2026-11-08_fa5e5a1752b448b652829a76c012daff_bkransomware_darkgate_elex_floxif_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-08_fa5e5a1752b448b652829a76c012daff_bkransomware_darkgate_elex_floxif_maze
Size 3.1MB
Sample261108-tybb2astes
SHA256 8d3ec0494b15f5f56d06e1abc1e4eb2d72847481229403181e932d5168d4a8ed
MD5 fa5e5a1752b448b652829a76c012daff
SHA1 d415645ba66b419c5981e94c37813dcdd4cca90b
SHA512 8449a2b6d4cb48bd5dbefd0499c19fe07a36103809af02fd3ffbc127ba1518cdbf1ca6974affa391971dadca93a9a0d707367a70faaea5cd03fb7c0224c5280b
SSDEEP 98304:tHCrP/kVWreYUT9qicuM8ppEgE8y8hm4WUZPWuem:tAAvQgE8y8hm4WUZPWut
TLSH
T11BE5D311EFC9C1EAC2225230857B6F3553AB2FB172A9DE4232DC3A3D1BB44D16514EA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-08_fa5e5a1752b448b652829a76c012daff_bkransomware_darkgate_elex_floxif_maze

File Explorer

2026-11-08_fa5e5a1752b448b652829a76c012daff_bkransomware_darkgate_elex_floxif_maze

.exe 3.1MB

2026-11-08_fa5e5a1752b448b652829a76c012daff_bkransomware_darkgate_elex_floxif_maze

IMPHASH 7dffd5cd7c38ecba6bc1b655d0955c9f
SHA256 8d3ec0494b15f5f56d06e1abc1e4eb2d72847481229403181e932d5168d4a8ed
MD5 fa5e5a1752b448b652829a76c012daff
SHA1 d415645ba66b419c5981e94c37813dcdd4cca90b
SHA512 8449a2b6d4cb48bd5dbefd0499c19fe07a36103809af02fd3ffbc127ba1518cdbf1ca6974affa391971dadca93a9a0d707367a70faaea5cd03fb7c0224c5280b
SSDEEP 98304:tHCrP/kVWreYUT9qicuM8ppEgE8y8hm4WUZPWuem:tAAvQgE8y8hm4WUZPWut
TLSH
T11BE5D311EFC9C1EAC2225230857B6F3553AB2FB172A9DE4232DC3A3D1BB44D16514EA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

88:d3:b8:0a:84:78:03:08:ef:7d:c0:5b:2f:92:30:57:29:ca:93:0b:86:0c:5d:b9:8f:c1:ba:72:71:5b:c4:30

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=10F\,Hancom tower\,49\, Daewangpangyo-ro 644beon-gil\,Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 12, 2018

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

12:1e:dc:26:91:7a:34:3f:01:6a:45:67:3f:9c:62:4b:71:06:3c:0a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Jan 12, 2018

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:25:07:1d:f9:af

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 18, 2009 - Mar 18, 2019

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

Serial Number

1c:62:20:89:2e:c4:2a:e5:0e:ef:64:c9

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2017 - Sep 19, 2018

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

Major OS version

Entry point

1243297

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\GitRepository\install\NEO2\Setup_NEO2\Release\Setup.pdb

