2026-08-10_66d5d50a6b724835dba179f4e505bb7d_bkransomware_darkgate_elex_maze_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_66d5d50a6b724835dba179f4e505bb7d_bkransomware_darkgate_elex_maze_remcos
Size 2.7MB
Sample260810-a949psgm2v
SHA256 ea5f8b868c729a7b0b90c638feeb9318c1d7f1efb85d9eb66c2053d3fb4d554f
MD5 66d5d50a6b724835dba179f4e505bb7d
SHA1 417452680dfacebc207f4cce5041a4e5368bc46d
SHA512 436ef81e31d3607836910b50fdac5f72a6e1c9b588648fbc084b7c8b17cb848cd66a65820571ac4cae3a6e7bc7e440ca6e319c5bdc1d1f155fbe4865b52d8e10
SSDEEP 49152:KawM+dQEn9o8BLAzjj6cPthutI0zykeTYTBzw+:NwME9TVcPoI0zykecT
TLSH
T139D55B1CE2C7E87BD9E4107CD1A877DA9628243C436579E369E4E6A15CE0CE32D37E06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_66d5d50a6b724835dba179f4e505bb7d_bkransomware_darkgate_elex_maze_remcos

File Explorer

2026-08-10_66d5d50a6b724835dba179f4e505bb7d_bkransomware_darkgate_elex_maze_remcos

.exe 2.7MB

2026-08-10_66d5d50a6b724835dba179f4e505bb7d_bkransomware_darkgate_elex_maze_remcos

IMPHASH 274bacea78addc501fd4c217d44e284c
SHA256 ea5f8b868c729a7b0b90c638feeb9318c1d7f1efb85d9eb66c2053d3fb4d554f
MD5 66d5d50a6b724835dba179f4e505bb7d
SHA1 417452680dfacebc207f4cce5041a4e5368bc46d
SHA512 436ef81e31d3607836910b50fdac5f72a6e1c9b588648fbc084b7c8b17cb848cd66a65820571ac4cae3a6e7bc7e440ca6e319c5bdc1d1f155fbe4865b52d8e10
SSDEEP 49152:KawM+dQEn9o8BLAzjj6cPthutI0zykeTYTBzw+:NwME9TVcPoI0zykecT
TLSH
T139D55B1CE2C7E87BD9E4107CD1A877DA9628243C436579E369E4E6A15CE0CE32D37E06
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2039057

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

waveInClose waveInUnprepareHeader waveInReset waveInStop waveInGetPosition mciSendCommandA mciGetErrorStringA auxGetNumDevs auxGetDevCapsA mixerGetNumDevs waveOutSetVolume waveOutGetPosition waveOutClose waveOutUnprepareHeader waveOutReset midiOutClose midiOutReset mixerOpen mixerGetDevCapsA mixerGetLineInfoA mixerGetLineControlsA mixerGetControlDetailsA mixerClose auxGetVolume auxSetVolume mixerSetControlDetails timeGetTime

comctl32

ord6 ord17

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

dsound

ord1

kernel32

InterlockedPushEntrySList InitializeSListHead InterlockedPopEntrySList FormatMessageA LocalFree LoadLibraryA GetProcAddress GetLastError FreeLibrary GlobalUnlock GlobalFree GetLocalTime GlobalLock WideCharToMultiByte FindFirstFileA FindClose GetPrivateProfileIntA GetDriveTypeA GetModuleFileNameA Sleep FindNextFileA CloseHandle GlobalAlloc GlobalReAlloc CreateSemaphoreA WaitForSingleObject ReleaseSemaphore MultiByteToWideChar lstrcpyA ExitThread CreateThread CreateDirectoryA SetErrorMode CompareFileTime SystemTimeToFileTime LocalFileTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime CreateFileA GetFileTime SetFileTime DeleteFileA MoveFileA GetFileAttributesA SetFileAttributesA GetFileSize ReadFile SetFilePointer WriteFile GetVersionExA CreateProcessA lstrlenA TerminateThread GetExitCodeThread RaiseException InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection DeleteCriticalSection DecodePointer GetCurrentThreadId FlushInstructionCache GetCurrentProcess lstrcmpA MulDiv SetLastError FindResourceA LoadResource InterlockedIncrement InterlockedDecrement SizeofResource IsDBCSLeadByte lstrcmpiA GetModuleHandleA LoadLibraryExA GetCurrentDirectoryA IsDebuggerPresent IsProcessorFeaturePresent HeapFree HeapAlloc GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery EncodePointer GetCommandLineA HeapReAlloc ExitProcess GetModuleHandleExW AreFileApisANSI UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType RtlUnwind GetProcessHeap GetModuleFileNameW HeapSize IsValidCodePage GetACP GetOEMCP GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetConsoleCP LoadLibraryExW FlushFileBuffers OutputDebugStringW GetStringTypeW LCMapStringW WriteConsoleW CreateFileW SetEndOfFile VirtualFree

