2026-09-22_270353d53db991d82924a2483f7e365b_darkgate_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_270353d53db991d82924a2483f7e365b_darkgate_elex_rhadamanthys_stop
Size 9.2MB
Sample260922-1pjelsshqf
SHA256 015101597ba0c91321c4d34d0d61722a03023fc196e21a49f8108ae2b41d92f1
MD5 270353d53db991d82924a2483f7e365b
SHA1 d42495ecde9b5fef29f2c5479a325bc0abfa768b
SHA512 e10980ee74148f6cf88799c46dc942ac352a8eb90a2bc6244f496a7b7c0da3bf8e2c2cef82707e2b90df2c0ef40a84a1f0fb796ad3188d3f82c0ea6ac2ef8b4a
SSDEEP 196608:yIaqUBSx6irchOpF4TVxNgNjuVRjo1U2tku+kiOr3DQg9:ZaqUBI6ir9iDk6VRsHkuDHUE
TLSH
T1BBA6121337D38022E6A21530D6E9D33992AD6D745A22C99B53E07F1FBF789839935B03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-22_270353d53db991d82924a2483f7e365b_darkgate_elex_rhadamanthys_stop

.exe 9.2MB

2026-09-22_270353d53db991d82924a2483f7e365b_darkgate_elex_rhadamanthys_stop

IMPHASH 1c4affc1880d6de3f4664d70189f78f8
SHA256 015101597ba0c91321c4d34d0d61722a03023fc196e21a49f8108ae2b41d92f1
MD5 270353d53db991d82924a2483f7e365b
SHA1 d42495ecde9b5fef29f2c5479a325bc0abfa768b
SHA512 e10980ee74148f6cf88799c46dc942ac352a8eb90a2bc6244f496a7b7c0da3bf8e2c2cef82707e2b90df2c0ef40a84a1f0fb796ad3188d3f82c0ea6ac2ef8b4a
SSDEEP 196608:yIaqUBSx6irchOpF4TVxNgNjuVRjo1U2tku+kiOr3DQg9:ZaqUBI6ir9iDk6VRsHkuDHUE
TLSH
T1BBA6121337D38022E6A21530D6E9D33992AD6D745A22C99B53E07F1FBF789839935B03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

ff:e4:7b:a6:2e:9a:fc:db:5b:e0:b2:13:1f:d0:41:85:06:25:40:23:c9:ba:22:0b:41:45:45:34:26:9b:09:a1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=The MouseMux Company,O=The MouseMux Company,ST=Zuid-Holland,C=NL

Chains

May 21, 2024

CN=The MouseMux Company,O=The MouseMux Company,ST=Zuid-Holland,C=NL

CN=Certera Code Signing CA,O=Certera,C=US

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 1, 2010 - Jan 18, 2038

Subject

CN=Certera Code Signing CA,O=Certera,C=US

Serial Number

21:66:f0:8a:51:eb:fc:ab:cc:8f:44:30:91:a9:4b:0e

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 7, 2022 - Sep 6, 2032

Subject

CN=The MouseMux Company,O=The MouseMux Company,ST=Zuid-Holland,C=NL

Serial Number

b9:58:c8:fe:35:33:14:df:b5:8f:99:95:33:54:d5:f4

Issuer

CN=Certera Code Signing CA,O=Certera,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 12, 2023 - Oct 11, 2026

