2026-07-28_663a642664cc71f671f920f96724c855_darkgate_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_663a642664cc71f671f920f96724c855_darkgate_elex_rhadamanthys_stop
Size 12.6MB
Sample260729-bfbwqs1dkf
SHA256 248d582102531fb83b42ad238907b530175ca06b5b8ca2e34d0ca23f80146284
MD5 663a642664cc71f671f920f96724c855
SHA1 1b19bef9a426821a7d90b1bfa898761f8f033556
SHA512 6ad3334eaf2989920cc0e633b74a2e317871417009a5e1b1b2d0c654198e6a5ab59b0268e59d6ca5f9abffd0a80669c3b1f2f0cd527ea31fabed81f3d4af0e9e
SSDEEP 393216:C49M5vSexRxM0b4Fj6xyE3gzv7dklsPx:k5aIRxM0ojEQF
TLSH
T156D62341E941817BD9B314B10CBE6A29C679BA39572450D7A3C4AF1C8F73AE27D3324B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-28_663a642664cc71f671f920f96724c855_darkgate_elex_rhadamanthys_stop

.exe 12.6MB

2026-07-28_663a642664cc71f671f920f96724c855_darkgate_elex_rhadamanthys_stop

IMPHASH a105dc00b39610f69514a6195c666689
SHA256 248d582102531fb83b42ad238907b530175ca06b5b8ca2e34d0ca23f80146284
MD5 663a642664cc71f671f920f96724c855
SHA1 1b19bef9a426821a7d90b1bfa898761f8f033556
SHA512 6ad3334eaf2989920cc0e633b74a2e317871417009a5e1b1b2d0c654198e6a5ab59b0268e59d6ca5f9abffd0a80669c3b1f2f0cd527ea31fabed81f3d4af0e9e
SSDEEP 393216:C49M5vSexRxM0b4Fj6xyE3gzv7dklsPx:k5aIRxM0ojEQF
TLSH
T156D62341E941817BD9B314B10CBE6A29C679BA39572450D7A3C4AF1C8F73AE27D3324B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

db:1c:d8:04:47:5b:d0:26:12:8d:85:d8:f4:af:1a:19:42:24:0b:be:2c:e1:be:11:1d:a3:3e:94:25:63:20:73

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Chains

Jun 6, 2019

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

92:cd:8c:ff:ba:cc:ba:d1:ed:74:cc:28:cd:64:7b:38:fe:75:e7:f3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Chains

Jun 6, 2019

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Serial Number

07:8f:d1:48:0a:d2:92:72:fb:1f:57:61:4e:67:02:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2017 - Oct 1, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Serial Number

34:cb:7f:a7:1d:10:18:43:27:bd:00:97:c4:b3:0a:c0

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2017 - Oct 1, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

881951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TryEnterCriticalSection FreeConsole SystemTimeToTzSpecificLocalTime SetLastError FileTimeToSystemTime GetSystemTimeAsFileTime VerSetConditionMask VerifyVersionInfoW GetCurrentThread UnmapViewOfFile CreateFileMappingW MapViewOfFile GetSystemDefaultLCID lstrcatW GetLocalTime LoadLibraryExW FreeLibrary InterlockedDecrement InterlockedIncrement lstrlenW GetCurrentThreadId FlushInstructionCache DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection WinExec RaiseException GetCurrentProcess GetModuleHandleW GetSystemInfo SetEndOfFile SetFilePointerEx SetFileAttributesW SetFileTime lstrcpynW Sleep FindNextFileW RemoveDirectoryW GetDriveTypeW LoadLibraryW GetProcAddress GetModuleHandleExW FindFirstFileW FindClose GetFullPathNameW GetDiskFreeSpaceExW CreateThread GetShortPathNameW lstrcmpiW GetTempPathA FindResourceA DeleteFileA CreateFileA WriteFile GetFileAttributesW AreFileApisANSI FindResourceExW FindResourceW LoadResource LockResource SizeofResource ReleaseMutex CreateMutexW FormatMessageW LocalFree GetWindowsDirectoryW GlobalLock GlobalUnlock GetVersionExW lstrcpyW CreateFileW GetFileSize ReadFile GetModuleFileNameW GetTempPathW DeleteFileW MoveFileExW CopyFileW OpenProcess GlobalAlloc GlobalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLastError WaitForSingleObject GetExitCodeProcess SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoW WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCurrentDirectoryA GetFullPathNameA SetStdHandle InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleHandleA FlushFileBuffers GetStartupInfoA SetHandleCount HeapCreate GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID CreateProcessW CloseHandle GetTickCount WideCharToMultiByte GetDateFormatA GetTimeFormatA MultiByteToWideChar CreateDirectoryW GetTimeZoneInformation GetConsoleMode GetConsoleCP TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP FindFirstFileA GetDriveTypeA GetFileInformationByHandle FileTimeToLocalFileTime ExitThread GetCPInfo LCMapStringW LCMapStringA GetStartupInfoW VirtualQuery RtlUnwind IsDebuggerPresent UnhandledExceptionFilter MoveFileW GetStdHandle WaitForMultipleObjects PeekNamedPipe FormatMessageA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedCompareExchange LoadLibraryA IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedExchange GetModuleFileNameA lstrcmpiA TerminateProcess GetNativeSystemInfo GetLogicalDriveStringsW QueryDosDeviceW ExpandEnvironmentStringsA GetCurrentProcessId VirtualProtect WriteProcessMemory SetUnhandledExceptionFilter DeviceIoControl GetVolumeInformationW GetFileTime GetCurrentDirectoryW GetACP FreeResource ExitProcess SetFilePointer GetFileType DuplicateHandle SystemTimeToFileTime DosDateTimeToFileTime MulDiv VerifyVersionInfoA SleepEx

