2026-09-01_744eabc80252e882c985774f292c529d_darkgate_elex_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-01_744eabc80252e882c985774f292c529d_darkgate_elex_maze
Size 315KB
Sample260903-lsb3dazybx
SHA256 6bef2a7bef21ef7ddd580769e139ddbe7b5765f1d5af50fa25fb91c7a25de071
MD5 744eabc80252e882c985774f292c529d
SHA1 e32ab8f7446e3d4604b9606f21cc8c7601934a34
SHA512 4ebcf89b19d8e984c413f532db467d3ef62cfc4f58ddf3a0f51965f1228aaf06a70c80e9adb28d28f4ea6fb1b3ce545ed4d5057f7f4339cc90607d6ef46093e9
SSDEEP 6144:MN0ABzcOZqCEbOb/obrrpAO7AOMDh8Zfy8WrS:/A5/Vb/6XptOFKy8WrS
TLSH
T1A0645B01B6E1A032E5F316315AB99BA64C7E79315F3580EFB3901A0E5C707C2AA35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-01_744eabc80252e882c985774f292c529d_darkgate_elex_maze

.exe 315KB

2026-09-01_744eabc80252e882c985774f292c529d_darkgate_elex_maze

IMPHASH 8079b2e9dca176116b520aeedcce3eb6
SHA256 6bef2a7bef21ef7ddd580769e139ddbe7b5765f1d5af50fa25fb91c7a25de071
MD5 744eabc80252e882c985774f292c529d
SHA1 e32ab8f7446e3d4604b9606f21cc8c7601934a34
SHA512 4ebcf89b19d8e984c413f532db467d3ef62cfc4f58ddf3a0f51965f1228aaf06a70c80e9adb28d28f4ea6fb1b3ce545ed4d5057f7f4339cc90607d6ef46093e9
SSDEEP 6144:MN0ABzcOZqCEbOb/obrrpAO7AOMDh8Zfy8WrS:/A5/Vb/6XptOFKy8WrS
TLSH
T1A0645B01B6E1A032E5F316315AB99BA64C7E79315F3580EFB3901A0E5C707C2AA35B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

c2:70:84:5c:50:5a:6a:90:fe:2b:22:24:bb:9d:97:f4:09:24:38:cd:e1:b8:af:bd:1e:2b:aa:75:6b:73:1f:7d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES

Chains

Aug 4, 2026

CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,C=ES

Serial Number

01:44:e5:1c:11:d9:c2:9d:6c:f7:65:c5:89:27:19:ad

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2024 - Nov 14, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

112410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Builds\100\Aether\AetherAgent-1.25.13\bin\PavGenUn.pdb

gdi32

CreateSolidBrush

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

kernel32

SizeofResource LockResource LoadResource FindResourceW FindResourceExW OpenProcess TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW Sleep CreateProcessW CreateThread GetProfileStringW WriteProfileStringW GetWindowsDirectoryW SetFileAttributesW DeleteFileW GetEnvironmentVariableW CopyFileW GetPrivateProfileIntW WTSGetActiveConsoleSessionId InitializeCriticalSectionAndSpinCount RaiseException DecodePointer DeleteCriticalSection lstrcpyW lstrcmpiW RemoveDirectoryW GetExitCodeProcess GetCurrentProcessId GetFileAttributesW ExitThread LoadLibraryExW lstrcatW TerminateThread SetEvent GetCurrentThreadId GetSystemTimeAsFileTime IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection GetProcessHeap SetStdHandle SetFilePointerEx InitializeSListHead GetThreadTimes FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetFileType GetConsoleMode GetConsoleCP GetStdHandle GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW GetCurrentThread GetStringTypeW GetCPInfo GetOEMCP IsValidCodePage WideCharToMultiByte ReadConsoleW GetModuleHandleExW ExitProcess HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy SetDllDirectoryW GetPrivateProfileStringW GetCommandLineW WritePrivateProfileStringW GetSystemDirectoryW FindNextFileW WaitForSingleObject LocalAlloc FreeLibrary LoadLibraryW GetVersionExW SetLastError WriteFile CloseHandle CreateFileW GetLocalTime FindFirstFileW FindClose lstrlenW GetCurrentProcess GetProcAddress GetModuleHandleW GetLastError GetModuleFileNameW LocalFree WriteConsoleW SetEndOfFile ReadFile FlushFileBuffers TlsFree TlsSetValue TlsGetValue TlsAlloc GetFileAttributesExW EncodePointer MultiByteToWideChar GetACP IsProcessorFeaturePresent MoveFileExW RtlUnwind

user32

DdeInitializeW DdeUninitialize DdeCreateStringHandleW DdeConnect DdeClientTransaction PeekMessageW SendMessageTimeoutW DispatchMessageW TranslateMessage GetMessageW ShowWindow CreateWindowExW RegisterClassW DefWindowProcW DestroyWindow IsWindow ExitWindowsEx GetWindow SendMessageCallbackW SetActiveWindow IsWindowEnabled EnumWindows EnumChildWindows GetClassNameW PostThreadMessageW SendMessageW GetWindowThreadProcessId GetWindowTextW MessageBoxW MessageBeep LoadStringW CharUpperW DdeFreeDataHandle DdeGetData DdeFreeStringHandle DdeDisconnect DdeGetLastError

advapi32

RegQueryValueExW RegCloseKey RegEnumValueW RegQueryInfoKeyW RegDeleteKeyExW RegDeleteKeyW RegCreateKeyExW DeleteService StartServiceW CloseServiceHandle ControlService QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW CreateRestrictedToken RegEnumKeyExW DuplicateTokenEx RegCreateKeyW RegSetValueExW RegDeleteValueW RevertToSelf AdjustTokenPrivileges LookupPrivilegeValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle TraceEvent OpenProcessToken CreateProcessAsUserW ImpersonateLoggedOnUser RegOpenKeyExW

ole32

CoCreateInstance CoInitialize OleUninitialize CoUninitialize OleInitialize

shell32

ShellExecuteW SHGetFolderPathW

oleaut32

SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_744eabc80252e882c985774f292c529d_darkgate_elex_maze

gdi32

wtsapi32

kernel32

user32

advapi32

ole32

shell32

oleaut32

generic