2026-09-24_cb6c955a4919540d04744ea3d15b7635_darkgate_elex_remcos_rhadamanthys_stop_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_cb6c955a4919540d04744ea3d15b7635_darkgate_elex_remcos_rhadamanthys_stop_virut
Size 1.9MB
Sample260924-2da5jatcrc
SHA256 b76879a98d7401d751fb93f6c6b69b0940d91242f5285dc605d8ba6ff1ed323a
MD5 cb6c955a4919540d04744ea3d15b7635
SHA1 f02fd7dbb44352844d6ba1c345c261e2f46ada00
SHA512 4cf4adc901eee299d1963cc03b9d61b582e19ec53c368404b08a40c1904447c684bfa55ef0ff024aba263159c9c879df5b6fcc88f8b97015529e0d6cff1616c8
SSDEEP 49152:4nupZPwpchZ/R1CB4TvAAvs1dNEZhbSlNhtjXR:4upZ4pcb/RY36hb+F
TLSH
T18295C01273D38072D0B702B0E6F5E769D539FE74132545C7A3A82B0AAE706D1FA3925B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-24_cb6c955a4919540d04744ea3d15b7635_darkgate_elex_remcos_rhadamanthys_stop_virut

File Explorer

2026-09-24_cb6c955a4919540d04744ea3d15b7635_darkgate_elex_remcos_rhadamanthys_stop_virut

.exe 1.9MB

2026-09-24_cb6c955a4919540d04744ea3d15b7635_darkgate_elex_remcos_rhadamanthys_stop_virut

IMPHASH 7b24277e254bc7c7476fd4e66f6a3e4e
SHA256 b76879a98d7401d751fb93f6c6b69b0940d91242f5285dc605d8ba6ff1ed323a
MD5 cb6c955a4919540d04744ea3d15b7635
SHA1 f02fd7dbb44352844d6ba1c345c261e2f46ada00
SHA512 4cf4adc901eee299d1963cc03b9d61b582e19ec53c368404b08a40c1904447c684bfa55ef0ff024aba263159c9c879df5b6fcc88f8b97015529e0d6cff1616c8
SSDEEP 49152:4nupZPwpchZ/R1CB4TvAAvs1dNEZhbSlNhtjXR:4upZ4pcb/RY36hb+F
TLSH
T18295C01273D38072D0B702B0E6F5E769D539FE74132545C7A3A82B0AAE706D1FA3925B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a4:ff:21:48:e9:58:63:80:dc:ec:dd:ae:66:b4:e9:72:e9:c2:16:e7:10:b4:f3:cc:7c:1e:91:30:39:3b:de:23

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

Feb 3, 2021

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

d6:f6:f7:a0:97:7f:36:50:f9:a9:36:84:c3:22:6e:81:1c:6b:ea:3c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

Feb 3, 2021

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

2021560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\360se_update\ExtDoctor\BrowserDoctor\Release\360seupdate.pdb

kernel32

ReleaseMutex GetWindowsDirectoryW CreateEventW HeapAlloc GetProcessHeap HeapFree TerminateThread ExitProcess CreateToolhelp32Snapshot Process32FirstW TerminateProcess Process32NextW CopyFileW MoveFileW lstrcatW GetEnvironmentVariableW GetTempFileNameW GetDiskFreeSpaceExW ResumeThread GetThreadContext SetThreadContext VirtualQuery InterlockedCompareExchange GetCurrentThread VirtualProtect SuspendThread MapViewOfFile CreateFileMappingW LoadLibraryA GetFileAttributesExW GetFileAttributesW FlushViewOfFile SetFileTime SetFileAttributesW LocalAlloc GetLogicalDriveStringsA GetVersion GetSystemDirectoryA GetDriveTypeA GetVolumeInformationA GetDiskFreeSpaceExA GetPrivateProfileStringW GetModuleHandleA GetSystemDefaultLangID GetFileType SystemTimeToFileTime GetCurrentDirectoryW DosDateTimeToFileTime FindResourceW LoadResource Sleep lstrcmpW MulDiv SetEvent OpenEventW InterlockedIncrement InterlockedDecrement LoadLibraryExW lstrcmpiW FlushInstructionCache GlobalUnlock GlobalLock GlobalAlloc FreeResource FindResourceExW GetCurrentThreadId GlobalMemoryStatusEx CreateThread CreateMutexW GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW SetStdHandle InitializeCriticalSectionAndSpinCount GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetStartupInfoA SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleMode GetConsoleCP GetTimeZoneInformation GetModuleFileNameA GetStdHandle HeapCreate IsValidCodePage GetOEMCP GetACP GetStringTypeW GetCPInfo LCMapStringW LCMapStringA RtlUnwind GetStartupInfoW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree DeleteAtom FindAtomW TlsAlloc AddAtomW GetAtomNameW TlsSetValue TlsGetValue SetEndOfFile GetSystemTimeAsFileTime FlushFileBuffers IsProcessorFeaturePresent HeapSize OpenProcess GetCurrentProcess RemoveDirectoryW lstrcpyW GetFullPathNameW SetLastError FindClose FindNextFileW FindFirstFileW MoveFileExW GetTickCount LockResource SizeofResource InterlockedExchange lstrcmpiA lstrcmpA WideCharToMultiByte lstrlenW RaiseException GetVersionExW MultiByteToWideChar lstrlenA GetLastError VirtualAlloc ReadFile VirtualFree SetFilePointer GetFileSize LeaveCriticalSection CreateFileW EnterCriticalSection FreeLibrary DeleteCriticalSection InitializeCriticalSection GetProcAddress CreateProcessW LoadLibraryW GetModuleFileNameW GetModuleHandleW GetCurrentProcessId CloseHandle HeapReAlloc HeapDestroy DeleteFileW CreateDirectoryW GetSystemDirectoryW ExpandEnvironmentStringsW GetTempPathW WriteFile CreateFileA OpenMutexW DeviceIoControl

