2026-11-08_71bd6efd239152db0f60ce954e29c642_coinminer_darkgate_elex_floxif_maze_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-08_71bd6efd239152db0f60ce954e29c642_coinminer_darkgate_elex_floxif_maze_stealc
Size 1.2MB
Sample261109-b67fbsvzfx
SHA256 bb693c8d1fafd73d6020f4f54a36d135ba4b482c17f0503495d8762fdc404af4
MD5 71bd6efd239152db0f60ce954e29c642
SHA1 9a78589495d6caf04b7b4546f24987057acf1739
SHA512 72c97216892c1f5084695adfe1500a56b212324d4d938e030648d3de8b2972e9f8891e9d04ee9a48a426cbc9109b2909acd64c015878dc59840b19da68ed3817
SSDEEP 24576:hRDA38wWR469QdKt1/NEIMnpEDaWLjU1Z4TWc4R1ReJ4eLrc37JXCuv7uqpd3VDN:7DnR469QdKZMneLjU1Z4TWc4R1ReJ4e2
TLSH
T1E3558C12BB82D1B0C59640740929E7AD61B9BCB48B735BE7B3C43F4E1DB96C05E3624E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-08_71bd6efd239152db0f60ce954e29c642_coinminer_darkgate_elex_floxif_maze_stealc

File Explorer

2026-11-08_71bd6efd239152db0f60ce954e29c642_coinminer_darkgate_elex_floxif_maze_stealc

.exe 1.2MB

2026-11-08_71bd6efd239152db0f60ce954e29c642_coinminer_darkgate_elex_floxif_maze_stealc

IMPHASH d8dac1522430dca5df675efc0ccedf72
SHA256 bb693c8d1fafd73d6020f4f54a36d135ba4b482c17f0503495d8762fdc404af4
MD5 71bd6efd239152db0f60ce954e29c642
SHA1 9a78589495d6caf04b7b4546f24987057acf1739
SHA512 72c97216892c1f5084695adfe1500a56b212324d4d938e030648d3de8b2972e9f8891e9d04ee9a48a426cbc9109b2909acd64c015878dc59840b19da68ed3817
SSDEEP 24576:hRDA38wWR469QdKt1/NEIMnpEDaWLjU1Z4TWc4R1ReJ4eLrc37JXCuv7uqpd3VDN:7DnR469QdKZMneLjU1Z4TWc4R1ReJ4e2
TLSH
T1E3558C12BB82D1B0C59640740929E7AD61B9BCB48B735BE7B3C43F4E1DB96C05E3624E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1b:a7:23:6c:ab:94:26:9b:dd:ec:c1:24:af:0a:f7:50:24:c7:96:47:4a:96:2a:ee:cb:b6:48:bd:0a:68:af:fd

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Flexera Software LLC,O=Flexera Software LLC,L=Itasca,ST=Illinois,C=US

Chains

Jul 22, 2021

CN=Flexera Software LLC,O=Flexera Software LLC,L=Itasca,ST=Illinois,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Flexera Software LLC,O=Flexera Software LLC,L=Itasca,ST=Illinois,C=US

Serial Number

08:8a:ef:a9:cb:ae:72:43:05:6e:30:d1:5b:c2:81:28

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 13, 2018 - Nov 20, 2021

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

483946

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cygwin\home\nightly\fnpbuild\FNP-11.18.2\tier1\FNP\Service\Build\_release-Windows-NT4-i686-main\FNPLicensingService.exe.pdb

kernel32

OpenEventA GetCurrentProcessId ResetEvent GetTempPathA SetLastError MultiByteToWideChar GetModuleHandleA LoadLibraryExA WideCharToMultiByte GetSystemTimeAsFileTime LocalFree GetCurrentThreadId GetLocalTime GetFileAttributesA OpenMutexA FlushFileBuffers CreateNamedPipeA FormatMessageA CreateFileW DeleteFileW GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetFilePointerEx MoveFileExW AreFileApisANSI EncodePointer GetStringTypeW IsDebuggerPresent OutputDebugStringW WriteConsoleW SetStdHandle GetTimeZoneInformation LoadLibraryA GetProcAddress GetModuleFileNameA OpenProcess ResumeThread SuspendThread Sleep CreateEventA CreateMutexA WaitForSingleObjectEx WaitForSingleObject DecodePointer ReleaseMutex SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DisconnectNamedPipe ConnectNamedPipe OutputDebugStringA CreateDirectoryA CreateWaitableTimerA CreateThread SetWaitableTimer WaitForMultipleObjectsEx GetDriveTypeA QueryDosDeviceA GetVersionExA GetSystemDirectoryA WriteFile DeviceIoControl CloseHandle SetFilePointer ReadFile CreateFileA DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException SetEndOfFile ReadConsoleW GetConsoleMode GetConsoleCP FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetFileType GetOEMCP GetACP IsValidCodePage GetModuleFileNameW GetStdHandle GetModuleHandleExW ExitProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo RtlUnwind IsProcessorFeaturePresent GetCommandLineA LoadLibraryExW SetEnvironmentVariableA

user32

wsprintfA

advapi32

GetSecurityDescriptorGroup CryptGenRandom CryptReleaseContext CryptAcquireContextA SetNamedSecurityInfoA GetNamedSecurityInfoA GetAce EqualSid StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA QueryServiceConfigA OpenServiceA OpenSCManagerA CloseServiceHandle RegEnumKeyExA RegDeleteValueA RegDeleteKeyA ReportEventA RegisterEventSourceA DeregisterEventSource SetSecurityDescriptorDacl MakeSelfRelativeSD MakeAbsoluteSD IsValidSid InitializeSid InitializeSecurityDescriptor InitializeAcl GetSidSubAuthority GetSidLengthRequired GetSecurityDescriptorSacl GetSecurityDescriptorOwner GetSecurityDescriptorLength GetSecurityDescriptorDacl GetSecurityDescriptorControl GetLengthSid GetAclInformation CopySid AddAce RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

shell32

ord680

oleaut32

SysAllocString SysAllocStringLen SysFreeString SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData VariantInit VariantClear

dhcpcsvc

DhcpRequestParams

ws2_32

__WSAFDIsSet closesocket connect recv ioctlsocket send setsockopt socket WSAStartup WSACleanup WSAGetLastError getaddrinfo freeaddrinfo select

Name

.text

Size

643KB

Virtual Size

643KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.textidx

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-08_71bd6efd239152db0f60ce954e29c642_coinminer_darkgate_elex_floxif_maze_stealc

PE Signature issue

kernel32

user32

advapi32

ole32

shell32

oleaut32

dhcpcsvc

ws2_32

generic