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 3, 2023 - Aug 2, 2034

Minor OS version

Major OS version

Entry point

824524

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Branch\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateDirectoryW GetCurrentProcessId GetExitCodeThread SetEvent CreateEventW SetLastError LoadLibraryW FreeLibrary lstrlenW GetVersionExW CreateFileA SetStdHandle WriteConsoleW WriteConsoleA GetModuleHandleA InitializeCriticalSectionAndSpinCount GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetConsoleMode GetConsoleCP GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetDiskFreeSpaceExW IsValidCodePage GetOEMCP GetACP HeapCreate LCMapStringW LCMapStringA GetCPInfo RtlUnwind ExitProcess lstrcmpiW TlsSetValue TlsAlloc TlsGetValue GetShortPathNameW GetSystemTimeAsFileTime IsDebuggerPresent UnhandledExceptionFilter TerminateProcess HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange PeekNamedPipe OpenEventW SearchPathW GetLocaleInfoA GetStringTypeW ConnectNamedPipe CreateNamedPipeW ResetEvent MoveFileW TerminateThread GetSystemDirectoryW GetLocalTime OutputDebugStringW GetVersion Process32NextW Process32FirstW CreateToolhelp32Snapshot GetWindowsDirectoryW GetUserDefaultLangID GetSystemDefaultLangID GetDriveTypeW CompareStringW InterlockedDecrement InterlockedIncrement GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc lstrcmpW GetFileSize ReadFile GlobalFree GetTempPathW GetSystemTime GetTempFileNameW DeleteFileW FindFirstFileW RemoveDirectoryW FindNextFileW GetLogicalDriveStringsW GetFileAttributesW SetFileAttributesW CopyFileW FindClose MultiByteToWideChar LoadLibraryExW WideCharToMultiByte InterlockedExchange GetSystemInfo TlsFree WaitForMultipleObjects Sleep GetLastError GetCurrentThreadId WaitForSingleObject MulDiv lstrcpynW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetLocaleInfoW EnumResourceLanguagesW SetEndOfFile SetCurrentDirectoryW GetCommandLineW UnlockFile LockFile GetExitCodeProcess CreateProcessW DuplicateHandle GetModuleFileNameA FlushFileBuffers SetFilePointer GetConsoleOutputCP LeaveCriticalSection GetConsoleScreenBufferInfo GetStdHandle SetConsoleTextAttribute GetFullPathNameW GetCurrentThread InitializeCriticalSection EnterCriticalSection DeleteCriticalSection GetModuleHandleW GetProcAddress RaiseException FlushInstructionCache GetCurrentProcess CloseHandle WriteFile CreateFileW LoadLibraryA GetStartupInfoW LocalAlloc GetEnvironmentVariableW FormatMessageW CreateThread SetUnhandledExceptionFilter LocalFree

user32

MapWindowPoints GetParent DefWindowProcW SendMessageW GetWindowTextW GetWindowTextLengthW FillRect IsWindow ShowWindow GetClientRect UnionRect IsWindowVisible BeginPaint EndPaint ScreenToClient SetWindowPos GetWindowDC LookupIconIdFromDirectoryEx GetWindowLongW GetWindowRect CallWindowProcW SetWindowLongW GetWindow DrawFrameControl RegisterWindowMessageW InvalidateRgn GetDesktopWindow GetKeyState DrawStateW DrawTextExW DrawFocusRect ValidateRect DestroyMenu AppendMenuW CreatePopupMenu TrackPopupMenu InflateRect LoadBitmapW MessageBeep LoadImageW CharNextW GetClassNameW ReleaseCapture SetCapture UpdateWindow DestroyIcon GetDlgCtrlID GetCapture SetScrollInfo GetScrollPos GetClassInfoExW RegisterClassExW DrawEdge SetScrollPos SetRect MoveWindow GetScrollInfo GetMessagePos SystemParametersInfoW GetActiveWindow TrackMouseEvent GetAsyncKeyState DestroyCursor GetWindowRgn IsZoomed SetWindowRgn GetComboBoxInfo DestroyAcceleratorTable CreateAcceleratorTableW TranslateAcceleratorW CreateDialogParamW EndDialog DialogBoxParamW InvalidateRect GetNextDlgTabItem SetCursor MonitorFromWindow GetMonitorInfoW IsDialogMessageW IsChild PostQuitMessage PostMessageW SetForegroundWindow SetCursorPos GetCursorPos PeekMessageW GetMessageW TranslateMessage DispatchMessageW LoadCursorW LoadStringW MessageBoxW GetFocus EnableWindow DestroyWindow GetForegroundWindow EnumWindows GetWindowThreadProcessId DialogBoxIndirectParamW MsgWaitForMultipleObjects GetPropW GetSystemMenu EnableMenuItem ModifyMenuW FindWindowW ExitWindowsEx GetScrollRange SetPropW RemovePropW LoadMenuW GetSubMenu OpenClipboard CloseClipboard EmptyClipboard SetClipboardData GetIconInfo SendMessageTimeoutW UnregisterClassA DrawTextW DrawIconEx GetSystemMetrics ClientToScreen OffsetRect SetRectEmpty PtInRect GetSysColorBrush IntersectRect IsRectEmpty SendMessageA IsWindowEnabled CopyRect RedrawWindow SetFocus GetSysColor CreateWindowExW GetDlgItem SetWindowTextW EqualRect SetTimer KillTimer GetDC ReleaseDC CreateIconFromResourceEx

