2026-09-30_49c0e6fe96c3633badbae448171bf296_darkgate_elex_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_49c0e6fe96c3633badbae448171bf296_darkgate_elex_maze
Size 743KB
Sample261001-sdaz4awyhs
SHA256 1b03a50c0c61ed9016a6c13be3a4c927d4d87af0fe305ded0068ff4f2e972afd
MD5 49c0e6fe96c3633badbae448171bf296
SHA1 4840ed60793a5ea21e3cba24f4ea2ddd058f6096
SHA512 59966cde9689e13a12bb4e9fb668c47bd252b6c51cb45a9d9e4da559a22b7e1907a6bfb021e20c8da58ad53e46fab600104b4d11d30d7169141bf77be3a27a17
SSDEEP 12288:bqptHx2QppQH0PCf/Es94WJkTXQEv1PHHC/hZKg/vLtFFhM7GMg+g2PpMcs0knGl:b5H0PCf/l94g+5N/6ZK3TKo9s0knR2
TLSH
T1FAF46D2039D7403AE17256B24FDCBB6E557EFA31172A24DB53C80B4A4A619C1EF31E36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-30_49c0e6fe96c3633badbae448171bf296_darkgate_elex_maze

File Explorer

2026-09-30_49c0e6fe96c3633badbae448171bf296_darkgate_elex_maze

.exe 743KB

2026-09-30_49c0e6fe96c3633badbae448171bf296_darkgate_elex_maze

IMPHASH cd6b23bb70846602b089e2cf19f95eb5
SHA256 1b03a50c0c61ed9016a6c13be3a4c927d4d87af0fe305ded0068ff4f2e972afd
MD5 49c0e6fe96c3633badbae448171bf296
SHA1 4840ed60793a5ea21e3cba24f4ea2ddd058f6096
SHA512 59966cde9689e13a12bb4e9fb668c47bd252b6c51cb45a9d9e4da559a22b7e1907a6bfb021e20c8da58ad53e46fab600104b4d11d30d7169141bf77be3a27a17
SSDEEP 12288:bqptHx2QppQH0PCf/Es94WJkTXQEv1PHHC/hZKg/vLtFFhM7GMg+g2PpMcs0knGl:b5H0PCf/l94g+5N/6ZK3TKo9s0knR2
TLSH
T1FAF46D2039D7403AE17256B24FDCBB6E557EFA31172A24DB53C80B4A4A619C1EF31E36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

af:96:01:64:57:c5:69:f4:dd:6e:84:41:bf:f5:0f:e2:a2:5b:a7:85

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=High Stairs,O=High Stairs,L=San Diego,ST=California,C=US

Chains

Sep 18, 2015

CN=High Stairs,O=High Stairs,L=San Diego,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=High Stairs,O=High Stairs,L=San Diego,ST=California,C=US

Serial Number

66:98:e8:e8:57:67:17:d3:80:db:0b:bf:63:18:21:e1

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 8, 2015 - Jun 7, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

232005

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateProcess LoadLibraryW GetComputerNameW ReleaseMutex OpenMutexW CreateMutexW CreateNamedPipeW ConnectNamedPipe WaitNamedPipeW Sleep CancelIo CreateWaitableTimerW SetWaitableTimer CancelWaitableTimer SetCurrentDirectoryW SetErrorMode GetCommandLineW CopyFileW OpenEventW DecodePointer GetLocaleInfoW LCMapStringW CompareStringW Process32NextW lstrlenA SetEndOfFile Process32FirstW CreateToolhelp32Snapshot SetEvent WaitForMultipleObjects ResetEvent GetExitCodeProcess OpenProcess CreateEventW FreeLibrary RaiseException DeleteCriticalSection InitializeCriticalSectionAndSpinCount MoveFileExW CreateProcessW GetVersionExW DeleteFileW GetTempPathW GetOverlappedResult WaitForSingleObject GetProcAddress GetModuleHandleW GetModuleFileNameW InterlockedDecrement GetCurrentProcess LocalFree CreateDirectoryW GetFileAttributesW WriteFile GetLastError ReadFile CreateFileW CloseHandle MultiByteToWideChar FindResourceExW SizeofResource LockResource LoadResource FindResourceW GetProcessHeap WideCharToMultiByte HeapSize HeapReAlloc HeapFree WriteConsoleW SetEnvironmentVariableA ReadConsoleW SetStdHandle UnregisterWaitEx QueryDepthSList InterlockedFlushSList LoadLibraryExW ExitThread CreateSemaphoreW GetTickCount InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc HeapAlloc HeapDestroy GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP GetFileType GetOEMCP GetACP IsValidCodePage GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection GetCurrentThreadId DuplicateHandle GetCurrentThread GetExitCodeThread GetSystemTimeAsFileTime EncodePointer GetStringTypeW IsProcessorFeaturePresent ExitProcess GetModuleHandleExW RtlUnwind CreateTimerQueue WaitForSingleObjectEx SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority TlsAlloc TlsGetValue TlsSetValue TlsFree GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError GetStartupInfoW IsValidLocale

user32

EnumWindows GetWindowThreadProcessId GetWindow IsWindowVisible SendMessageW

advapi32

RegSetValueExW GetLengthSid CopySid SetFileSecurityW CryptDeriveKey SetNamedSecurityInfoW MakeAbsoluteSD GetSecurityDescriptorControl GetSecurityDescriptorLength MakeSelfRelativeSD GetSidSubAuthority InitializeSid GetSidLengthRequired CryptDestroyHash CryptHashData CryptCreateHash RegCreateKeyExW RegEnumKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey DuplicateTokenEx LookupAccountSidW ConvertSidToStringSidW CreateProcessAsUserW CryptEncrypt CryptExportKey CryptDuplicateKey CryptGenKey CryptReleaseContext CryptDestroyKey CryptDecrypt CryptImportKey CryptAcquireContextW AddAce GetAclInformation GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl InitializeAcl GetSecurityDescriptorDacl LookupAccountNameW GetTokenInformation OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor IsValidSid

shell32

SHGetFolderPathW

ole32

StringFromGUID2 CoInitializeEx CoInitializeSecurity CoCreateGuid CoCreateInstance CoUninitialize CoSetProxyBlanket

oleaut32

SysAllocString VariantClear SysFreeString

shlwapi

PathStripPathW PathCombineW PathCombineA PathAppendW PathFileExistsW PathRemoveFileSpecW PathRenameExtensionW

crypt32

CryptBinaryToStringA CryptStringToBinaryA

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpQueryHeaders WinHttpQueryDataAvailable

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

GetModuleFileNameExW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_49c0e6fe96c3633badbae448171bf296_darkgate_elex_maze

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

winhttp

version

psapi

userenv

generic