user32

GetDC ReleaseDC GetSystemMetrics SetWindowPos IsIconic ScreenToClient GetActiveWindow PeekMessageA GetMessageA TranslateMessage DispatchMessageA AppendMenuA CreatePopupMenu TrackPopupMenu DestroyMenu GetMenu EnableMenuItem GetSubMenu GetMenuItemCount DeleteMenu ModifyMenuA GetClientRect ClientToScreen ClipCursor GetClipCursor LoadCursorA GetCursor SetCursor CreateIconIndirect SetCursorPos SetWindowTextA ShowWindow MoveWindow GetDlgItem SendDlgItemMessageA EnableWindow EndDialog DialogBoxParamA GetMenuStringA FillRect GetSysColorBrush wsprintfA WaitForInputIdle GetClassNameA EnumWindows GetWindowTextA OpenClipboard DestroyIcon SetClipboardData CloseClipboard SetForegroundWindow GetMenuItemRect AdjustWindowRect EnumDisplaySettingsA ChangeDisplaySettingsA UpdateWindow LoadMenuA SetMenu ShowCursor GetKeyState SendIMEMessageExA WINNLSEnableIME SystemParametersInfoA DrawMenuBar SetTimer DefWindowProcA LoadIconA RegisterClassExA CharNextA UnregisterClassA GetWindowTextLengthA InvalidateRgn RedrawWindow SetCapture GetWindow IsChild GetParent IsWindow GetClassInfoExA GetSysColor DestroyAcceleratorTable GetDesktopWindow CreateAcceleratorTableA ReleaseCapture RegisterWindowMessageA SetClassLongA IsDialogMessageA WaitMessage PostQuitMessage SetDlgItemInt GetDlgItemInt CreateDialogParamA KillTimer InvertRect LoadImageA PostMessageA GetDlgItemTextA SetDlgItemTextA DestroyWindow GetWindowRect GetCursorPos GetWindowLongA SetWindowLongA CreateWindowExA CallWindowProcA GetFocus SendMessageA SetFocus GetAsyncKeyState GetDlgCtrlID EndPaint BeginPaint InvalidateRect EmptyClipboard MessageBoxA

gdi32

SetBkColor SetTextColor CreateSolidBrush DeleteObject AddFontResourceExA CreateDIBitmap CreateBitmap CreateCompatibleDC CreateDIBSection SelectObject BitBlt DeleteDC CreateFontA GetTextMetricsA GetGlyphOutlineA GetDeviceCaps EnumFontFamiliesExA TextOutA SetBkMode SetStretchBltMode GetStockObject CreateCompatibleBitmap GetObjectA SetDIBitsToDevice StretchDIBits

advapi32

RegCreateKeyExA RegQueryInfoKeyW GetUserNameA RegDeleteKeyA RegEnumKeyExA RegDeleteValueA RegQueryValueExA RegOpenKeyExA RegCloseKey RegCreateKeyA RegSetValueExA

shell32

DragQueryFileA SHGetSpecialFolderPathA ShellExecuteExA DragFinish

ole32

OleLockRunning CoGetClassObject CLSIDFromProgID CreateStreamOnHGlobal StringFromGUID2 CoTaskMemAlloc CoCreateInstance CoTaskMemFree CoInitialize CoTaskMemRealloc CoUninitialize OleUninitialize CLSIDFromString OleInitialize

oleaut32

VarUI4FromStr OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VariantClear VariantInit SysStringLen SysAllocString SysFreeString SysAllocStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_66d5d50a6b724835dba179f4e505bb7d_bkransomware_darkgate_elex_maze_remcos

winmm

comctl32

version

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic