2026-07-02_cfa428711584b02b3fe41a2d43f9173a_darkgate_elex_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_cfa428711584b02b3fe41a2d43f9173a_darkgate_elex_remcos_stop
Size 956KB
Sample260702-tyf8aahx4s
SHA256 5df7ea4b8cc8e89ca4641488e7322672c3a859fae1e2bf6b95144868168e0969
MD5 cfa428711584b02b3fe41a2d43f9173a
SHA1 6655d12884ec8d05a4b9143b9fcc509ea0834f58
SHA512 19328cc178a86d03f30ecaf85f451f221f1e382ae4f81c8e032ea19f3464f8a3fc1ef96f1d26783c4656fd6f8f75a05cc035bc94c1b01a6dc210c3ff52bd3a18
SSDEEP 12288:wIDmEcDhvCUMoUlKJwB0cn3Fnd5+yUoNPTs2JQml9FB7GcPQdYm1qIIf0P6a0/KX:w4HoXcvtNPAeQ8FZQdf1qIWeOmuF+
TLSH
T17B25BE00B782D036F9B314F18AFE866E9538FD21071554DBA3C8696E0E75AF27D3126B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_cfa428711584b02b3fe41a2d43f9173a_darkgate_elex_remcos_stop

File Explorer

2026-07-02_cfa428711584b02b3fe41a2d43f9173a_darkgate_elex_remcos_stop

.exe 956KB

2026-07-02_cfa428711584b02b3fe41a2d43f9173a_darkgate_elex_remcos_stop

IMPHASH db4d5d831c9533634445e4ba12458bd6
SHA256 5df7ea4b8cc8e89ca4641488e7322672c3a859fae1e2bf6b95144868168e0969
MD5 cfa428711584b02b3fe41a2d43f9173a
SHA1 6655d12884ec8d05a4b9143b9fcc509ea0834f58
SHA512 19328cc178a86d03f30ecaf85f451f221f1e382ae4f81c8e032ea19f3464f8a3fc1ef96f1d26783c4656fd6f8f75a05cc035bc94c1b01a6dc210c3ff52bd3a18
SSDEEP 12288:wIDmEcDhvCUMoUlKJwB0cn3Fnd5+yUoNPTs2JQml9FB7GcPQdYm1qIIf0P6a0/KX:w4HoXcvtNPAeQ8FZQdf1qIWeOmuF+
TLSH
T17B25BE00B782D036F9B314F18AFE866E9538FD21071554DBA3C8696E0E75AF27D3126B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

367396

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\305265\out\Release\guardhp.pdb

gdiplus

GdiplusShutdown GdipFree GdipDisposeImage GdipAlloc GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipCreateFromHDC GdipDeleteGraphics GdipDrawImagePointRectI GdipFillRectangleI GdipDrawString GdipSetTextRenderingHint GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipDeleteStringFormat GdipCreateStringFormat GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipDrawImageRectRectI GdipDrawImageRectRect GdiplusStartup

kernel32

WideCharToMultiByte LocalFree TerminateProcess GetStartupInfoW Sleep GetProcessHeap HeapFree HeapAlloc CreateEventW WaitForSingleObject GlobalAlloc GlobalFree GlobalLock GlobalUnlock CreateMutexW ReleaseMutex GetShortPathNameW DeleteFileW GetFileSizeEx SetFilePointer RemoveDirectoryW VirtualAllocEx WriteProcessMemory ReadProcessMemory VirtualFreeEx GetVersion VirtualAlloc InterlockedCompareExchange ResumeThread WriteFile GetTickCount GlobalFindAtomW GlobalAddAtomW OpenEventW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExitProcess HeapWalk HeapLock OpenThread HeapUnlock SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime CreateFileA SystemTimeToFileTime TlsSetValue ResetEvent OpenEventA TlsGetValue TlsFree TlsAlloc GetSystemTimeAsFileTime InterlockedExchange VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapSize HeapReAlloc HeapDestroy FlushFileBuffers RtlUnwind LCMapStringA LCMapStringW GetCPInfo ReadFile GetTimeZoneInformation SetHandleCount GetStdHandle DeviceIoControl CreateFileW GetFileType GetStartupInfoA SetEvent CreateEventA LoadLibraryW OutputDebugStringW CreateProcessW lstrlenA GetVersionExW SetLastError FlushInstructionCache GetCurrentProcess GetCommandLineW InterlockedIncrement InterlockedDecrement LoadLibraryExW MultiByteToWideChar RaiseException lstrcmpiW lstrlenW FreeLibrary GetModuleHandleW GetLastError LeaveCriticalSection EnterCriticalSection HeapCreate GetModuleFileNameA GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW DeleteCriticalSection InitializeCriticalSection GetProcAddress GetModuleFileNameW Process32NextW GetCurrentProcessId Process32FirstW CreateToolhelp32Snapshot CloseHandle OpenProcess GetLongPathNameW GetLocalTime GetCurrentThreadId WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SetStdHandle GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetModuleHandleA CompareStringA CompareStringW SetEnvironmentVariableA GetSystemDirectoryW lstrcmpA lstrcmpiA GetSystemWindowsDirectoryW FreeResource ExitThread CreateThread

