2026-09-07_7b8716018c5803230efbc77eef8726be_darkgate_elex_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_7b8716018c5803230efbc77eef8726be_darkgate_elex_mafia
Size 1.4MB
Sample260908-2dtxmsysgy
SHA256 6d13909799ecff3f3530908e832bc7059dd401d779af73876582494abaace478
MD5 7b8716018c5803230efbc77eef8726be
SHA1 677a3c96d6ba577810581d3393f5880b6b7c3e0d
SHA512 62a5696e44ed8f8e9f49fbd3899c215b7dce82294eed4618390b0c9d6ad61a7e230e64411555074dc09d9b0a52687910038cd1b6c4975445b0f4083062c130b5
SSDEEP 24576:dHk3zGcI8CB6ulnQ/tbw/2Mkjy6Fr7g0ox:5k3zdVwpQ/lFTjN4
TLSH
T1F16502203B62C436F95701768E69CB6A663EAF100F6752C7B3D42A3D9EB42D25B34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_7b8716018c5803230efbc77eef8726be_darkgate_elex_mafia

File Explorer

2026-09-07_7b8716018c5803230efbc77eef8726be_darkgate_elex_mafia

.exe 1.4MB

2026-09-07_7b8716018c5803230efbc77eef8726be_darkgate_elex_mafia

IMPHASH f684a2e66505dcb3ac45b09f62d44a3f
SHA256 6d13909799ecff3f3530908e832bc7059dd401d779af73876582494abaace478
MD5 7b8716018c5803230efbc77eef8726be
SHA1 677a3c96d6ba577810581d3393f5880b6b7c3e0d
SHA512 62a5696e44ed8f8e9f49fbd3899c215b7dce82294eed4618390b0c9d6ad61a7e230e64411555074dc09d9b0a52687910038cd1b6c4975445b0f4083062c130b5
SSDEEP 24576:dHk3zGcI8CB6ulnQ/tbw/2Mkjy6Fr7g0ox:5k3zdVwpQ/lFTjN4
TLSH
T1F16502203B62C436F95701768E69CB6A663EAF100F6752C7B3D42A3D9EB42D25B34347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

121443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cc-repo\dev_fm_prozen_me80\AMT_Development\SW\Src\Apps\PAVP\PAVP30\IntelCpHeciSvc\Release\IntelCpHeciSvc.pdb

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW

kernel32

CreateThread ReadFile GetOverlappedResult WriteFile DeviceIoControl CreateFileW Sleep GetCurrentProcess GetCurrentThread LocalFree GetCommandLineW WriteConsoleW LoadLibraryW ResumeThread IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID IsValidCodePage GetOEMCP GetACP GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc HeapSize WaitForMultipleObjects WaitForSingleObject SetEvent LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary GetModuleFileNameW lstrcmpiW InterlockedDecrement InterlockedIncrement GetModuleHandleW GetProcAddress InitializeCriticalSectionAndSpinCount RaiseException lstrlenW CloseHandle CreateEventW OpenProcess GetLastError GetCurrentThreadId ExpandEnvironmentStringsW DeleteCriticalSection InitializeCriticalSection QueryPerformanceFrequency QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection SetStdHandle GetProcessHeap SetEndOfFile SetFilePointer FlushFileBuffers GetConsoleMode GetConsoleCP ExitProcess GetFileType SetHandleCount GetLocaleInfoW GetStdHandle SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc HeapCreate IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess LCMapStringW GetStartupInfoW HeapSetInformation ExitThread HeapAlloc GetCPInfo RtlUnwind HeapFree DecodePointer EncodePointer InterlockedExchange InterlockedCompareExchange GetStringTypeW WideCharToMultiByte

user32

GetMessageA RegisterDeviceNotificationW UnregisterDeviceNotification PostThreadMessageW LoadStringW TranslateMessage DispatchMessageW GetMessageW CharUpperW MessageBoxW RegisterWindowMessageW DispatchMessageA IsWindowUnicode MsgWaitForMultipleObjectsEx PeekMessageW CharNextW

advapi32

RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW QueryServiceConfigW ChangeServiceConfigW RegOpenKeyW OpenThreadToken OpenProcessToken ControlService DeleteService CreateServiceW GetTokenInformation SetSecurityDescriptorGroup SetSecurityDescriptorOwner InitializeSecurityDescriptor IsValidSid GetLengthSid CopySid RegQueryValueExW OpenSCManagerW OpenServiceW SetServiceStatus CloseServiceHandle GetSecurityDescriptorLength RegQueryValueExA RegSetValueExA ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW

ole32

CoAddRefServerProcess CoTaskMemRealloc CoTaskMemFree CoInitializeEx CoUninitialize CoRevokeClassObject CoRegisterClassObject CoReleaseServerProcess CoInitialize StringFromGUID2 CoCreateInstance CoGetInterfaceAndReleaseStream CoTaskMemAlloc CoInitializeSecurity CoResumeClassObjects CoMarshalInterThreadInterfaceInStream

oleaut32

RegisterTypeLi UnRegisterTypeLi SysAllocString SafeArrayRedim SafeArrayDestroy SafeArrayCreate SafeArrayCopy SafeArrayGetLBound VariantClear VariantInit SafeArrayUnlock SafeArrayLock SafeArrayGetUBound SafeArrayGetVartype LoadTypeLi LoadRegTypeLi VarUI4FromStr SysStringLen SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_7b8716018c5803230efbc77eef8726be_darkgate_elex_mafia

setupapi

kernel32

user32

advapi32

ole32

oleaut32

generic