2026-06-02_a57322e83a4cfe9be6cbdb3e9d318173_darkgate_elex_floxif_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_a57322e83a4cfe9be6cbdb3e9d318173_darkgate_elex_floxif_remcos_rhadamanthys_stop
Size 479KB
Sample260602-pqa9vaev5p
SHA256 367485146c098623ce498e06b631e09da973f55b7c70b67dae12428b61136cb0
MD5 a57322e83a4cfe9be6cbdb3e9d318173
SHA1 655a6996a513ad3d0a4fd4c1c2602c1e38adb0b9
SHA512 66376038ff807577879bed7f24ef7320a47c6b4c91b21ec117817917752a0a53f48d18cd9bf33003ab3d7cffc8b3eceb95ce1256849964d794e6755cad676481
SSDEEP 12288:FzRfZXnzRvRO94/SgdJASbh39b37BjvrEH7pa:ZUjgd6Sb1JBrEH7k
TLSH
T11DA4BE403FD8C3F5C646283665D5A73669BA6D7C1B2891C3A7A03A589E346C3FD3930E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-02_a57322e83a4cfe9be6cbdb3e9d318173_darkgate_elex_floxif_remcos_rhadamanthys_stop

File Explorer

2026-06-02_a57322e83a4cfe9be6cbdb3e9d318173_darkgate_elex_floxif_remcos_rhadamanthys_stop

.exe 479KB

2026-06-02_a57322e83a4cfe9be6cbdb3e9d318173_darkgate_elex_floxif_remcos_rhadamanthys_stop

IMPHASH ca82a5627202369d5cd128342205d881
SHA256 367485146c098623ce498e06b631e09da973f55b7c70b67dae12428b61136cb0
MD5 a57322e83a4cfe9be6cbdb3e9d318173
SHA1 655a6996a513ad3d0a4fd4c1c2602c1e38adb0b9
SHA512 66376038ff807577879bed7f24ef7320a47c6b4c91b21ec117817917752a0a53f48d18cd9bf33003ab3d7cffc8b3eceb95ce1256849964d794e6755cad676481
SSDEEP 12288:FzRfZXnzRvRO94/SgdJASbh39b37BjvrEH7pa:ZUjgd6Sb1JBrEH7k
TLSH
T11DA4BE403FD8C3F5C646283665D5A73669BA6D7C1B2891C3A7A03A589E346C3FD3930E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f4:30:41:28:87:a6:a7:0f:1f:fb:36:70:ef:cf:d1:13:77:44:c8:bf:40:ec:36:6e:08:6f:2c:09:e1:b5:69:71

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Jul 10, 2019

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

ea:c8:fc:fe:41:9d:5b:29:06:7f:4c:7c:fb:03:20:72:43:ff:d7:0d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Jul 10, 2019

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 28, 2018 - Feb 1, 2020

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 28, 2018 - Feb 1, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

158428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\362718\out\Release\360Tray.pdb

kernel32

SetFilePointer WriteFile DeviceIoControl CreateThread GetFileAttributesW SystemTimeToFileTime OpenEventW CopyFileW InterlockedExchange LCMapStringW LCMapStringA GetCPInfo GetStringTypeW RtlUnwind GetStartupInfoW ResumeThread GetSystemTimeAsFileTime ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetShortPathNameW LocalAlloc GetModuleHandleA SetLastError SetEvent CreateMutexW GetTickCount LoadLibraryW InterlockedCompareExchange Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo HeapWalk HeapLock OpenThread HeapUnlock OutputDebugStringW GetFileSizeEx SetFilePointerEx LocalFileTimeToFileTime lstrlenA lstrcmpiA lstrcmpA CreateFileA SetEndOfFile WriteConsoleW GetConsoleOutputCP ProcessIdToSessionId FreeResource GetSystemWindowsDirectoryW SetErrorMode MoveFileExW SetFileAttributesW DeleteFileW RemoveDirectoryW InterlockedIncrement InterlockedDecrement RaiseException CloseHandle lstrcmpiW lstrlenW OpenMutexW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte LoadLibraryExW FreeLibrary ReadFile CreateFileW GetWindowsDirectoryW GetPrivateProfileStringW GetModuleFileNameW GetCommandLineW GetModuleHandleW GetProcAddress GetVersionExW MultiByteToWideChar FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetLastError OpenProcess LocalFree GetVersion TerminateProcess WriteConsoleA GetLocaleInfoW SetStdHandle InitializeCriticalSectionAndSpinCount FlushFileBuffers GetConsoleMode GetConsoleCP GetSystemDirectoryW VirtualAlloc VirtualFree LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy HeapCreate ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentProcess WaitForSingleObject GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID CreateEventW ReleaseMutex GetACP GetOEMCP IsValidCodePage SetHandleCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA GetFileType

user32

PostMessageW FindWindowW GetActiveWindow CharNextW SendMessageTimeoutW IsWindow MessageBoxW UnregisterClassA LoadStringW

advapi32

RegEnumKeyExA RegQueryValueExA QueryServiceStatus StartServiceW CloseServiceHandle OpenServiceW OpenSCManagerW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW GetSidSubAuthority RegCreateKeyExW CreateProcessAsUserW GetLengthSid SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx RegSetValueExW RegQueryValueExW RegOpenKeyExW CheckTokenMembership CreateWellKnownSid DuplicateToken GetTokenInformation OpenProcessToken RegCloseKey ConvertSidToStringSidW LookupAccountSidW RegOpenKeyExA

shell32

SHGetFolderPathW ord680 ShellExecuteW ord165 SHGetSpecialFolderPathW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize

oleaut32

VarUI4FromStr

shlwapi

StrCmpIW SHSetValueW StrStrIW SHGetValueW PathAppendW PathFileExistsW PathRemoveFileSpecW PathCombineW ord437 wnsprintfW SHGetValueA SHSetValueA PathStripPathW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

rpcrt4

NdrAsyncClientCall RpcBindingFree RpcStringFreeW RpcAsyncCompleteCall RpcStringBindingComposeW RpcAsyncInitializeHandle RpcBindingFromStringBindingW

wininet

InternetOpenUrlW InternetCloseHandle HttpQueryInfoW InternetReadFile InternetSetOptionW DeleteUrlCacheEntryW InternetOpenW

userenv

GetUserProfileDirectoryW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_a57322e83a4cfe9be6cbdb3e9d318173_darkgate_elex_floxif_remcos_rhadamanthys_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

rpcrt4

wininet

userenv

generic