2026-10-01_0e5c7245fa6ea0dc77e66ec23845fe7c_darkgate_elex_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_0e5c7245fa6ea0dc77e66ec23845fe7c_darkgate_elex_mafia
Size 4.6MB
Sample261002-yvs5wsha34
SHA256 572c6bd96edb96981b36b744ec5d31192cb28b27caab50275d42a4c21eef5019
MD5 0e5c7245fa6ea0dc77e66ec23845fe7c
SHA1 76436eab9d7939d12a8c187464ab612370800c52
SHA512 b16b77825f1ba86d4f648a35487fb998dfbcf0b2bb2db6d9e2a4e433e7d280e29f77ed1670a71ea38b9fc230ccec40b7154881ff1e31dd408cd3e4870036cab8
SSDEEP 49152:B25vfUxd944tfSH8OEWp3VKVwpfOMW17iyh5Ha2rAE2rcmgS3VhvxK3pCDoMTNfI:B25vfUxd944tfSH8olVKYs17ihUety
TLSH
T11C260502A5798037FEB715B85A7C26D43718BD28BB2894CB61423A6D3DBE2F5543073E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-01_0e5c7245fa6ea0dc77e66ec23845fe7c_darkgate_elex_mafia

File Explorer

2026-10-01_0e5c7245fa6ea0dc77e66ec23845fe7c_darkgate_elex_mafia

.exe 4.6MB

2026-10-01_0e5c7245fa6ea0dc77e66ec23845fe7c_darkgate_elex_mafia

IMPHASH 94258235b3394e73d31da509d7087653
SHA256 572c6bd96edb96981b36b744ec5d31192cb28b27caab50275d42a4c21eef5019
MD5 0e5c7245fa6ea0dc77e66ec23845fe7c
SHA1 76436eab9d7939d12a8c187464ab612370800c52
SHA512 b16b77825f1ba86d4f648a35487fb998dfbcf0b2bb2db6d9e2a4e433e7d280e29f77ed1670a71ea38b9fc230ccec40b7154881ff1e31dd408cd3e4870036cab8
SSDEEP 49152:B25vfUxd944tfSH8OEWp3VKVwpfOMW17iyh5Ha2rAE2rcmgS3VhvxK3pCDoMTNfI:B25vfUxd944tfSH8olVKYs17ihUety
TLSH
T11C260502A5798037FEB715B85A7C26D43718BD28BB2894CB61423A6D3DBE2F5543073E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

62:11:10:80:9a:b8:18:3e:94:b5:8b:e1:0c:c0:ff:c5:91:ec:bd:69

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Jutao Networking Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Echnology Team,O=Jutao Networking Limited,L=Beijing,ST=Beijing,C=CN

Chains

Nov 1, 2013

CN=Jutao Networking Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Echnology Team,O=Jutao Networking Limited,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Jutao Networking Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Echnology Team,O=Jutao Networking Limited,L=Beijing,ST=Beijing,C=CN

Serial Number

0f:65:09:e1:a3:33:a9:09:ff:03:d5:33:5c:f8:b6:26

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 28, 2013 - Nov 27, 2015

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

593288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\new_caimao\src\build\Release\setup.exe.pdb

