2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee
Size 270KB
Sample260813-t4ftpscb47
SHA256 238fb83c5e4672820ed948ec8d8ac62cef7f02ecce78f56e82bc93ea606baa38
MD5 9b9ac620f02f6e64049b4f5c4dadd326
SHA1 30e2cd389d5d90286c9891fe21cc61e9db0ecd0e
SHA512 6e7813d7fedb842d0eb65c9de94422fbb6675e76f3874e1cc29248f84ad92c582379b92951a0ff36a15e811a2ccb571c7385dc0ba86cca2907224a93c2abac6c
SSDEEP 6144:E5mMt3GNTAI8gqeD+A6ra5LhocaDOWR+BV+UdvrEFp7hKbig:wIN/84+A6ra5lRWABjvrEH7a5
TLSH
T110449E213190C3FAD1A3163075F8A6B59DF9B83D4B7A51DBA7A4076D4F2C6E2872430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee

File Explorer

2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee

.exe 270KB

2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee

IMPHASH 95aca322b1d428c2f628fd431dc5dc52
SHA256 238fb83c5e4672820ed948ec8d8ac62cef7f02ecce78f56e82bc93ea606baa38
MD5 9b9ac620f02f6e64049b4f5c4dadd326
SHA1 30e2cd389d5d90286c9891fe21cc61e9db0ecd0e
SHA512 6e7813d7fedb842d0eb65c9de94422fbb6675e76f3874e1cc29248f84ad92c582379b92951a0ff36a15e811a2ccb571c7385dc0ba86cca2907224a93c2abac6c
SSDEEP 6144:E5mMt3GNTAI8gqeD+A6ra5LhocaDOWR+BV+UdvrEFp7hKbig:wIN/84+A6ra5lRWABjvrEH7a5
TLSH
T110449E213190C3FAD1A3163075F8A6B59DF9B83D4B7A51DBA7A4076D4F2C6E2872430B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a0:68:89:54:a8:0e:42:5e:fc:fe:2a:35:09:9e:fe:f9:b6:74:c4:7d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Hewlett Packard,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop Consumer Solutions,O=Hewlett Packard,L=San Diego,ST=California,C=US

Chains

Oct 21, 2012

CN=Hewlett Packard,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop Consumer Solutions,O=Hewlett Packard,L=San Diego,ST=California,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Hewlett Packard,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop Consumer Solutions,O=Hewlett Packard,L=San Diego,ST=California,C=US

Serial Number

44:23:9c:21:87:ef:ae:7b:a9:f3:cd:89:c4:fe:9d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 27, 2012 - Sep 3, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

43954

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\jnks\workspace\K9_Prod_Active_Build\build971\SxS\src\Release\hpUrlLauncher.pdb

user32

GetKeyState SendMessageCallbackW GetMessageW SetTimer RegisterWindowMessageW DestroyIcon LoadIconW MsgWaitForMultipleObjectsEx WaitForInputIdle GetAsyncKeyState OpenWindowStationW CloseWindowStation GetProcessWindowStation SetProcessWindowStation GetThreadDesktop SetThreadDesktop OpenDesktopW CloseDesktop ExitWindowsEx AllowSetForegroundWindow PeekMessageW MsgWaitForMultipleObjects GetSystemMetrics SystemParametersInfoW wsprintfW

shlwapi

PathIsFileSpecW PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW

psapi

GetModuleFileNameExW EnumProcesses EnumProcessModules GetModuleBaseNameW

kernel32

MultiByteToWideChar EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetTickCount CreateFileW Sleep SetFilePointer WriteFile CloseHandle OutputDebugStringW GetCurrentThreadId QueryPerformanceCounter OpenProcess GetFileAttributesExW GetCommandLineW GetTempFileNameW GetLongPathNameW SearchPathW FormatMessageW LocalFree CreateMutexW WaitForSingleObject CreateFileMappingW MapViewOfFile ReleaseMutex UnmapViewOfFile SetLastError LoadLibraryW GetProcAddress FreeLibrary QueryPerformanceFrequency InterlockedIncrement InterlockedDecrement WideCharToMultiByte InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer HeapSetInformation GetStartupInfoW HeapFree GetSystemTimeAsFileTime GetTimeFormatW GetDateFormatW RaiseException RtlUnwind HeapAlloc LCMapStringW GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapSize GetModuleHandleW ExitProcess IsProcessorFeaturePresent GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree HeapCreate GetTimeZoneInformation GetACP GetOEMCP IsValidCodePage GetLocaleInfoW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile WriteConsoleW SetStdHandle CompareStringW SetEnvironmentVariableA GetCurrentProcessId InitializeCriticalSection ExpandEnvironmentStringsW GetModuleFileNameW GetLastError FindResourceW GlobalFree GlobalUnlock GlobalLock ProcessIdToSessionId GlobalAlloc LocalAlloc GetUserDefaultLangID SetCurrentDirectoryW GetCurrentDirectoryW GetComputerNameExW DeleteFileW FindClose ExitThread SetFileAttributesW CopyFileW MoveFileExW FindNextFileW FindFirstFileW GetSystemDefaultUILanguage GetSystemDefaultLCID FlushViewOfFile OpenFileMappingW GetSystemDirectoryW DeviceIoControl GetFileTime SizeofResource LockResource LoadResource GetVersionExW CreateProcessW GetTempPathW GetDiskFreeSpaceExW CreateThread GetExitCodeThread GetExitCodeProcess TerminateThread CreateEventW OpenEventW ResetEvent SetEvent GetLocalTime GetSystemTime GetFileAttributesW OpenMutexW CreateDirectoryW GetShortPathNameW GetFileSizeEx PeekNamedPipe GetEnvironmentVariableW TryEnterCriticalSection WaitForMultipleObjects CreatePipe GlobalMemoryStatusEx FindResourceExW

advapi32

RegCloseKey CheckTokenMembership OpenProcessToken RegQueryInfoKeyW RegEnumValueW RegDeleteValueW RegSetValueExW RegDeleteKeyW RegQueryValueExW RegCreateKeyExW GetUserNameW RegOpenKeyExW RegEnumKeyExW

shell32

SHGetSpecialFolderPathW ExtractIconW ShellExecuteExW SHGetFolderPathW ShellExecuteW

ole32

CoUninitialize CoCreateInstance CoInitialize CLSIDFromString

oleaut32

SysFreeString SysAllocString

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

secur32

GetUserNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee

PE Signature issue

user32

shlwapi

psapi

kernel32

advapi32

shell32

ole32

oleaut32

version

secur32

generic