2026-10-21_a172f987eb6985cb61b9741c4513a43b_darkgate_elex_gcleaner_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_a172f987eb6985cb61b9741c4513a43b_darkgate_elex_gcleaner_wannacry
Size 4.2MB
Sample261022-sg67psds8v
SHA256 7dc896701a90d2876f437de3b97b97e4a5b3bcc64762ac09d9c07d0c3c2a45b3
MD5 a172f987eb6985cb61b9741c4513a43b
SHA1 619ee2ae917e25c66495a1484a609bd4ab58186a
SHA512 95017442fca0c9127d744c0a5abeb589e477d0608d299543ed4ae6f417f4ae85eec529c3344668e0849ca4688419b48823a2384fb069fc2f11b23b63a7caab91
SSDEEP 98304:pLAllASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTd1:JiU1Ls6DjX34gSVNf
TLSH
T1E426333338ACCCB2F96025305EA8536166FD6B181E34505F73BC4B2E9B2B6C5458E79B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

installer

Malware Config

Signatures

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

2026-10-21_a172f987eb6985cb61b9741c4513a43b_darkgate_elex_gcleaner_wannacry

.exe 4.2MB

2026-10-21_a172f987eb6985cb61b9741c4513a43b_darkgate_elex_gcleaner_wannacry

IMPHASH 0c40996f6e1e5f2a82b51e9950881bf1
SHA256 7dc896701a90d2876f437de3b97b97e4a5b3bcc64762ac09d9c07d0c3c2a45b3
MD5 a172f987eb6985cb61b9741c4513a43b
SHA1 619ee2ae917e25c66495a1484a609bd4ab58186a
SHA512 95017442fca0c9127d744c0a5abeb589e477d0608d299543ed4ae6f417f4ae85eec529c3344668e0849ca4688419b48823a2384fb069fc2f11b23b63a7caab91
SSDEEP 98304:pLAllASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTd1:JiU1Ls6DjX34gSVNf
TLSH
T1E426333338ACCCB2F96025305EA8536166FD6B181E34505F73BC4B2E9B2B6C5458E79B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Digest

6a:3e:8c:51:73:2d:11:39:45:2c:42:7f:31:b8:ea:ea:74:9b:56:56:f4:04:5d:f0:7a:3c:f4:03:d6:78:e1:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC252676,CN=N-able Technologies Ltd,O=N-able Technologies Ltd,STREET=4th Floor 115 George Street,L=Edinburgh,ST=Scotland,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 19, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

76:53:08:2d:a3:ba:f2:23:58:3d:82:46

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jun 9, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

73190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep MultiByteToWideChar WideCharToMultiByte CompareFileTime FindClose FindFirstFileW GetFileAttributesW GetLastError CreateDirectoryW ExpandEnvironmentStringsW lstrlenA WriteFile GetStdHandle lstrcmpW GetSystemTimeAsFileTime lstrlenW RemoveDirectoryW FindNextFileW DeleteFileW VirtualAlloc VirtualFree GetACP GetOEMCP GetUserDefaultUILanguage GetUserDefaultLCID GetTempPathW SetEnvironmentVariableW SetCurrentDirectoryW CloseHandle lstrcmpiW GetModuleFileNameW CreateThread GetVersionExW CreateFileW GetDriveTypeW GetModuleHandleW GetProcAddress LoadLibraryA MulDiv GetSystemDirectoryW TerminateThread ResumeThread SuspendThread LocalFree lstrcpyW FormatMessageW DeleteCriticalSection GetFileSize SetFilePointer ReadFile SetFileTime SetEndOfFile LeaveCriticalSection EnterCriticalSection WaitForMultipleObjects CreateEventW SetEvent ResetEvent InitializeCriticalSection GetModuleHandleA WaitForSingleObject GetExitCodeThread GetLocalTime SystemTimeToFileTime GetCommandLineW SetFileAttributesW GetStartupInfoA

user32

CharUpperW GetWindowLongW wsprintfW wsprintfA MessageBoxA GetKeyState SendMessageW wvsprintfW KillTimer GetSystemMenu EnableMenuItem SetTimer GetWindowTextW DefWindowProcW CallWindowProcW GetWindowDC DrawIconEx MessageBeep DialogBoxIndirectParamW GetWindow GetParent GetClientRect ClientToScreen GetWindowTextLengthW SetWindowPos GetDC DrawTextW ReleaseDC ShowWindow GetWindowRect ScreenToClient LoadIconW LoadImageW SetWindowLongW SetDlgItemTextW SystemParametersInfoW GetSystemMetrics GetDlgItem SetFocus EndDialog SetWindowTextW

gdi32

DeleteObject SelectObject GetDeviceCaps GetObjectW CreateFontIndirectW

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc ShellExecuteW ShellExecuteExW SHGetSpecialFolderPathW SHGetFileInfoW

ole32

CoCreateInstance CoInitialize

oleaut32

SysAllocString VariantClear

msvcrt

__set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit _except_handler3 _beginthreadex _CxxThrowException _purecall memset _wcsnicmp malloc free _wtol memcpy memmove memcmp __CxxFrameHandler ??3@YAXPAX@Z ??2@YAPAXI@Z _controlfp

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_a172f987eb6985cb61b9741c4513a43b_darkgate_elex_gcleaner_wannacry

kernel32

user32

gdi32

shell32

ole32

oleaut32

msvcrt

generic