2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc
Size 1.3MB
Sample260808-dmmb6abd49
SHA256 07b4317a455124ad852125bf82a60f5e30b78ed190273f2cd33609e2fd2b09ba
MD5 93809fe3b4fb1d637cb4fd9420056f46
SHA1 e2c28b3671909a9e32c36c5e18513d01ee98a5b3
SHA512 5acf8ee10689a2cc5d76c7fb6164d971937646d350f893b5d74acbe118f8630d701c70df2c656951a6e3699d4f3c12b4ad3cfddf3b88055af84687de99fd7714
SSDEEP 24576:W6zFhBykJfB+tn7IMwKpLKy0TduSZpUR0GHrVQ1aW4mSOgv3isi:fjykWt7IMwKMykpAHrVQ1/fSNvi
TLSH
T1F255E025FAE1C839E66282B90DF4F739403D5A601F3909C7A7D45A4E6D30AC33EB6D46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc

File Explorer

2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc

.exe 1.3MB

2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc

IMPHASH 486258d87dc1b6ace4fba0ba3c97b10d
SHA256 07b4317a455124ad852125bf82a60f5e30b78ed190273f2cd33609e2fd2b09ba
MD5 93809fe3b4fb1d637cb4fd9420056f46
SHA1 e2c28b3671909a9e32c36c5e18513d01ee98a5b3
SHA512 5acf8ee10689a2cc5d76c7fb6164d971937646d350f893b5d74acbe118f8630d701c70df2c656951a6e3699d4f3c12b4ad3cfddf3b88055af84687de99fd7714
SSDEEP 24576:W6zFhBykJfB+tn7IMwKpLKy0TduSZpUR0GHrVQ1aW4mSOgv3isi:fjykWt7IMwKMykpAHrVQ1/fSNvi
TLSH
T1F255E025FAE1C839E66282B90DF4F739403D5A601F3909C7A7D45A4E6D30AC33EB6D46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

230817

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Q:\dev\WebHelper-code\webplugins-master\esnlaunch\Release\BFHWebHelper.pdb

kernel32

CreateFileA GetLastError SetEvent WriteFile ReadFile GetOverlappedResult ResetEvent CreateEventW CloseHandle TlsGetValue LeaveCriticalSection EnterCriticalSection PostQueuedCompletionStatus TlsAlloc TlsFree CreateMutexW AllocConsole SetWaitableTimer GetQueuedCompletionStatus VerSetConditionMask WaitForSingleObject InitializeCriticalSection MultiByteToWideChar OpenProcess TerminateThread InitializeCriticalSectionAndSpinCount GetConsoleWindow Sleep TerminateProcess VerifyVersionInfoW GetCurrentDirectoryW SetLastError QueueUserAPC Process32FirstW WaitForMultipleObjects Process32NextW CreateIoCompletionPort CreateMutexA CreateToolhelp32Snapshot DeleteCriticalSection ReleaseMutex GetCurrentProcessId CreateThread SleepEx LocalFree SetEndOfFile TlsSetValue WideCharToMultiByte ReadConsoleW CreateFileW WriteConsoleW SetStdHandle OutputDebugStringW SetEnvironmentVariableA FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP GetTimeZoneInformation HeapReAlloc FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameW FormatMessageA GetFileType GetStdHandle GetProcessHeap GetOEMCP GetACP GetStringTypeW EncodePointer DecodePointer SetConsoleCtrlHandler HeapFree GetSystemTimeAsFileTime HeapAlloc GetCPInfo GetCurrentThreadId ExitThread GetProcAddress LoadLibraryExW GetCommandLineW RaiseException RtlUnwind IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess GetStartupInfoW GetModuleHandleW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsDebuggerPresent ExitProcess GetModuleHandleExW AreFileApisANSI HeapSize IsValidCodePage

user32

MessageBoxW

shell32

ShellExecuteExW

ws2_32

listen ioctlsocket WSAStartup freeaddrinfo WSASend WSAGetLastError shutdown setsockopt WSACleanup WSASetLastError closesocket bind WSASocketW getaddrinfo WSARecv

mswsock

GetAcceptExSockaddrs AcceptEx

winhttp

WinHttpCrackUrl

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc

kernel32

user32

shell32

ws2_32

mswsock

winhttp

generic