2026-11-08_0400fc21e3174b1d3bcd90968ca13104_darkgate_elex_floxif_hijackloader_mafia_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-08_0400fc21e3174b1d3bcd90968ca13104_darkgate_elex_floxif_hijackloader_mafia_magniber
Size 3.4MB
Sample261109-j56fmsdh44
SHA256 830776f2f97da0f3db8da7bd37ab2ce41233736b052ec4358721d2f8d97a2bca
MD5 0400fc21e3174b1d3bcd90968ca13104
SHA1 3c134e713898f16ba84e61c719261998bcaedabe
SHA512 e65fa4c8578f1af2a02ac2b249c5efc4cfedc6de069a2fb82c5f5b05828f1722dbd9de509211309625866f61908cff889e8e751d6707f5ec68d37f4205b3f6ac
SSDEEP 98304:ysR42OInsY+BiDvPZk8DBokYeG97FTGP2ZpGIoj9ghi1RebMIg9Cbk/V8Gz6TKM0:ysRaivOFxTGP2X/ojDIg9Cbk/V8GPBT
TLSH
T10DF5BF217F99407AD1622D319DA9A7BDA66BFC701F3402C721543E3EBE717C2493892B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-08_0400fc21e3174b1d3bcd90968ca13104_darkgate_elex_floxif_hijackloader_mafia_magniber

File Explorer

2026-11-08_0400fc21e3174b1d3bcd90968ca13104_darkgate_elex_floxif_hijackloader_mafia_magniber

.exe 3.4MB

2026-11-08_0400fc21e3174b1d3bcd90968ca13104_darkgate_elex_floxif_hijackloader_mafia_magniber

IMPHASH 75d6724c7682323f2e350d50a7d38bf6
SHA256 830776f2f97da0f3db8da7bd37ab2ce41233736b052ec4358721d2f8d97a2bca
MD5 0400fc21e3174b1d3bcd90968ca13104
SHA1 3c134e713898f16ba84e61c719261998bcaedabe
SHA512 e65fa4c8578f1af2a02ac2b249c5efc4cfedc6de069a2fb82c5f5b05828f1722dbd9de509211309625866f61908cff889e8e751d6707f5ec68d37f4205b3f6ac
SSDEEP 98304:ysR42OInsY+BiDvPZk8DBokYeG97FTGP2ZpGIoj9ghi1RebMIg9Cbk/V8Gz6TKM0:ysRaivOFxTGP2X/ojDIg9Cbk/V8GPBT
TLSH
T10DF5BF217F99407AD1622D319DA9A7BDA66BFC701F3402C721543E3EBE717C2493892B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

57:5b:a7:79:0d:a4:cf:0d:f2:ca:22:17:cd:3d:6c:e9:fc:8e:3c:51

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Apr 9, 2025

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

97:00:34:f9:a1:8f:58:d9:85:17:ff:31:c4:dc:7f:84:17:48:69:c7:7f:a9:1d:17:fc:1a:c2:5d:f7:1a:17:8d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Apr 9, 2025

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Serial Number

07:de:92:56:75:ef:b1:50:cb:1c:bb:0a:4e:d8:76:71

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 13, 2024 - Sep 14, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1330734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\Jenkins\workspace\buildDriverWithParameter\Windows\Core\Release\ES2Utility.pdb

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey InitializeSecurityDescriptor SetSecurityDescriptorDacl RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCreateKeyExW

kernel32

IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetConsoleMode GetStringTypeW GetTimeZoneInformation GetLocaleInfoA EnumSystemLocalesA IsDebuggerPresent WriteConsoleW SetEnvironmentVariableA HeapCreate SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle SetUnhandledExceptionFilter VirtualQuery GetSystemInfo GetSystemTimeAsFileTime HeapSize HeapQueryInformation UnhandledExceptionFilter TerminateProcess IsValidLocale QueryPerformanceCounter CreateThread ExitThread ExitProcess GetFileType SetStdHandle RaiseException RtlUnwind EncodePointer DecodePointer GetStartupInfoW HeapSetInformation GetUserDefaultLCID FindResourceExW GetNumberFormatW GetWindowsDirectoryW VirtualProtect SearchPathW Sleep GetProfileIntW GlobalFlags GetSystemDirectoryW GetCurrentDirectoryW SetErrorMode GetFileTime GetFileSizeEx FileTimeToLocalFileTime GetFileAttributesExW TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle TlsGetValue LocalAlloc InterlockedIncrement FileTimeToSystemTime lstrlenA GlobalGetAtomNameW ResumeThread SetThreadPriority GlobalAddAtomW GlobalFindAtomW CompareStringW InitializeCriticalSectionAndSpinCount lstrcpyW FreeResource InterlockedDecrement ReleaseActCtx CreateActCtxW lstrcmpA GlobalDeleteAtom GetCurrentThread GetUserDefaultUILanguage ConvertDefaultLocale GetSystemDefaultUILanguage CompareStringA lstrcmpW GetLocaleInfoW LoadLibraryExW InterlockedExchange GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile ActivateActCtx DeactivateActCtx CreateFileW lstrcmpiW GetThreadLocale SetLastError CopyFileW GlobalSize GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW MulDiv VerifyVersionInfoW VerSetConditionMask VirtualAlloc GlobalReAlloc GlobalFree GlobalAlloc HeapReAlloc HeapFree HeapAlloc GetProcessHeap WaitForSingleObject OpenMutexW GetLastError CreateMutexW CloseHandle GetFileAttributesW CreateDirectoryW GetTempFileNameW GetTempPathW GetModuleFileNameW WideCharToMultiByte MultiByteToWideChar GetCurrentProcessId GetCurrentThreadId GetLocalTime GetTickCount GetVersionExW DeleteFileW GlobalMemoryStatusEx GetCurrentProcess GetModuleHandleW FindClose FindNextFileW FindFirstFileW GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress LoadLibraryW LeaveCriticalSection EnterCriticalSection FreeLibrary GetCommandLineW DeleteCriticalSection InitializeCriticalSection WritePrivateProfileStringW FindResourceW LoadResource LockResource SizeofResource GetConsoleCP InterlockedCompareExchange

user32

UnregisterClassW WaitMessage ReleaseCapture WindowFromPoint SetCapture KillTimer SetTimer InvalidateRect RealChildWindowFromPoint EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetLayeredWindowAttributes EnumDisplayMonitors SystemParametersInfoW SetRectEmpty DeleteMenu LoadCursorW GetDC ReleaseDC GetWindowThreadProcessId ShowOwnedPopups SetCursor GetMessageW TranslateMessage GetActiveWindow GetCursorPos SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem IsWindowEnabled ShowWindow MoveWindow SetWindowTextW IsDialogMessageW CheckDlgButton LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW RemovePropW IsWindow SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow SetActiveWindow DispatchMessageW BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow CharNextW GetMessageTime GetMessagePos PeekMessageW GetKeyNameTextW GetMonitorInfoW ScrollWindow TrackPopupMenu GetKeyState SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos EnableWindow ShowScrollBar ValidateRect UpdateWindow MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu GetWindowLongW SetWindowLongW CopyRect PtInRect DrawIconEx GetSysColorBrush GetFocus RedrawWindow IsWindowVisible MapWindowPoints GetClientRect GetWindowRect SetWindowRgn DrawFocusRect DrawFrameControl DrawEdge FillRect GetSysColor OffsetRect TranslateMDISysAccel DrawMenuBar DefMDIChildProcW InflateRect IsRectEmpty GetWindow GetDesktopWindow GetPropW ReuseDDElParam IsIconic CopyAcceleratorTableW SetRect IntersectRect InvalidateRgn GetNextDlgGroupItem GetNextDlgTabItem MessageBeep LoadMenuW GetSystemMenu NotifyWinEvent GetAsyncKeyState GetWindowRgn DrawStateW RegisterWindowMessageW SendMessageW SetWindowContextHelpId GetParent MapDialogRect SetWindowPos UnhookWindowsHookEx PostMessageW PostQuitMessage CharUpperW DrawIcon DestroyCursor CreateMenu HideCaret InvertRect MapVirtualKeyExW IsCharLowerW DestroyWindow PostThreadMessageW SetForegroundWindow GetLastActivePopup RemoveMenu GetSubMenu GetMenuItemCount InsertMenuW GetMenuItemID AppendMenuW GetMenuStringW GetMenuState GetSystemMetrics DefFrameProcW IsClipboardFormatAvailable SubtractRect CharUpperBuffW FrameRect CreateDialogIndirectParamW EndDialog UpdateLayeredWindow RegisterClipboardFormatW UnpackDDElParam IsZoomed InsertMenuItemW TranslateAcceleratorW CreateAcceleratorTableW LoadAcceleratorsW GetKeyboardState GetKeyboardLayout MapVirtualKeyW ToUnicodeEx GetUpdateRect DestroyAcceleratorTable SetClassLongW GetDoubleClickTime CopyIcon EnableScrollBar GetIconInfo SetCursorPos DestroyMenu GetMenuDefaultItem SetMenuDefaultItem GetMenuItemInfoW DestroyIcon LoadImageW EmptyClipboard CloseClipboard SetClipboardData CopyImage OpenClipboard UnionRect IsMenu MonitorFromPoint SetParent LockWindowUpdate BringWindowToTop MonitorFromWindow CreatePopupMenu