user32

SetWindowRgn ShowScrollBar SetScrollRange GetScrollRange EnableScrollBar SetScrollPos GetScrollInfo SetScrollInfo GetScrollPos SetCursor DrawFocusRect PtInRect UnionRect EqualRect ReleaseCapture SetCapture GetAsyncKeyState ScreenToClient DrawTextW FillRect InvalidateRect EndPaint BeginPaint GetFocus GetParent GetWindowTextLengthW GetWindowTextW SystemParametersInfoW EnableWindow GetClientRect PostQuitMessage RegisterWindowMessageW FindWindowW PostMessageW SendMessageW OffsetRect CopyRect SendMessageTimeoutW FindWindowExW ReleaseDC GetDC CallWindowProcW GetWindowLongW IsWindow SetTimer KillTimer SetWindowPos IsWindowVisible ShowWindow WaitForInputIdle GetWindowRect GetForegroundWindow GetShellWindow GetWindowInfo GetDesktopWindow GetWindow EnumDisplaySettingsW GetMonitorInfoW MonitorFromPoint GetWindowThreadProcessId GetAncestor WindowFromPoint SetWindowLongW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW DestroyWindow DefWindowProcW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW UnregisterClassA UpdateLayeredWindow

gdi32

OffsetViewportOrgEx RectVisible CreateRectRgn CombineRgn RestoreDC DeleteDC CreateCompatibleDC CreateDIBSection CreateCompatibleBitmap SelectObject SetViewportOrgEx BitBlt GetObjectW SetBkColor ExtTextOutW GetStockObject SetBkMode SaveDC DeleteObject CreateFontW SetTextColor SelectClipRgn EnumFontFamiliesW CreateRectRgnIndirect

advapi32

RegQueryValueExW AdjustTokenPrivileges GetTokenInformation RegOpenKeyExA RegEnumKeyExA RegQueryValueExA LookupPrivilegeValueW OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor OpenSCManagerW OpenServiceW QueryServiceStatus ControlService DeleteService CloseServiceHandle

shell32

CommandLineToArgvW SHCreateDirectoryExW ord165 SHLoadInProc SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoCreateGuid CoTaskMemAlloc CoCreateInstance CoInitialize CoUninitialize CreateStreamOnHGlobal StringFromGUID2 CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

StrCmpIW PathFindFileNameW PathIsRelativeW PathIsRootW SHGetValueW StrStrIA SHSetValueW PathRemoveFileSpecW StrStrIW PathFileExistsW PathAppendW StrCmpNIW SHGetValueA SHSetValueA StrTrimA PathCombineW

comctl32

_TrackMouseEvent InitCommonControlsEx

ws2_32

WSACleanup WSAStartup

psapi

GetModuleFileNameExW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

Name

.text

Size

491KB

Virtual Size

491KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

26KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

206KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

99KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_cfa428711584b02b3fe41a2d43f9173a_darkgate_elex_remcos_stop

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

ws2_32

psapi

version

iphlpapi

generic