2026-04-15_2bfb4843d2b6e60fdb21ff483cbdbd1d_cloudeye_darkgate_elex_mespinoza_vidar

General

Target
2026-04-15_2bfb4843d2b6e60fdb21ff483cbdbd1d_cloudeye_darkgate_elex_mespinoza_vidar
Size 3.1MB
Sample260415-pxvbasev8l
SHA256 f7eda9c0ce1283f0219c89c3c795eb31948c7785ae0a23d0201cc077d35b76ea
MD5 2bfb4843d2b6e60fdb21ff483cbdbd1d
SHA1 211023eae4c6d3d01021791f5c793115077f5d2d
SHA512 300c53d852ff58acf13d5bed1ba2a22a33eafa691e499e85416abda31476561f7542a67b7e694d1a2dac71d3f07bd2e8d465aee715a34324dc5acc1f69e35740
SSDEEP 98304:BjxAZu9Ffc9IW1dXgfC/MHmg6+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXy:j9VmAO5v
TLSH
T14EE5B3CAEED39C37C59515309995E71D36246FD08513BE4AE2047E8DEBBEF80A91C322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_2bfb4843d2b6e60fdb21ff483cbdbd1d_cloudeye_darkgate_elex_mespinoza_vidar

File Explorer

2026-04-15_2bfb4843d2b6e60fdb21ff483cbdbd1d_cloudeye_darkgate_elex_mespinoza_vidar

.exe 3.1MB

2026-04-15_2bfb4843d2b6e60fdb21ff483cbdbd1d_cloudeye_darkgate_elex_mespinoza_vidar

SHA256 f7eda9c0ce1283f0219c89c3c795eb31948c7785ae0a23d0201cc077d35b76ea
MD5 2bfb4843d2b6e60fdb21ff483cbdbd1d
SHA1 211023eae4c6d3d01021791f5c793115077f5d2d
SHA512 300c53d852ff58acf13d5bed1ba2a22a33eafa691e499e85416abda31476561f7542a67b7e694d1a2dac71d3f07bd2e8d465aee715a34324dc5acc1f69e35740
SSDEEP 98304:BjxAZu9Ffc9IW1dXgfC/MHmg6+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXy:j9VmAO5v
TLSH
T14EE5B3CAEED39C37C59515309995E71D36246FD08513BE4AE2047E8DEBBEF80A91C322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

312099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\protocolhandler.pdb

Name

.text

Size

317KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

90KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_2bfb4843d2b6e60fdb21ff483cbdbd1d_cloudeye_darkgate_elex_mespinoza_vidar

generic