2026-07-13_19fd5835ac14634f83d519ef29c3d89b_darkgate_elex_mafia_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-13_19fd5835ac14634f83d519ef29c3d89b_darkgate_elex_mafia_remcos_stop
Size 942KB
Sample260713-h3rn2aft21
SHA256 bf6c5e8588c2f9921d6789738ec36be1dda07eb39b2466dd5521af107df8ee08
MD5 19fd5835ac14634f83d519ef29c3d89b
SHA1 944259861607bdf5114bf6cdad3a28ef3bcb0f0d
SHA512 cf84db053253f232f08f0ac4519a60973b4622814b8baef05c554aa665080eb1ede6d9fdc1a9d7c19b271886eae8ddf2c0d8799834cdd9e4a65e6d7d27fd88a5
SSDEEP 12288:a3YQIInBW8B2AcpwFZV3ioZNdPmpRVIgFllUHmrB8Dzs5urTQRpLVLYQ8T8Or:aoCA0c3oZNFUIgFzUHY63s5urT0L2Q56
TLSH
T13A2539307BE541B4E3B2257799B58A159729FDE9073581EFA9801C3F387A5C2DA38323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-13_19fd5835ac14634f83d519ef29c3d89b_darkgate_elex_mafia_remcos_stop

File Explorer

2026-07-13_19fd5835ac14634f83d519ef29c3d89b_darkgate_elex_mafia_remcos_stop

.exe 942KB

2026-07-13_19fd5835ac14634f83d519ef29c3d89b_darkgate_elex_mafia_remcos_stop

IMPHASH c43daef622729338f886772c829c077c
SHA256 bf6c5e8588c2f9921d6789738ec36be1dda07eb39b2466dd5521af107df8ee08
MD5 19fd5835ac14634f83d519ef29c3d89b
SHA1 944259861607bdf5114bf6cdad3a28ef3bcb0f0d
SHA512 cf84db053253f232f08f0ac4519a60973b4622814b8baef05c554aa665080eb1ede6d9fdc1a9d7c19b271886eae8ddf2c0d8799834cdd9e4a65e6d7d27fd88a5
SSDEEP 12288:a3YQIInBW8B2AcpwFZV3ioZNdPmpRVIgFllUHmrB8Dzs5urTQRpLVLYQ8T8Or:aoCA0c3oZNFUIgFzUHY63s5urT0L2Q56
TLSH
T13A2539307BE541B4E3B2257799B58A159729FDE9073581EFA9801C3F387A5C2DA38323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

256259

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\bioticdev\PCKInstaller\Release\Win32\Installer.pdb

gdiplus

GdipDrawImageI GdipCreateBitmapFromStream GdipDrawImageRectI GdiplusShutdown GdiplusStartup GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFile GdipCloneImage GdipDisposeImage GdipFillRectangle GdipDrawLine GdipCreateLineBrushFromRect GdipDeleteFont GdipCreateFontFromDC GdipMeasureString GdipDrawString GdipFillRectangleI GdipDrawPath GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipAddPathArcI GdipAddPathLineI GdipClosePathFigure GdipDeletePath GdipCreatePath GdipDeletePen GdipCreatePen1 GdipCreateLineBrushFromRectI GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipAlloc GdipFree GdipGetImageHeight GdipGetImageWidth

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpConnect WinHttpWriteData WinHttpSendRequest WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpOpenRequest WinHttpReceiveResponse WinHttpQueryHeaders

