2026-10-19_be2a2abc68bc29a386927ceceb780454_darkgate_elex_maze_remcos_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_be2a2abc68bc29a386927ceceb780454_darkgate_elex_maze_remcos_stealc
Size 2.3MB
Sample261020-maf42sba67
SHA256 7a974b369c34fc0d2d5a4dd7546483f739918629219eed9149fb70696058ad3a
MD5 be2a2abc68bc29a386927ceceb780454
SHA1 6b80cae988bdefd1b33ca3384837f76dd0578835
SHA512 eee5cc828a2b2c6c69e6a04de95a2b9ea9676dc3e315b09be2b1a335f03c50eebbbd577b0860bf1f59873efa8a46ea73686e97645608039a35b0a9710110758d
SSDEEP 49152:P3ly1ugZ1qJE8kv0fqpHsZelmOvJvt/KTQUyXh/Dk0KPqTD+/2:PAUgZ1QnkIimOBV/n11DtO1
TLSH
T1F8B5F12276818136E56206B28E3EBB1910BDFA704B3149DBF3D81E1D9D70AD36F35627
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_be2a2abc68bc29a386927ceceb780454_darkgate_elex_maze_remcos_stealc

File Explorer

2026-10-19_be2a2abc68bc29a386927ceceb780454_darkgate_elex_maze_remcos_stealc

.exe 2.3MB

2026-10-19_be2a2abc68bc29a386927ceceb780454_darkgate_elex_maze_remcos_stealc

IMPHASH ed18fe9bb7d70e4b3692d5b8a93c02dc
SHA256 7a974b369c34fc0d2d5a4dd7546483f739918629219eed9149fb70696058ad3a
MD5 be2a2abc68bc29a386927ceceb780454
SHA1 6b80cae988bdefd1b33ca3384837f76dd0578835
SHA512 eee5cc828a2b2c6c69e6a04de95a2b9ea9676dc3e315b09be2b1a335f03c50eebbbd577b0860bf1f59873efa8a46ea73686e97645608039a35b0a9710110758d
SSDEEP 49152:P3ly1ugZ1qJE8kv0fqpHsZelmOvJvt/KTQUyXh/Dk0KPqTD+/2:PAUgZ1QnkIimOBV/n11DtO1
TLSH
T1F8B5F12276818136E56206B28E3EBB1910BDFA704B3149DBF3D81E1D9D70AD36F35627
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

594606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\build\workspace\miflash_git\out\Release\bin\LoginPro.pdb

libcef

cef_string_multimap_free cef_string_multimap_alloc cef_string_map_free cef_string_map_alloc cef_string_utf8_clear cef_log cef_string_multimap_value cef_string_multimap_size cef_string_map_append cef_string_map_value cef_string_map_key cef_string_map_size cef_string_list_append cef_string_list_value cef_string_list_size cef_string_utf16_cmp cef_api_hash cef_string_list_alloc cef_string_list_free cef_currently_on cef_post_task cef_browser_host_create_browser cef_string_list_copy cef_string_ascii_to_utf16 cef_string_utf16_to_utf8 cef_string_utf8_to_utf16 cef_cookie_manager_get_global_manager cef_string_multimap_key cef_string_utf16_set cef_string_userfree_utf16_free cef_string_multimap_append cef_quit_message_loop cef_run_message_loop cef_shutdown cef_initialize cef_execute_process cef_string_utf16_clear

kernel32

SetEnvironmentVariableA GetCommandLineW CreateFileW WriteFile CloseHandle InitializeCriticalSectionAndSpinCount RaiseException GetLastError DecodePointer DeleteCriticalSection SetLastError WriteConsoleW GetTimeZoneInformation GetOEMCP IsValidCodePage GetStdHandle HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetStartupInfoW UnhandledExceptionFilter GetCPInfo ReadConsoleW RtlUnwind AreFileApisANSI SetStdHandle HeapReAlloc GetConsoleMode GetConsoleCP GetFullPathNameW IsProcessorFeaturePresent GetStringTypeW EncodePointer InterlockedExchangeAdd TerminateProcess LoadLibraryExW lstrcmpiW GetDriveTypeW FreeLibrary HeapFree GetProcessHeap HeapAlloc FreeEnvironmentStringsW GetEnvironmentStringsW OutputDebugStringW WideCharToMultiByte DosDateTimeToFileTime GetFileType GlobalUnlock GlobalLock GlobalAlloc InterlockedDecrement GetLocalTime MulDiv ExitProcess GetFileSize LoadLibraryW MultiByteToWideChar GetACP FindResourceW SizeofResource LoadResource LockResource FreeResource CreateToolhelp32Snapshot Process32NextW Process32FirstW GetUserDefaultLangID GetModuleHandleExA InterlockedIncrement GetTempFileNameW GetCurrentProcess CreateDirectoryW CopyFileW GetFileAttributesW ReadFile GetTempPathW GetCurrentDirectoryW GetLongPathNameW RemoveDirectoryW GetFileAttributesExW DeleteFileW WaitForSingleObject GetCurrentThread Sleep IsDebuggerPresent GetCurrentThreadId DuplicateHandle CreateThread InterlockedCompareExchange TlsGetValue TlsSetValue TlsAlloc TlsFree SetEvent CreateEventW SetUnhandledExceptionFilter CreateMutexW SetFilePointer CreateProcessW GetTickCount GetModuleFileNameW ReleaseMutex GetCurrentProcessId LeaveCriticalSection EnterCriticalSection GetSystemDirectoryW GetWindowsDirectoryW SetEndOfFile SetFilePointerEx SetFileTime FlushFileBuffers SystemTimeToTzSpecificLocalTime SystemTimeToFileTime QueryPerformanceCounter GetSystemTimeAsFileTime FileTimeToSystemTime QueryPerformanceFrequency GetNativeSystemInfo GetModuleHandleW GetVersionExW GetProcAddress GetModuleHandleExW GetQueuedCompletionStatus InterlockedExchange PostQueuedCompletionStatus CreateIoCompletionPort