kernel32

GetFileSize GetThreadLocale ExpandEnvironmentStringsW CreateProcessW VirtualAllocEx WriteProcessMemory QueueUserAPC ResumeThread TerminateProcess OpenEventW CreateFileW ReadFile lstrlenW WriteFile GetModuleFileNameW GetCurrentProcess OpenProcess LoadLibraryW GetProcAddress FreeLibrary GetLastError LocalAlloc LocalFree InterlockedExchange LoadLibraryA RaiseException GetExitCodeProcess DuplicateHandle GetDateFormatW GetFileInformationByHandle InterlockedCompareExchange VerifyVersionInfoW VerSetConditionMask GetShortPathNameW MoveFileExW GetFileAttributesExW GetFileAttributesW SizeofResource LockResource LoadResource FindResourceW RemoveDirectoryW SetFilePointer SetFileTime WTSGetActiveConsoleSessionId GetFileTime GetCurrentThreadId LoadLibraryExW CreateThread Sleep IsDebuggerPresent ResetEvent SetEvent CreateEventW WaitForMultipleObjects GetCurrentProcessId GetTickCount ReleaseMutex SetLastError DeleteFileW CreateMutexW OutputDebugStringA FormatMessageA GetModuleHandleA GetCommandLineW GetNativeSystemInfo GetVersionExW CopyFileW SetCurrentDirectoryW CreateDirectoryW FindNextFileW GetTempPathW GetLongPathNameW GetTempFileNameW GetCurrentDirectoryW UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateToolhelp32Snapshot VirtualQueryEx HeapSetInformation Process32NextW Process32FirstW GetProcessId AssignProcessToJobObject GetStdHandle InterlockedExchangeAdd QueryPerformanceCounter FileTimeToSystemTime GetUserDefaultLangID GetEnvironmentVariableW SetEnvironmentVariableW SetFilePointerEx SetEndOfFile FlushFileBuffers RtlCaptureStackBackTrace GetLocaleInfoW GetUserDefaultUILanguage InitializeCriticalSectionAndSpinCount DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter GetSystemDirectoryW GetWindowsDirectoryW TlsSetValue TlsGetValue TlsFree TlsAlloc InterlockedIncrement ReleaseSemaphore lstrcatW lstrcpyW InterlockedDecrement RtlCaptureContext CreateSemaphoreW InitializeCriticalSection WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState GetSystemTime MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc GetProcessHeap EncodePointer DecodePointer UnhandledExceptionFilter GetStartupInfoW GetConsoleCP GetConsoleMode GetFullPathNameW ExitProcess HeapReAlloc SetStdHandle GetFileType FileTimeToLocalFileTime PeekNamedPipe RtlUnwind LCMapStringW GetCPInfo IsProcessorFeaturePresent HeapCreate SetHandleCount HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation WriteConsoleW GetStringTypeW CreateFileA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetDriveTypeW CompareStringW SetEnvironmentVariableA FindFirstFileW FindClose GetModuleHandleW WaitForSingleObject GetSystemTimeAsFileTime CloseHandle

gdi32

StretchBlt SetTextColor SetBkMode GetStockObject CreateCompatibleBitmap GetTextFaceW CreateFontIndirectW CreateCompatibleDC SelectObject BitBlt DeleteObject GetCharABCWidthsW GetFontUnicodeRanges GetOutlineTextMetricsW GetTextExtentPointI SetTextAlign ExtTextOutW GetGlyphIndicesW GetFontData GetGlyphOutlineW SetWorldTransform SetGraphicsMode GdiFlush CreateDIBSection DeleteDC GetTextMetricsW CreateFontW

advapi32

GetFileSecurityW ConvertStringSecurityDescriptorToSecurityDescriptorW SetFileSecurityW GetUserNameW RegSetValueExW ConvertSecurityDescriptorToStringSecurityDescriptorW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW CreateProcessAsUserW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle UnregisterTraceGuids TraceEvent RegisterTraceGuidsW RegEnumValueA SetSecurityInfo GetSecurityDescriptorSacl LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyExW RegQueryValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW RegUnLoadKeyW RegLoadKeyW AdjustTokenPrivileges

ole32

CoInitializeEx PropVariantClear CoUninitialize CoTaskMemFree CLSIDFromString StringFromGUID2 CoCreateInstance

user32

InvalidateRect EndPaint LoadBitmapW BeginPaint PostQuitMessage RegisterClassExW LoadCursorW UpdateWindow ShowWindow SetWindowPos GetSystemMetrics SetForegroundWindow MoveWindow GetMonitorInfoW MonitorFromWindow DestroyWindow CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW CharUpperW SystemParametersInfoW LoadIconW GetWindowRect CreateWindowExW TranslateMessage DispatchMessageW GetMessageW PostThreadMessageW SendMessageW EnableWindow IsWindow GetWindowTextW MessageBoxW DrawTextA GetSysColor PtInRect SetTimer SendMessageTimeoutW GetWindowThreadProcessId FindWindowW DefWindowProcW SetWindowLongW GetWindowLongW SetWindowTextW

wininet

InternetConnectW HttpOpenRequestW InternetOpenW InternetSetOptionW HttpSendRequestW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpAddRequestHeadersW InternetQueryDataAvailable InternetReadFile

urlmon

CreateURLMonikerEx

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

netapi32

Netbios

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ws2_32

ntohl

winmm

timeGetTime

shlwapi

SHDeleteKeyW UrlCanonicalizeW SHStrDupW SHCopyKeyW SHDeleteEmptyKeyW

oleaut32

VariantClear VariantInit SysAllocString

iphlpapi

GetAdaptersInfo

usp10

ScriptFreeCache ScriptShape ScriptItemize

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

813KB

Virtual Size

813KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_0e5c7245fa6ea0dc77e66ec23845fe7c_darkgate_elex_mafia

PE Signature issue

kernel32

gdi32

advapi32

ole32

user32

wininet

urlmon

wtsapi32

userenv

netapi32

version

ws2_32

winmm

shlwapi

oleaut32

iphlpapi

usp10

generic