gdi32

GetLayout GetBrushOrgEx CreateFontIndirectW CreateSolidBrush GetRgnBox EqualRgn CreatePolygonRgn CreateRectRgnIndirect GetStockObject CreateFontW SetBkMode SetTextColor SetBrushOrgEx CreatePatternBrush FillRgn SelectClipRgn GetBitmapBits CreateRectRgn GetObjectW GetDeviceCaps Rectangle ExcludeClipRect CreatePen ExtTextOutW SetBkColor BitBlt SetViewportOrgEx CreateCompatibleBitmap CreateCompatibleDC DeleteObject SelectObject DeleteDC CreateDIBSection CreateBitmapIndirect CombineRgn

advapi32

RegOpenKeyW LookupPrivilegeValueW LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW GetSecurityDescriptorDacl StartServiceW QueryServiceStatus OpenServiceW RegDeleteValueA RegQueryValueExA RegOpenKeyA RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExA OpenSCManagerW LockServiceDatabase UnlockServiceDatabase CloseServiceHandle RegOpenKeyExA RegEnumValueA AdjustTokenPrivileges RegCreateKeyW OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid GetUserNameW RegDeleteKeyA RegCreateKeyA

shell32

ShellExecuteW SHGetFolderPathW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc SHGetFileInfoW SHGetSpecialFolderLocation ShellExecuteExW

ole32

CoTaskMemRealloc CoTaskMemFree CoInitialize OleInitialize CLSIDFromProgID CoGetClassObject CoCreateInstance CreateStreamOnHGlobal OleLockRunning StringFromGUID2 CoTaskMemAlloc OleUninitialize CoUninitialize CoCreateGuid CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes CoInitializeEx CLSIDFromString

oleaut32

VarUI4FromStr VarDateFromStr OleLoadPicture SysStringByteLen SysAllocStringByteLen SysAllocStringLen LoadTypeLi LoadRegTypeLi SysStringLen OleCreateFontIndirect VariantCopy VariantInit VariantClear SysAllocString SysFreeString

dbghelp

SymGetLineFromAddr SymSetSearchPath SymCleanup SymInitialize SymSetOptions SymFunctionTableAccess StackWalk SymGetModuleBase

shlwapi

PathIsDirectoryW PathFileExistsW PathIsUNCW PathAddBackslashW

comctl32

ImageList_Create CreatePropertySheetPageW PropertySheetW DestroyPropertySheetPage InitCommonControlsEx ImageList_LoadImageW ImageList_GetIcon ImageList_AddMasked ImageList_SetBkColor _TrackMouseEvent ImageList_Add ImageList_ReplaceIcon ImageList_Destroy

msimg32

TransparentBlt AlphaBlend

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

netapi32

NetUserGetLocalGroups NetApiBufferFree NetLocalGroupGetMembers

secur32

GetUserNameExW

comdlg32

GetOpenFileNameW GetSaveFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_270353d53db991d82924a2483f7e365b_darkgate_elex_rhadamanthys_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

dbghelp

shlwapi

comctl32

msimg32

version

netapi32

secur32

comdlg32

generic