gdi32

CreatePen CreatePatternBrush CreateFontIndirectW CreateCompatibleBitmap CreateCompatibleDC BitBlt EnumFontFamiliesW GetTextCharsetInfo DeleteObject SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetMapMode GetClipBox ExcludeClipRect IntersectClipRect LineTo MoveToEx SetTextAlign GetLayout SetLayout SelectClipRgn GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetTextColor GetStockObject ExtSelectClipRgn DeleteDC SelectPalette GetObjectType GetRgnBox OffsetRgn CreateRoundRectRgn SetRectRgn GetMapMode DPtoLP CreateDIBSection Rectangle SetPixel SetDIBColorTable RealizePalette StretchBlt RoundRect CreatePalette GetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries ExtFloodFill SetPaletteEntries GetViewportOrgEx LPtoDP PtInRegion FillRgn FrameRgn GetBoundsRect EnumFontFamiliesExW GetWindowOrgEx SetPixelV GetTextFaceW CreateBitmap CreateDIBitmap GetObjectW SetBkColor SetTextColor GetTextMetricsW GetTextExtentPoint32W ExtTextOutW PatBlt Polygon Ellipse Polyline GetBkColor CombineRgn CreatePolygonRgn CreateEllipticRgn CreateRectRgnIndirect CreateRectRgn CreateHatchBrush CreateSolidBrush CreateDCW CopyMetaFileW GetDeviceCaps

msimg32

AlphaBlend TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

shell32

SHGetFileInfoW SHGetDesktopFolder SHGetSpecialFolderLocation SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW SHAppBarMessage ShellExecuteW DragFinish DragQueryFileW SHGetSpecialFolderPathW

comctl32

ImageList_GetIconSize InitCommonControlsEx

shlwapi

PathIsDirectoryW PathFindFileNameW PathFindExtensionW PathStripToRootW PathIsUNCW PathRemoveFileSpecW

ole32

OleLockRunning OleGetClipboard RevokeDragDrop CoLockObjectExternal RegisterDragDrop DoDragDrop OleFlushClipboard OleIsCurrentClipboard OleInitialize CoFreeUnusedLibraries CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CoInitialize CoCreateInstance CLSIDFromString CoInitializeEx OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator CoRevokeClassObject CoRegisterMessageFilter OleUninitialize CLSIDFromProgID CoCreateGuid OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree CoUninitialize

oleaut32

VariantCopy VariantInit VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen VarBstrFromDate OleCreateFontIndirect VariantChangeType VariantClear SysAllocString SysAllocStringLen SafeArrayDestroy SysFreeString

oledlg

OleUIBusyW

gdiplus

GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipCloneImage GdipDrawImageI GdipGetImageGraphicsContext GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipDrawImageRectI

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-08_0400fc21e3174b1d3bcd90968ca13104_darkgate_elex_floxif_hijackloader_mafia_magniber

PE Signature issue

PE Signature issue

advapi32

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

version

oleacc

imm32

winmm

generic