2026-09-08_5a5125f5c7418786037b9ca768bbb09d_darkgate_elex_maze_remcos_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_5a5125f5c7418786037b9ca768bbb09d_darkgate_elex_maze_remcos_stealc
Size 894KB
Sample260908-vbftnser3z
SHA256 d49cd24513b2742708d8139a2093e4bffc9df3355bac352b6cb2952f12b06c29
MD5 5a5125f5c7418786037b9ca768bbb09d
SHA1 cadeb4e2a18f92ca4ac32222b8b3e065ce415067
SHA512 14ba3cdfa8ffdcf5fa686f0d496fd3792ff2d5acb82d0ea4ee3de282f40b0ca331652194eb880e2ce92933edc675be7c5a70b9cb9439168c547789fb57a3fb11
SSDEEP 24576:RckL1ESJf5QkXA+mEvB/cVvHtB5cfiY6:RPpEE/XA+mYB/c5tg6
TLSH
T143159D11B6C1C133E9B2027259BCAB7A507DF8310B3566C7F3E50B5D2A74AC26E3265B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-08_5a5125f5c7418786037b9ca768bbb09d_darkgate_elex_maze_remcos_stealc

.exe 894KB

2026-09-08_5a5125f5c7418786037b9ca768bbb09d_darkgate_elex_maze_remcos_stealc

IMPHASH 5a43d394d36e657d3a40a24d7def7e30
SHA256 d49cd24513b2742708d8139a2093e4bffc9df3355bac352b6cb2952f12b06c29
MD5 5a5125f5c7418786037b9ca768bbb09d
SHA1 cadeb4e2a18f92ca4ac32222b8b3e065ce415067
SHA512 14ba3cdfa8ffdcf5fa686f0d496fd3792ff2d5acb82d0ea4ee3de282f40b0ca331652194eb880e2ce92933edc675be7c5a70b9cb9439168c547789fb57a3fb11
SSDEEP 24576:RckL1ESJf5QkXA+mEvB/cVvHtB5cfiY6:RPpEE/XA+mYB/c5tg6
TLSH
T143159D11B6C1C133E9B2027259BCAB7A507DF8310B3566C7F3E50B5D2A74AC26E3265B
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

bf:7f:63:9e:0b:7a:69:30:4b:0c:09:fc:ef:39:65:fc:cc:33:95:4d:1c:24:e3:ce:25:ac:22:5c:53:00:b4:ff

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=9144030071526726XG,CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 12, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0b:ca:73:6e:dd:e7:f8:99:25:91:c3:07:6a:dc:fb:6e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2026 - Apr 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

484845

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\microgamebox_proj\src\MicroGameBox\bin\Release\PDB\QQMGameBoxUpdater.pdb

sentry

sentry_set_user sentry_options_set_auto_session_tracking sentry_value_new_string sentry_value_new_object sentry_options_set_release sentry_options_set_dsn sentry_options_new sentry_options_set_database_pathw sentry_options_set_sample_rate sentry_options_set_debug sentry_options_set_group_names sentry_options_set_symbolize_stacktraces sentry_init sentry_options_set_logger sentry_set_transaction sentry_options_set_environment sentry_remove_tag sentry_capture_event sentry_event_add_exception sentry_value_new_event sentry_value_new_exception sentry_set_tag sentry_value_set_by_key

