2026-10-25_b97dc819f7a493ee1d099acc48fd4d8b_darkgate_elex_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_b97dc819f7a493ee1d099acc48fd4d8b_darkgate_elex_remcos_rhadamanthys_stop
Size 1.1MB
Sample261026-ry7n5aev9x
SHA256 98092d6800f85a9084be132437d5f8d16ba1d426b9b79693cd2f6a96380c86f6
MD5 b97dc819f7a493ee1d099acc48fd4d8b
SHA1 8f38f45199c465c283bc1f6002f7b7c6cbe969b2
SHA512 f3d0408d74b8496c2fcc97a1a427e377e3788428b563178c2b1d24c7bc50bccd5b137fe1bdb23e336f0d6d8f4eb6b7de59571ab5126e90e8ef39c75825e2fd92
SSDEEP 24576:6y0Hgd6Sb1JCseolRtsuLEDGACOZJI+FOL9ATfxfX2W0whQO1yD092W:AHgvBJttpz4RS9kfxT1yg9v
TLSH
T176450240BFCCD070D64618768596D736663E7E64272489C3A7F43B99AE306D2FE3930A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_b97dc819f7a493ee1d099acc48fd4d8b_darkgate_elex_remcos_rhadamanthys_stop

File Explorer

2026-10-25_b97dc819f7a493ee1d099acc48fd4d8b_darkgate_elex_remcos_rhadamanthys_stop

.exe 1.1MB

2026-10-25_b97dc819f7a493ee1d099acc48fd4d8b_darkgate_elex_remcos_rhadamanthys_stop

IMPHASH ca82a5627202369d5cd128342205d881
SHA256 98092d6800f85a9084be132437d5f8d16ba1d426b9b79693cd2f6a96380c86f6
MD5 b97dc819f7a493ee1d099acc48fd4d8b
SHA1 8f38f45199c465c283bc1f6002f7b7c6cbe969b2
SHA512 f3d0408d74b8496c2fcc97a1a427e377e3788428b563178c2b1d24c7bc50bccd5b137fe1bdb23e336f0d6d8f4eb6b7de59571ab5126e90e8ef39c75825e2fd92
SSDEEP 24576:6y0Hgd6Sb1JCseolRtsuLEDGACOZJI+FOL9ATfxfX2W0whQO1yD092W:AHgvBJttpz4RS9kfxT1yg9v
TLSH
T176450240BFCCD070D64618768596D736663E7E64272489C3A7F43B99AE306D2FE3930A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

158428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\362718\out\Release\360Tray.pdb

kernel32

SetFilePointer WriteFile DeviceIoControl CreateThread GetFileAttributesW SystemTimeToFileTime OpenEventW CopyFileW InterlockedExchange LCMapStringW LCMapStringA GetCPInfo GetStringTypeW RtlUnwind GetStartupInfoW ResumeThread GetSystemTimeAsFileTime ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetShortPathNameW LocalAlloc GetModuleHandleA SetLastError SetEvent CreateMutexW GetTickCount LoadLibraryW InterlockedCompareExchange Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo HeapWalk HeapLock OpenThread HeapUnlock OutputDebugStringW GetFileSizeEx SetFilePointerEx LocalFileTimeToFileTime lstrlenA lstrcmpiA lstrcmpA CreateFileA SetEndOfFile WriteConsoleW GetConsoleOutputCP ProcessIdToSessionId FreeResource GetSystemWindowsDirectoryW SetErrorMode MoveFileExW SetFileAttributesW DeleteFileW RemoveDirectoryW InterlockedIncrement InterlockedDecrement RaiseException CloseHandle lstrcmpiW lstrlenW OpenMutexW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte LoadLibraryExW FreeLibrary ReadFile CreateFileW GetWindowsDirectoryW GetPrivateProfileStringW GetModuleFileNameW GetCommandLineW GetModuleHandleW GetProcAddress GetVersionExW MultiByteToWideChar FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetLastError OpenProcess LocalFree GetVersion TerminateProcess WriteConsoleA GetLocaleInfoW SetStdHandle InitializeCriticalSectionAndSpinCount FlushFileBuffers GetConsoleMode GetConsoleCP GetSystemDirectoryW VirtualAlloc VirtualFree LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy HeapCreate ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentProcess WaitForSingleObject GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID CreateEventW ReleaseMutex GetACP GetOEMCP IsValidCodePage SetHandleCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA GetFileType

user32

PostMessageW FindWindowW GetActiveWindow CharNextW SendMessageTimeoutW IsWindow MessageBoxW UnregisterClassA LoadStringW

advapi32

RegEnumKeyExA RegQueryValueExA QueryServiceStatus StartServiceW CloseServiceHandle OpenServiceW OpenSCManagerW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW GetSidSubAuthority RegCreateKeyExW CreateProcessAsUserW GetLengthSid SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx RegSetValueExW RegQueryValueExW RegOpenKeyExW CheckTokenMembership CreateWellKnownSid DuplicateToken GetTokenInformation OpenProcessToken RegCloseKey ConvertSidToStringSidW LookupAccountSidW RegOpenKeyExA

shell32

SHGetFolderPathW ord680 ShellExecuteW ord165 SHGetSpecialFolderPathW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize

oleaut32

VarUI4FromStr

shlwapi

StrCmpIW SHSetValueW StrStrIW SHGetValueW PathAppendW PathFileExistsW PathRemoveFileSpecW PathCombineW ord437 wnsprintfW SHGetValueA SHSetValueA PathStripPathW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

rpcrt4

NdrAsyncClientCall RpcBindingFree RpcStringFreeW RpcAsyncCompleteCall RpcStringBindingComposeW RpcAsyncInitializeHandle RpcBindingFromStringBindingW

wininet

InternetOpenUrlW InternetCloseHandle HttpQueryInfoW InternetReadFile InternetSetOptionW DeleteUrlCacheEntryW InternetOpenW

userenv

GetUserProfileDirectoryW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_b97dc819f7a493ee1d099acc48fd4d8b_darkgate_elex_remcos_rhadamanthys_stop

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

rpcrt4

wininet

userenv

generic