kernel32

OutputDebugStringW SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP GetTimeZoneInformation GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW QueryPerformanceCounter GetStartupInfoW GetStdHandle SizeofResource GetFileType SetStdHandle GetSystemTimeAsFileTime VirtualQuery VirtualAlloc GetSystemInfo HeapQueryInformation ExitThread CreateThread RtlUnwind IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleExW ExitProcess GetEnvironmentStringsW GetCommandLineW FindResourceExW VirtualProtect GetProfileIntW GetTickCount GetTempPathW GetTempFileNameW SearchPathW GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime SetErrorMode GetWindowsDirectoryW lstrcmpiW DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW FlushFileBuffers GetFileSize GetFileAttributesW CreateFileW lstrcpyW DeleteFileW SetEnvironmentVariableA WriteConsoleW LCMapStringW GetCurrentDirectoryW GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW CompareStringW FileTimeToSystemTime GlobalGetAtomNameW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GlobalFlags ResumeThread SetThreadPriority CloseHandle CompareStringA lstrcmpA GetVersionExW GetCurrentThread GlobalFindAtomW GlobalAddAtomW LoadLibraryA lstrcmpW GlobalDeleteAtom LoadLibraryExW FreeLibrary GetSystemDirectoryW GetCurrentThreadId EncodePointer CopyFileW GlobalSize GlobalAlloc GetCurrentProcessId MulDiv LoadLibraryW GlobalFree GlobalUnlock GlobalLock GetProcAddress GetModuleHandleW GetModuleHandleA FreeResource SetLastError OutputDebugStringA lstrcpynW DeleteCriticalSection DecodePointer EnterCriticalSection HeapSize RaiseException LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapFree HeapAlloc HeapReAlloc GetThreadUILanguage SetEnvironmentVariableW GetCurrentProcess GetExitCodeProcess GetPrivateProfileIntW GetPrivateProfileStringW FindClose WaitForSingleObject Sleep WinExec WritePrivateProfileStringW GetModuleFileNameW FindFirstFileW SetThreadUILanguage VerifyVersionInfoW VerSetConditionMask LocalFree FormatMessageW GetLastError GetVolumeInformationA MultiByteToWideChar WideCharToMultiByte FindResourceW LoadResource LockResource

user32

CharUpperBuffW SetCursorPos DrawFrameControl SetRect UnionRect InvertRect HideCaret EnableScrollBar GetIconInfo DrawIconEx DrawFocusRect GetNextDlgGroupItem GetMenuDefaultItem SetClassLongW LockWindowUpdate RegisterClipboardFormatW EnumChildWindows CopyAcceleratorTableW DestroyAcceleratorTable CreateAcceleratorTableW GetKeyboardState GetKeyboardLayout ToUnicodeEx WaitMessage PostThreadMessageW ModifyMenuW IsMenu NotifyWinEvent WindowFromPoint SetWindowRgn SetCapture GetAsyncKeyState CharUpperW TrackMouseEvent IsRectEmpty DrawStateW EmptyClipboard SetClipboardData CloseClipboard OpenClipboard EnumDisplayMonitors SetLayeredWindowAttributes MonitorFromPoint SetParent ReuseDDElParam UnpackDDElParam LoadImageW DestroyIcon SetRectEmpty InsertMenuItemW CreatePopupMenu TranslateAcceleratorW LoadAcceleratorsW ReleaseCapture DeleteMenu CopyImage RealChildWindowFromPoint IntersectRect MapVirtualKeyW GetKeyNameTextW SetCursor ShowOwnedPopups GetMessageW OffsetRect MessageBeep IsZoomed PostQuitMessage SystemParametersInfoW GetMenuItemInfoW DestroyMenu SendDlgItemMessageA LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps CheckMenuItem IsDialogMessageW SetWindowTextW SendDlgItemMessageW UpdateLayeredWindow CheckDlgButton MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetTopWindow GetClassNameW GetClassLongW SetWindowLongW EqualRect CopyRect MapWindowPoints AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos ScrollWindow RedrawWindow ValidateRect SetForegroundWindow GetForegroundWindow TrackPopupMenu SetMenu GetMenu GetCapture GetKeyState SetFocus GetDlgCtrlID IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos IsChild CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW PostMessageW GetMessageTime GetMessagePos LoadMenuW RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringW GetLastActivePopup GetWindowThreadProcessId ClientToScreen EndPaint BeginPaint GetWindowDC GetDesktopWindow SetMenuDefaultItem CopyIcon IsClipboardFormatAvailable DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel IsCharLowerW MapVirtualKeyExW SubtractRect GetUpdateRect GetComboBoxInfo GetWindowLongW SetActiveWindow IsWindowEnabled GetActiveWindow GetDoubleClickTime CreateMenu DestroyCursor GetWindowRgn MapDialogRect GetNextDlgTabItem GetDlgItem EndDialog CreateDialogIndirectParamW DestroyWindow UpdateWindow ReleaseDC FillRect GetDC PtInRect GetFocus LoadCursorW FrameRect DrawEdge GrayStringW DrawTextExW TabbedTextOutW DrawTextW InflateRect InvalidateRect GetSysColor ScreenToClient GetCursorPos KillTimer GetParent SetTimer SetScrollPos BringWindowToTop IsWindow RegisterWindowMessageW UnregisterClassW ExitWindowsEx DispatchMessageW TranslateMessage PeekMessageW MessageBoxW GetWindowRect EnableMenuItem GetSystemMenu DrawIcon GetClientRect GetSystemMetrics IsIconic SendMessageW LoadIconW EnableWindow GetSysColorBrush