kernel32

SetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetTickCount OutputDebugStringW WritePrivateProfileStringW GetTempPathW MultiByteToWideChar ReleaseMutex WaitForSingleObject Sleep CloseHandle CreateMutexW VerSetConditionMask InterlockedIncrement InterlockedExchange InterlockedCompareExchange GetProcAddress GlobalFree LocalAlloc LocalFree GetLongPathNameW OpenProcess TerminateProcess CreateThread GetCurrentThreadId ResumeThread EnterCriticalSection LeaveCriticalSection SetEvent WaitForMultipleObjects GetFileSizeEx WriteFile ReadFile SetEndOfFile SetFilePointerEx GetSystemInfo FormatMessageW MapViewOfFile UnmapViewOfFile WaitForMultipleObjectsEx CreateEventW OpenEventW CreateFileMappingW LoadLibraryW GetModuleFileNameW GetModuleHandleW GetModuleHandleExW CreateProcessW GetCommandLineW OutputDebugStringA GetPrivateProfileIntW GetFullPathNameW CreateFileW GetFileAttributesExW DeleteFileW MoveFileExW QueueUserWorkItem VerifyVersionInfoW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess GetProcessId SetErrorMode GetEnvironmentVariableW GetComputerNameExW GetNativeSystemInfo GetSystemDirectoryW GetLastError DecodePointer GetExitCodeThread GetPrivateProfileStringW LockResource GlobalAlloc GlobalLock GlobalUnlock LoadResource SizeofResource FindResourceW GetDriveTypeW CreateDirectoryW GetLogicalDrives GetFileAttributesW RemoveDirectoryW GetDiskFreeSpaceExW HeapFree GetProcessHeap HeapAlloc GetVersionExW FindFirstFileW SetEnvironmentVariableW GetEnvironmentVariableA FindClose SetEnvironmentVariableA HeapSetInformation FindNextFileW GetCurrentProcessId SetFileAttributesW CreateDirectoryA CreateFileA GetPrivateProfileStringA GetPrivateProfileIntA SetFilePointer GetFileSize SwitchToThread FreeLibrary DeviceIoControl EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LoadLibraryExW ExitThread IsProcessorFeaturePresent RtlUnwind HeapReAlloc EncodePointer GetSystemTimeAsFileTime GetStringTypeW IsDebuggerPresent GetExitCodeProcess RaiseException ExitProcess HeapSize GetStdHandle IsValidCodePage GetACP GetOEMCP GetFileType QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleMode ReadConsoleW GetConsoleCP FlushFileBuffers GetTimeZoneInformation SetStdHandle WriteConsoleW TerminateThread

user32

GetWindowLongW GetWindowRect GetClientRect TranslateMessage GetMessageW GetClassNameW EnumWindows FindWindowW LoadCursorW LoadIconW SystemParametersInfoW PostMessageW DefWindowProcW PostQuitMessage CreateWindowExW IsWindow DestroyWindow SetTimer KillTimer MessageBoxW SetWindowLongW GetForegroundWindow AllowSetForegroundWindow GetWindowThreadProcessId DispatchMessageW PeekMessageW MsgWaitForMultipleObjectsEx RegisterClassW ShowWindow UpdateLayeredWindow SetWindowPos IsWindowVisible IsIconic ReleaseDC GetDC UpdateWindow SetForegroundWindow

gdi32

SelectObject CreateDIBSection DeleteDC CreateCompatibleDC DeleteObject

advapi32

CheckTokenMembership LookupPrivilegeValueW FreeSid AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegNotifyChangeKeyValue RegEnumKeyExW RegCreateKeyExW RegCloseKey GetCurrentHwProfileW RegQueryValueExA RegOpenKeyExA SetSecurityInfo SetEntriesInAclW RegEnumKeyW RegDeleteKeyW

shell32

ShellExecuteExW ShellExecuteW SHGetFolderPathA SHCreateDirectoryExW SHGetSpecialFolderPathW ord165 CommandLineToArgvW

ole32

CoCreateGuid CreateStreamOnHGlobal

shlwapi

PathFindFileNameW PathAddExtensionW PathIsDirectoryEmptyW PathRemoveBackslashW SHRegSetPathW SHRegGetPathW SHSetValueW SHGetValueW PathAddBackslashW PathFileExistsW PathAppendW PathCanonicalizeW PathCombineW PathIsDirectoryW PathIsRelativeW PathMakePrettyW PathQuoteSpacesW PathRemoveFileSpecW SHDeleteKeyW

netapi32

Netbios

winhttp

WinHttpReadData WinHttpWriteData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpConnect WinHttpAddRequestHeaders WinHttpSendRequest WinHttpQueryHeaders WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpCrackUrl

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

iphlpapi

GetAdaptersAddresses

gdiplus

GdipGetGenericFontFamilySansSerif GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteFontFamily GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipFree GdipAlloc GdipCreateFontFamilyFromName GdipDrawImageRectRect GdipDrawImageI GdipRotateWorldTransform GdipTranslateWorldTransform GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesWrapMode GdipDisposeImageAttributes GdipCreateImageAttributes GdipGetImageHeight GdipDisposeImage GdipCloneImage GdipLoadImageFromStream GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdiplusShutdown GdipDeleteStringFormat GdiplusStartup

Name

.text

Size

617KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.QMGuid

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_5a5125f5c7418786037b9ca768bbb09d_darkgate_elex_maze_remcos_stealc

sentry

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

netapi32

winhttp

version

iphlpapi

gdiplus

generic