2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee
Size 5.7MB
Sample261001-m2wc2sae94
SHA256 0115bc82d7ac551a6d7b7a4e60c32b1daf0c2ba24b08f862e9c15a41d4a83a73
MD5 85e11fcfe6d3568b5bf4e5fa9f1d411a
SHA1 f8493e13b30f8322e3e8e4edce00c2f4ba6a1bba
SHA512 5dcd4a21a2866feb55f8c88c20557fee5b1f54dda9d44f45f3d60a378ec47f918b1c3fbe52d1ed50a05fb04294e4d7eb7cd468cb44d9d8a20efecb506b140d02
SSDEEP 98304:VM5gDCoUxB1QBmJHRXY5x/GDZ8UUCffOxhBsiS7VGVG15b6HcVQFu9bk2:GOD9shJHRXy08/RIVXt6JFC9
TLSH
T1A056331275D1C032E1B659704AF6F7B1662BFDB12BF6918B7384AE181BF4BC2D821352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee

.exe 5.7MB

2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee

IMPHASH ec26033e5a2e7d0337c109de56efd095
SHA256 0115bc82d7ac551a6d7b7a4e60c32b1daf0c2ba24b08f862e9c15a41d4a83a73
MD5 85e11fcfe6d3568b5bf4e5fa9f1d411a
SHA1 f8493e13b30f8322e3e8e4edce00c2f4ba6a1bba
SHA512 5dcd4a21a2866feb55f8c88c20557fee5b1f54dda9d44f45f3d60a378ec47f918b1c3fbe52d1ed50a05fb04294e4d7eb7cd468cb44d9d8a20efecb506b140d02
SSDEEP 98304:VM5gDCoUxB1QBmJHRXY5x/GDZ8UUCffOxhBsiS7VGVG15b6HcVQFu9bk2:GOD9shJHRXy08/RIVXt6JFC9
TLSH
T1A056331275D1C032E1B659704AF6F7B1662BFDB12BF6918B7384AE181BF4BC2D821352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

PE Signature issue

Digest

00:0e:91:37:f0:47:db:20:91:f6:77:6e:d2:95:2a:9d:09:ca:ba:57

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PC Utilities Software Limited,OU=IT Department,O=PC Utilities Software Limited,POSTALCODE=W1H 1DP,STREET=78 York Street,L=London,ST=England,C=GB

Chains

Sep 25, 2026

CN=PC Utilities Software Limited,OU=IT Department,O=PC Utilities Software Limited,POSTALCODE=W1H 1DP,STREET=78 York Street,L=London,ST=England,C=GB

Subject

CN=PC Utilities Software Limited,OU=IT Department,O=PC Utilities Software Limited,POSTALCODE=W1H 1DP,STREET=78 York Street,L=London,ST=England,C=GB

Serial Number

cf:20:ed:fb:9e:9d:56:f4:29:a4:4e:79:c3:46:58:05

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2014 - Jul 30, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Minor OS version

Major OS version

Entry point

77239

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

O:\CPPwrapper_VS2010\Release_RSspec\optimizerpro_silent.pdb

kernel32

GetLastError CloseHandle FindResourceA SetFilePointer SetEndOfFile LoadResource CreateProcessW SystemTimeToFileTime CreateDirectoryW WaitForSingleObject SetFileTime WriteFile OpenProcess SizeofResource GetVersionExW GetExitCodeProcess GetFileAttributesW GetTempPathW SetLastError CreateFileW LoadLibraryA Process32FirstW LockResource Process32NextW CreateToolhelp32Snapshot GetShortPathNameW DeleteFileW GetCurrentProcessId GetSystemTime GetModuleFileNameW ReadFile GetProcessHeap HeapFree HeapAlloc WriteConsoleW SetStdHandle IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTickCount GetFileSize GetProcAddress QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW FlushFileBuffers GetConsoleMode GetConsoleCP HeapCreate GetFileType InitializeCriticalSectionAndSpinCount MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetVolumeInformationW GetSystemTimeAsFileTime GetFileTime VerSetConditionMask GetCurrentProcess VerifyVersionInfoW IsWow64Process GetVersion GetEnvironmentVariableW GetBinaryTypeW SetEvent TerminateThread Sleep CreateEventW WideCharToMultiByte lstrcmpW MultiByteToWideChar lstrlenW LocalAlloc LocalFree ExpandEnvironmentStringsW InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentThreadId RaiseException RtlUnwind LCMapStringW GetCPInfo FreeLibrary LoadLibraryW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize GetModuleHandleW ExitProcess GetStdHandle GetLocaleInfoW GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetHandleCount HeapReAlloc

advapi32

RegCreateKeyExW RegSetValueExW RegCloseKey RegFlushKey RegOpenKeyExW

shell32

CommandLineToArgvW SHGetFolderPathW

ole32

CoUninitialize CoInitialize CoCreateInstance

iphlpapi

GetAdaptersInfo

wininet

InternetConnectA HttpOpenRequestA InternetCloseHandle InternetCrackUrlA InternetSetOptionW HttpQueryInfoA InternetReadFile HttpSendRequestA InternetOpenA

psapi

GetModuleFileNameExW

user32

GetSystemMetrics

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee

PE Signature issue

kernel32

advapi32

shell32

ole32

iphlpapi

wininet

psapi

user32

generic