user32

ShowWindow GetWindowThreadProcessId CallWindowProcW GetDesktopWindow GetSystemMetrics WindowFromPoint GetMessageW TranslateMessage SystemParametersInfoW SetCursor GetCursorPos UpdateLayeredWindow UpdateWindow PostQuitMessage GetShellWindow PostMessageW SetTimer IsWindow FindWindowW SendMessageW GetWindow GetWindowRect GetParent GetCapture TrackMouseEvent AdjustWindowRectEx DrawTextW InflateRect DrawIconEx GetIconInfo WindowFromDC UnregisterClassA DispatchMessageW GetTopWindow IsWindowVisible RegisterClassExW GetClassInfoExW LoadCursorW DefWindowProcW DestroyWindow GetDlgItem CreateWindowExW EndDialog CharNextW DestroyAcceleratorTable ReleaseDC GetWindowLongW SetWindowLongW MapWindowPoints GetClientRect GetMonitorInfoW SetWindowPos PtInRect ExitWindowsEx GetForegroundWindow CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW wsprintfW LoadStringW DialogBoxParamW IsIconic GetKeyState MessageBoxW KillTimer RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW BeginPaint EndPaint IsChild GetFocus SetFocus GetClassNameW GetSysColor RedrawWindow CreateAcceleratorTableW ClientToScreen ScreenToClient MoveWindow SetCapture ReleaseCapture FillRect InvalidateRgn InvalidateRect GetDC MonitorFromWindow

gdi32

CreateSolidBrush CreateCompatibleBitmap BitBlt GetStockObject GetDeviceCaps GetObjectW SelectObject DeleteObject CreateDIBSection CreateCompatibleDC DeleteDC SetViewportOrgEx GetObjectType GetRandomRgn GdiAlphaBlend GetLayout SetLayout GetCurrentObject SetBkMode SetGraphicsMode SetWorldTransform ModifyWorldTransform GetTextExtentPoint32W CreateFontIndirectW SelectClipRgn CreateRectRgn CombineRgn OffsetRgn GetRgnBox CreateRectRgnIndirect RectVisible SaveDC IntersectClipRect RestoreDC LPtoDP

advapi32

RegQueryInfoKeyW RegOpenKeyExW RegCreateKeyA SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl GetLengthSid RegSetKeySecurity SetSecurityDescriptorOwner InitializeSecurityDescriptor RegSetValueExW RegCreateKeyExW DuplicateTokenEx GetTokenInformation SetNamedSecurityInfoW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegQueryValueExW RegEnumKeyExW

shell32

SHGetFolderPathW SHGetSpecialFolderPathA SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteW ShellExecuteExW SHGetSpecialFolderPathW SHChangeNotify SHFileOperationW

ole32

PropVariantClear OleInitialize CLSIDFromString CLSIDFromProgID CoGetClassObject OleLockRunning StringFromGUID2 OleUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree RegisterDragDrop RevokeDragDrop DoDragDrop CoInitialize CreateStreamOnHGlobal CoCreateInstance CoUninitialize

oleaut32

CreateStdDispatch CreateDispTypeInfo VariantChangeType VarCmp SysAllocStringLen LoadTypeLi VariantCopy LoadRegTypeLi OleCreateFontIndirect VarUI4FromStr VarBstrCmp SysStringLen VariantClear SysAllocString SysFreeString VariantInit

shlwapi

StrStrIW StrCmpIW SHDeleteKeyW StrToIntW SHDeleteEmptyKeyW PathRemoveBackslashW SHStrDupW PathFindExtensionW SHDeleteValueW SHSetValueA PathIsRootW SHGetValueA SHSetValueW PathAppendW PathRemoveFileSpecW PathFindFileNameW SHGetValueW PathFileExistsW

comctl32

InitCommonControlsEx

wintrust

WinVerifyTrust

psapi

EnumProcessModules GetModuleFileNameExW GetModuleInformation

wininet

HttpAddRequestHeadersA InternetOpenUrlW InternetErrorDlg InternetCrackUrlW HttpQueryInfoA InternetOpenW InternetConnectW HttpOpenRequestW HttpAddRequestHeadersW InternetQueryOptionW InternetSetOptionW HttpSendRequestW HttpQueryInfoW InternetReadFile InternetCloseHandle

crypt32

CryptQueryObject CryptMsgGetParam CertFindCertificateInStore CertFreeCertificateContext CertCloseStore CryptMsgClose CertGetNameStringW

netapi32

Netbios

gdiplus

GdiplusStartup GdiplusShutdown

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

setupapi

SetupIterateCabinetW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_cb6c955a4919540d04744ea3d15b7635_darkgate_elex_remcos_rhadamanthys_stop_virut

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wintrust

psapi

wininet

crypt32

netapi32

gdiplus

version

setupapi

generic