2026-07-23_f850dc85553d7163461ae50b0d645bbf_bkransomware_darkgate_elex_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_f850dc85553d7163461ae50b0d645bbf_bkransomware_darkgate_elex_maze
Size 2.9MB
Sample260723-lnxtaabc56
SHA256 e290802f1f7fdfb91d395d9f133b6997e035425e102d5a2c5b71de649ab65e26
MD5 f850dc85553d7163461ae50b0d645bbf
SHA1 242b339c6d7b96ea48560d925f64a4ad60a1d203
SHA512 203445e0bfcf62f0680ed7db9611452f2d16a5996569af87711677eb3c06cb1e547f72e12dc07d9d2640ac69ad279112d4e3c95ce2c817b57b1dbb8fc9d75fba
SSDEEP 49152:C5syafjJhchx78UsA3b6YXT9GsjVQa8a+x5l1z2xq/SYsW6OlAA5SFYTGZA7Zjc+:msXJhcJ3bNXT9e2xq/SYs9O+APFjc6R2
TLSH
T178E57C2079428172D6670172ADAEBB6F485CAAB10B78D4C3B3C45E1F2DB46D32F35297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_f850dc85553d7163461ae50b0d645bbf_bkransomware_darkgate_elex_maze

File Explorer

2026-07-23_f850dc85553d7163461ae50b0d645bbf_bkransomware_darkgate_elex_maze

.exe 2.9MB

2026-07-23_f850dc85553d7163461ae50b0d645bbf_bkransomware_darkgate_elex_maze

IMPHASH 012b4034e80e3403c6fc08599c27b53f
SHA256 e290802f1f7fdfb91d395d9f133b6997e035425e102d5a2c5b71de649ab65e26
MD5 f850dc85553d7163461ae50b0d645bbf
SHA1 242b339c6d7b96ea48560d925f64a4ad60a1d203
SHA512 203445e0bfcf62f0680ed7db9611452f2d16a5996569af87711677eb3c06cb1e547f72e12dc07d9d2640ac69ad279112d4e3c95ce2c817b57b1dbb8fc9d75fba
SSDEEP 49152:C5syafjJhchx78UsA3b6YXT9GsjVQa8a+x5l1z2xq/SYsW6OlAA5SFYTGZA7Zjc+:msXJhcJ3bNXT9e2xq/SYs9O+APFjc6R2
TLSH
T178E57C2079428172D6670172ADAEBB6F485CAAB10B78D4C3B3C45E1F2DB46D32F35297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1717885

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

soundlib

CreateSoundLib

winmm

waveOutGetDevCapsA waveOutClose waveOutGetNumDevs timeGetTime waveOutOpen waveOutSetVolume waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveOutReset waveInGetNumDevs waveInGetDevCapsA waveInOpen waveInClose waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInStart waveInReset

ss3dgfunc

_WriteTGA@24 _Normalize@8 _COLORtoDWORD@16 _SetRotationXMatrix@8 _TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16 _SetInverseMatrix@8 _VECTOR3Length@4 _SetRotationYMatrix@8 _CrossProduct@12

wsock32

socket send recv inet_addr htons connect closesocket WSACleanup WSAStartup gethostbyname ioctlsocket