user32

CreateAcceleratorTableW MoveWindow GetSysColor ClientToScreen SetCaretPos ShowCaret HideCaret CreateCaret InvalidateRgn GetCaretBlinkTime GetWindowTextLengthW GetWindowTextW SetWindowTextW SetRect FillRect GetDesktopWindow BeginDeferWindowPos GetGUIThreadInfo GetCaretPos DeferWindowPos SetActiveWindow DrawTextW CharPrevW GetLastActivePopup EndDeferWindowPos SetForegroundWindow UnregisterClassW PostMessageW SetWindowPos AllowSetForegroundWindow SendMessageW FindWindowW SetWindowRgn MessageBoxW DispatchMessageW DefWindowProcW CreateWindowExW MsgWaitForMultipleObjectsEx PeekMessageW CallMsgFilterW RegisterClassExW TranslateMessage GetQueueStatus WaitMessage KillTimer PostQuitMessage SetTimer DestroyWindow IntersectRect PtInRect CharNextW wvsprintfW SetCursor UnionRect OffsetRect LoadCursorW IsWindow IsWindowVisible IsIconic SetFocus GetActiveWindow GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetWindowRect GetCursorPos ScreenToClient MapWindowPoints IsRectEmpty GetWindowLongW SetWindowLongW GetParent GetWindow CallWindowProcW RegisterClassW GetClassInfoExW ShowWindow EnableWindow SetPropW GetPropW MonitorFromWindow GetMonitorInfoW IsZoomed

shell32

SHGetFolderPathW SHFileOperationW ShellExecuteW CommandLineToArgvW

ole32

OleInitialize CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CreateStreamOnHGlobal OleLockRunning CLSIDFromProgID CLSIDFromString CoCreateInstance CoInitializeEx CoUninitialize CoInitialize RevokeDragDrop

oleaut32

VarUI4FromStr VariantClear VariantInit SysAllocString SysFreeString

dbghelp

MiniDumpWriteDump

gdiplus

GdipDeleteGraphics GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipCreateBitmapFromScan0 GdipGraphicsClear GdipDrawImage GdipDrawImageRectI GdipDeleteFontFamily GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipCreateLineBrushI GdipDeleteBrush GdipCloneBrush GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipCreateFromHDC GdipAlloc GdipFree GdipDrawString GdipGetFamily GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdiplusShutdown GdiplusStartup

vmprotectsdk32

VMProtectBegin VMProtectEnd

winmm

timeEndPeriod timeBeginPeriod timeGetTime

imm32

ImmReleaseContext ImmSetCompositionFontW ImmSetCompositionWindow ImmGetContext

iphlpapi

GetAdaptersInfo

comctl32

_TrackMouseEvent ord17

gdi32

GetObjectW SetWindowOrgEx CreateRoundRectRgn CombineRgn CreatePenIndirect CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW GetTextMetricsW DeleteDC DeleteObject GetStockObject Rectangle RestoreDC SelectObject CreatePen BitBlt GetDeviceCaps CreatePatternBrush GetObjectA GdiFlush ExtTextOutW TextOutW MoveToEx CreateDIBSection SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect SaveDC

advapi32

RegDeleteKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW IsTextUnicode

libcurl

curl_free curl_slist_append curl_easy_init curl_easy_escape curl_global_init curl_slist_free_all curl_easy_cleanup curl_easy_getinfo curl_easy_perform curl_easy_setopt

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

751KB

Virtual Size

750KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=1, id=199, version=41118,

count=40, id=223, productName=VS2013 build 21005, version=21005,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=88, id=225, productName=VS2013 build 21005, version=21005,

count=254, id=224, productName=VS2013 build 21005, version=21005,

count=2, id=225, version=20806,

count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=117, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=588, id=1, productName=Unmarked objects,

count=127, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,