kernel32

CloseHandle CreateThread FreeResource CreateFileW ReadFile FlushFileBuffers GetFileSize GetTempPathW GetTempFileNameW DeleteFileW MoveFileW FindFirstFileW FindNextFileW FindClose FreeLibrary LoadLibraryW GetModuleFileNameW CreateDirectoryW GlobalLock WriteFile GlobalUnlock SetEvent WaitForSingleObject TerminateThread InitializeCriticalSectionAndSpinCount DeleteCriticalSection CreateEventW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection GetVersionExW GetCurrentProcess ExpandEnvironmentStringsW GetFileAttributesW GetLastError SetLastError SetFilePointer Sleep TerminateProcess GetProcessHeap HeapAlloc lstrlenW HeapFree WaitForMultipleObjects GlobalFree LocalAlloc LocalFree CopyFileW GetCurrentThreadId MoveFileExW GetExitCodeProcess GetNativeSystemInfo GetFileSizeEx GlobalAlloc GetTickCount GetFileAttributesExW UnmapViewOfFile MapViewOfFile CreateFileMappingW InterlockedDecrement GetLocalTime GetFirmwareEnvironmentVariableW FileTimeToDosDateTime SystemTimeToFileTime FileTimeToSystemTime GetFileType DuplicateHandle GetFileInformationByHandle GetSystemTime GetModuleHandleExW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetModuleHandleW GetProcAddress InterlockedExchange LoadLibraryA RaiseException HeapDestroy HeapReAlloc HeapSize InterlockedIncrement InterlockedCompareExchange GetStringTypeW InitializeCriticalSection EncodePointer DecodePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleW SetEndOfFile CompareStringW SetEnvironmentVariableA OutputDebugStringW SetCriticalSectionSpinCount GetCommandLineW HeapSetInformation GetStartupInfoW RtlUnwind LCMapStringW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree HeapCreate IsProcessorFeaturePresent ExitProcess GetStdHandle SetHandleCount GetLocaleInfoW GetTimeZoneInformation FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetVersion

user32

LoadCursorW SetCursor GetWindow BringWindowToTop AttachThreadInput GetForegroundWindow GetWindowThreadProcessId RegisterWindowMessageW DestroyWindow GetDesktopWindow GetCursorPos GetSystemMetrics LoadImageW SetTimer SetDlgItemTextW GetWindowDC ReleaseDC GetWindowLongW CreateDialogParamW DialogBoxParamW DefWindowProcW ScreenToClient GetParent MessageBoxW IsWindowEnabled GetClientRect TrackMouseEvent EndPaint BeginPaint GetPropW SetPropW PostMessageW DrawFocusRect GetDialogBaseUnits GetSysColor ExitWindowsEx GetKeyState EndDialog GetWindowRect GetDC InvalidateRect IsWindow EnableWindow SetWindowLongW CallWindowProcW HideCaret SendMessageW SetWindowTextW SendDlgItemMessageW ShowWindow SetWindowPos GetDlgItem SetFocus KillTimer

gdi32

GetStockObject SetBkMode SetBrushOrgEx StretchBlt GetObjectW CreatePatternBrush DeleteObject CreateFontIndirectW ExtTextOutW GetTextMetricsW CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject BitBlt DeleteDC SetTextColor SetBkColor

advapi32

OpenSCManagerW LookupPrivilegeValueW OpenProcessToken RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegCreateKeyExW OpenServiceW CloseServiceHandle CryptGetHashParam AllocateAndInitializeSid SetEntriesInAclW InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid RegOpenKeyW SetFileSecurityW RegEnumKeyExW GetUserNameW LookupAccountSidW RegLoadKeyW RegDeleteValueW ControlService QueryServiceStatus RegDeleteKeyW CryptReleaseContext CryptDestroyKey CryptEncrypt CryptGenKey CryptExportKey CryptDestroyHash CryptVerifySignatureW CryptHashData CryptAcquireContextW CryptImportKey CryptGetKeyParam CryptCreateHash AdjustTokenPrivileges

shell32

ShellExecuteExW ShellExecuteW SHGetFolderPathW SHGetKnownFolderPath Shell_NotifyIconW

ole32

CoSetProxyBlanket CoTaskMemFree CoInitialize CoCreateInstance CoInitializeSecurity CoUninitialize CoInitializeEx GetHGlobalFromStream CreateStreamOnHGlobal StringFromCLSID CoCreateGuid

oleaut32

SysStringByteLen SysAllocStringByteLen SysAllocStringLen OleCreatePictureIndirect SysAllocString SysFreeString VariantInit VariantClear VariantChangeType SysStringLen

shlwapi

PathAppendW PathStripPathW PathFindExtensionW PathFindFileNameW StrToIntExW PathAddBackslashW PathRemoveExtensionW PathRemoveFileSpecW PathFileExistsW

crypt32

CryptDecodeObjectEx CryptStringToBinaryW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-13_19fd5835ac14634f83d519ef29c3d89b_darkgate_elex_mafia_remcos_stop

gdiplus

version

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

generic