dinput8

DirectInput8Create

kernel32

GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc InitializeSListHead GetThreadTimes OutputDebugStringW GetTimeZoneInformation SetStdHandle GetFileSize CloseHandle GetLocalTime OpenFile IsDBCSLeadByte ReleaseMutex WaitForSingleObject CreateMutexA CreateDirectoryA GetTickCount DeleteFileA MultiByteToWideChar WideCharToMultiByte LCMapStringA Sleep GlobalAlloc GlobalLock GlobalUnlock lstrlenA SetCurrentDirectoryA GetCurrentDirectoryA CreateToolhelp32Snapshot Process32First Process32Next lstrcmpA lstrcpyA OutputDebugStringA FreeLibrary GetProcAddress LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency ReadFile CreateFileA GetLastError lstrcmpiA InterlockedCompareExchange GetModuleHandleA lstrcpynA WriteFile OpenProcess GetCurrentProcess GetCurrentProcessId TerminateProcess CreateThread GetModuleFileNameA GetFileAttributesA InterlockedExchange SetUnhandledExceptionFilter WriteConsoleW GetCurrentThreadId InitializeCriticalSection HeapAlloc LeaveCriticalSection DeleteCriticalSection FindClose lstrcatA GetLogicalDriveStringsA GetTempPathA RemoveDirectoryA QueryDosDeviceA SetFileAttributesA FindFirstFileA FindNextFileA CopyFileA GetVersionExA InterlockedExchangeAdd GetPrivateProfileIntA GetPrivateProfileStringA GetSystemTimeAsFileTime GetSystemTime GetModuleFileNameW GetProcessHeap FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode GetFileType GetStdHandle HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW SetEvent GetCPInfo GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError HeapFree FileTimeToSystemTime SystemTimeToTzSpecificLocalTime IsProcessorFeaturePresent IsDebuggerPresent RaiseException RtlUnwind GetStringTypeW FlushFileBuffers GetFileAttributesExW EnterCriticalSection CreateDirectoryW CreateFileW SetEndOfFile SetEnvironmentVariableA LocalFree DecodePointer EncodePointer GetCurrentThread UnhandledExceptionFilter GetCommandLineA LoadLibraryExW ExitThread AreFileApisANSI GetModuleHandleExW ExitProcess WritePrivateProfileStringA

user32

PeekMessageA wsprintfA SetRect MessageBoxA CharNextA CharPrevA GetAsyncKeyState OpenClipboard CloseClipboard SetClipboardData EmptyClipboard CopyRect PostMessageA OffsetRect GetClipboardData IsClipboardFormatAvailable SetCapture ReleaseCapture GetCursorPos ScreenToClient GetDC ReleaseDC TranslateMessage DispatchMessageA LoadCursorA LoadCursorFromFileA SetCursor FillRect GetClientRect SetForegroundWindow DrawTextA RegisterClassA LoadIconA SetWindowLongA GetWindowLongA ShowCursor EndPaint BeginPaint UpdateWindow EndMenu GetSystemMenu GetSystemMetrics KillTimer SetTimer ShowWindow DestroyWindow CreateWindowExW CreateWindowExA RegisterClassExW RegisterClassExA PostQuitMessage DefWindowProcA UnregisterHotKey

gdi32

SetTextColor SetBkMode CreateSolidBrush CreateFontA GetStockObject RemoveFontResourceExA AddFontResourceExA SelectObject GetTextExtentPoint32A DeleteObject CreateFontIndirectA TextOutA

advapi32

RegQueryValueExA RegOpenKeyExA RegQueryInfoKeyA RegCloseKey

shell32

ShellExecuteA

ole32

CoInitialize CoCreateInstance CoFreeUnusedLibraries CoUninitialize

oleaut32

VariantClear

freeimage

_FreeImage_Unload@4 _FreeImage_GetBits@4 _FreeImage_Load@12 _FreeImage_GetInfo@4 _FreeImage_ConvertTo16Bits565@4 _FreeImage_SaveJPEG@12

iphlpapi

GetAdaptersInfo

psapi

GetModuleFileNameExW EnumProcessModules GetProcessImageFileNameA

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

gdiplus

GdipDeleteGraphics GdipDrawImageRectI GdipCreateBitmapFromFile GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCreateFromHDC

generic

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=225, version=20806,

count=3, id=199, version=41118,

count=50, id=223, productName=VS2013 build 21005, version=21005,

count=136, id=225, productName=VS2013 build 21005, version=21005,

count=244, id=224, productName=VS2013 build 21005, version=21005,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=344, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=662, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,