user32

PostQuitMessage GetSystemMetrics GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos SendMessageW IsDlgButtonChecked GetWindowRect GetDesktopWindow FindWindowW SystemParametersInfoW CharLowerBuffW CloseClipboard UnregisterClassA CheckDlgButton GetCursorPos LoadCursorW RegisterClassExW CreateWindowExW MoveWindow GetWindowRgn ReleaseDC GetDC MonitorFromWindow ScreenToClient InvalidateRect IsRectEmpty GetUpdateRect DispatchMessageW TranslateMessage GetMessageW GetFocus IsWindow SetCapture ReleaseCapture PtInRect RegisterClassW GetClassInfoExW GetPropW SetPropW OffsetRect InflateRect SetCursor IntersectRect IsIconic IsZoomed SetWindowRgn CreateCaret HideCaret ShowCaret SetCaretPos ClientToScreen GetSysColor GetCaretPos FillRect DrawTextW CharPrevW SetRect InvalidateRgn CreateAcceleratorTableW SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowLongW SetClipboardData EmptyClipboard GetWindow LoadImageW GetKeyState GetParent GetWindowLongW DestroyWindow OpenClipboard GetClipboardData GetDlgItem MessageBoxA ModifyMenuA SetWindowTextA CallWindowProcW EndPaint BeginPaint GetDlgCtrlID CharNextW DefWindowProcW LoadBitmapW PostMessageW MessageBoxW SetDlgItemTextW GetDlgItemTextW SetFocus EnableWindow KillTimer SetTimer ShowWindow wsprintfW EndDialog

gdi32

SetStretchBltMode DeleteDC SetBkMode GetStockObject GetObjectW DeleteObject CreateFontIndirectW ExtSelectClipRgn CreateRectRgnIndirect GetClipBox CombineRgn ExtTextOutW SetBkColor CreateSolidBrush LineTo MoveToEx CreateCompatibleDC RoundRect SetTextColor TextOutW GetTextExtentPoint32W GetCharABCWidthsW GetObjectA SelectObject CreateRoundRectRgn GetTextMetricsW CreateCompatibleBitmap SaveDC BitBlt RestoreDC SetWindowOrgEx CreatePen StretchBlt Rectangle CreateDIBSection GetDeviceCaps CreatePenIndirect PtInRegion CreateRectRgn SelectClipRgn

advapi32

CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptDestroyKey CryptEncrypt CryptImportKey CryptReleaseContext RegDeleteValueA RegOpenKeyA RegQueryValueExA RegOpenCurrentUser RegCloseKey RegQueryValueExW ConvertSidToStringSidW GetUserNameW GetNamedSecurityInfoW GetAclInformation GetAce GetTokenInformation GetSidLengthRequired InitializeSid GetSidSubAuthority SetNamedSecurityInfoW InitializeAcl AddAce EqualSid CopySid IsValidSid GetLengthSid OpenThreadToken RegEnumKeyExA RegCreateKeyW RegDeleteKeyA RegSetValueExA RegEnumValueW RegFlushKey RegOpenKeyExA AllocateAndInitializeSid CheckTokenMembership FreeSid RegEnumKeyExW RegQueryInfoKeyW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW RegOpenKeyW CreateProcessAsUserW RegCreateKeyExA RegSetValueExW OpenProcessToken InitializeSecurityDescriptor SetSecurityDescriptorDacl DuplicateTokenEx RegOpenKeyExW CryptGenRandom

shell32

SHFileOperationW ShellExecuteExA SHCreateDirectoryExA ShellExecuteA SHGetSpecialFolderPathA SHGetSpecialFolderPathW ord165 SHGetFolderPathW SHBrowseForFolderW SHGetPathFromIDListW ord75 ShellExecuteW ShellExecuteExW SHGetSpecialFolderLocation

ole32

CLSIDFromString CLSIDFromProgID OleLockRunning CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoCreateInstance CoUninitialize CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

SysAllocString VariantClear VariantInit SysFreeString VarUI4FromStr

shlwapi

PathCombineW StrStrIA StrIsIntlEqualW PathFileExistsW StrCatW SHDeleteKeyW StrStrW PathFindExtensionA PathFindFileNameA PathRemoveFileSpecA PathFindExtensionW SHAutoComplete PathRemoveBackslashW PathAppendW PathFindFileNameW PathAppendA PathFileExistsA PathAddBackslashW PathStripPathW

comctl32

_TrackMouseEvent InitCommonControlsEx DestroyPropertySheetPage CreatePropertySheetPageW ord17

userenv

UnloadUserProfile

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

ws2_32

socket closesocket freeaddrinfo getaddrinfo sendto recvfrom accept listen ioctlsocket getpeername getsockopt htons bind ntohs getsockname setsockopt WSAIoctl send recv select WSAGetLastError __WSAFDIsSet WSASetLastError WSAStartup WSACleanup connect gethostname htonl ntohl

gdiplus

GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipFree GdipCloneBrush GdipAlloc GdipCreateFromHDC GdipSetTextRenderingHint GdipCreateStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipCreateLineBrushI GdipDrawString GdipDeleteBrush GdipDeleteStringFormat GdipDeleteGraphics GdipDeleteFont GdiplusShutdown GdiplusStartup

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

wldap32

ord79 ord35 ord33 ord200 ord30 ord26 ord50 ord60 ord301 ord27 ord41 ord32 ord22 ord211 ord143 ord46

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_663a642664cc71f671f920f96724c855_darkgate_elex_rhadamanthys_stop

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

userenv

iphlpapi

psapi

ws2_32

gdiplus

imm32

wldap32

generic