeyExA RegOpenKeyExW RegEnumKeyExA RegQueryValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegEnumValueW RegEnumKeyW RegOpenKeyW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegQueryValueExA

shell32

SHAppBarMessage ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW SHGetFileInfoW SHGetDesktopFolder SHBrowseForFolderW Shell_NotifyIconW DragQueryFileW DragFinish

comctl32

ImageList_GetIconSize

shlwapi

PathFileExistsW StrCmpW UrlUnescapeW PathRemoveFileSpecW PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW

ole32

OleGetClipboard RegisterDragDrop StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CoLockObjectExternal CLSIDFromString CLSIDFromProgID CoInitializeEx CoCreateInstance CoRegisterMessageFilter CoRevokeClassObject DoDragDrop OleFlushClipboard OleIsCurrentClipboard CreateStreamOnHGlobal OleLockRunning IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleDuplicateData CoTaskMemAlloc OleInitialize CoFreeUnusedLibraries ReleaseStgMedium CoTaskMemFree CoInitialize CoCreateGuid CoUninitialize OleUninitialize CreateILockBytesOnHGlobal RevokeDragDrop

oleaut32

SysFreeString OleCreateFontIndirect VarBstrFromDate SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy SysAllocString VariantInit VariantChangeType VariantClear SysAllocStringLen

oledlg

OleUIBusyW

wininet

InternetSetFilePointer InternetSetStatusCallbackW InternetGetLastResponseInfoW InternetQueryDataAvailable InternetSetOptionExW InternetCanonicalizeUrlW InternetCrackUrlW HttpSendRequestExW InternetWriteFile HttpEndRequestW HttpQueryInfoW InternetReadFile HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetCloseHandle InternetOpenW InternetAttemptConnect InternetConnectW

winhttp

WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpSetOption WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData WinHttpCrackUrl

dbghelp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo GetNetworkParams

msi

ord205

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipDrawImageI GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipGetImagePaletteSize

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_793a1873faae2c8f1270d4581ef30997_coinminer_darkgate_elex_floxif_mafia_remcos

PE Signature issue

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

wininet

winhttp

dbghelp

iphlpapi

msi

oleacc

gdiplus

imm32

winmm

generic