gdi32

SetRectRgn DPtoLP GetTextMetricsW CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetDIBits RealizePalette SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateRoundRectRgn GetRgnBox OffsetRgn GetTextColor CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline Rectangle EnumFontFamiliesExW ExtFloodFill SetPaletteEntries GetViewportOrgEx LPtoDP GetWindowOrgEx FillRgn FrameRgn GetBoundsRect PtInRegion GetTextFaceW SetPixelV SetMapMode SetBkMode CombineRgn PatBlt CreateRectRgnIndirect CreateDCW CopyMetaFileW ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx SetLayout OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx MoveToEx SetTextAlign SetTextColor SetROP2 SetPolyFillMode RoundRect CreateSolidBrush SetBkColor SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetDeviceCaps GetClipBox ExcludeClipRect DeleteObject CreatePatternBrush CreatePen CreateHatchBrush CreateBitmap CreateFontIndirectW CreateRectRgn Escape ExtTextOutW TextOutW RectVisible PtVisible GetTextExtentPoint32W GetBkColor GetObjectW GetCurrentObject BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC CreateFontW GetStockObject GetLayout

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegCreateKeyW RegQueryValueExW RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegCreateKeyExW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegDeleteKeyW RegDeleteValueW RegOpenKeyW RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteExW DragQueryFileW DragFinish SHAppBarMessage SHGetMalloc SHGetPathFromIDListW ShellExecuteW SHGetFileInfoW SHGetFolderPathW SHGetDesktopFolder SHBrowseForFolderW SHGetSpecialFolderLocation

comctl32

ImageList_SetBkColor ImageList_GetBkColor ImageList_GetImageInfo

shlwapi

PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW StrFormatKBSizeW PathFileExistsW PathRemoveFileSpecW

uxtheme

IsThemeBackgroundPartiallyTransparent GetWindowTheme GetThemeSysColor GetCurrentThemeName DrawThemeText DrawThemeParentBackground DrawThemeBackground GetThemeColor IsAppThemed GetThemePartSize CloseThemeData OpenThemeData

ole32

CoTaskMemFree CoTaskMemAlloc OleDuplicateData ReleaseStgMedium CoUninitialize CoCreateGuid CoCreateInstance CoInitialize CoDisconnectObject CreateStreamOnHGlobal DoDragDrop OleGetClipboard OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoInitializeEx

oleaut32

SysFreeString VarBstrFromDate VariantCopy VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen LoadTypeLi SysAllocString VariantChangeType VariantClear VariantInit SysAllocStringLen

gdiplus

GdipCreateFromHDC GdipDeleteGraphics GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdipDrawImageRectI GdiplusShutdown GdipSetInterpolationMode GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdiplusStartup GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext

msi

ord92 ord32 ord159 ord160 ord118 ord7 ord70 ord78 ord150 ord8

iphlpapi

GetAdaptersInfo

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ws2_32

recv connect inet_addr htons inet_ntoa gethostbyname socket WSAStartup send

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-08_fa5e5a1752b448b652829a76c012daff_bkransomware_darkgate_elex_floxif_maze

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

msi

iphlpapi

version

ws2_32

oleacc

imm32

winmm

generic