2026-10-26_b434e9d9864c3f7a8cff3c20e9c99be9_badda_darkgate_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_b434e9d9864c3f7a8cff3c20e9c99be9_badda_darkgate_elex_rhadamanthys_stop
Size 677KB
Sample261027-kqv7sssxes
SHA256 07af2b7e34eba729f981089d66700ef345d42ba2cfa17fbd48a7016911522a75
MD5 b434e9d9864c3f7a8cff3c20e9c99be9
SHA1 bf201b161ee3ab44eaf123c046eaf2376b4f665e
SHA512 3b84798a92c99f479813e5421450ee835c8e3d74f7ff723703f29de6c9a9d64e628ce1e21a17e16b01896353a7fc622b5826b3cae32b2d5945885bc4f207d915
SSDEEP 12288:aP3dg+WeBMAGrAxmSpyc6njp5EH9aACTXQpdeF0PyHZVKdEvS:aPMrUsc8yaACTXQU6
TLSH
T13AE4AFBB62D54079C4900176DE71B719BEFDA874EB21E2C3910DD92E28E13D4823E7B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_b434e9d9864c3f7a8cff3c20e9c99be9_badda_darkgate_elex_rhadamanthys_stop

File Explorer

2026-10-26_b434e9d9864c3f7a8cff3c20e9c99be9_badda_darkgate_elex_rhadamanthys_stop

.exe 677KB

2026-10-26_b434e9d9864c3f7a8cff3c20e9c99be9_badda_darkgate_elex_rhadamanthys_stop

IMPHASH 0729bec9d95e7c57469deddf71ff2a49
SHA256 07af2b7e34eba729f981089d66700ef345d42ba2cfa17fbd48a7016911522a75
MD5 b434e9d9864c3f7a8cff3c20e9c99be9
SHA1 bf201b161ee3ab44eaf123c046eaf2376b4f665e
SHA512 3b84798a92c99f479813e5421450ee835c8e3d74f7ff723703f29de6c9a9d64e628ce1e21a17e16b01896353a7fc622b5826b3cae32b2d5945885bc4f207d915
SSDEEP 12288:aP3dg+WeBMAGrAxmSpyc6njp5EH9aACTXQpdeF0PyHZVKdEvS:aPMrUsc8yaACTXQU6
TLSH
T13AE4AFBB62D54079C4900176DE71B719BEFDA874EB21E2C3910DD92E28E13D4823E7B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

708608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\FP_Win_NF\FP_Geary_169\code\build\win\results\FlashPlayerApp\Release\Win32\FlashPlayerApp.pdb

uxtheme

GetCurrentThemeName

kernel32

CreateDirectoryW GetLastError WideCharToMultiByte GetCommandLineW SetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetVersion LoadLibraryA LoadLibraryW GetModuleFileNameW OutputDebugStringA RaiseException EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetCurrentProcess FlushInstructionCache GetUserDefaultUILanguage GetVersionExA CreateProcessW WaitForSingleObject GetExitCodeProcess GetVersionExW SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle CreateFileA GetLocaleInfoA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW InitializeCriticalSectionAndSpinCount IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP SetFilePointer ReadFile RtlUnwind GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA GetStdHandle WriteFile HeapReAlloc CloseHandle GetFileSizeEx CreateFileW GetFileAttributesW DeleteFileW FindClose FindNextFileW FindFirstFileW SystemTimeToFileTime GetSystemTime RemoveDirectoryW MultiByteToWideChar HeapCreate HeapSize InterlockedDecrement InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue InitializeCriticalSection DeleteCriticalSection InterlockedCompareExchange HeapFree GetProcessHeap HeapAlloc IsProcessorFeaturePresent VirtualFree VirtualAlloc Sleep ExitProcess GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent

user32

CreateWindowExW ClientToScreen ReleaseDC GetDC GetNextDlgTabItem UnregisterClassA EndDialog GetWindowTextW GetWindowTextLengthW SetFocus DestroyWindow SystemParametersInfoW SetScrollPos GetScrollInfo EndPaint BeginPaint ScrollWindowEx GetFocus InvalidateRect SetWindowPos MapWindowPoints GetWindowRect SetScrollInfo DialogBoxParamW GetWindow GetSysColor GetDlgItem SetWindowTextW EnableWindow ShowWindow MoveWindow CallWindowProcW CreateDialogParamW GetWindowLongW DefWindowProcW GetActiveWindow MessageBoxW SetWindowLongW GetParent FillRect GetSysColorBrush GetClientRect SendMessageW GetDesktopWindow UpdateWindow

gdi32

GetTextExtentPoint32W SelectObject SetViewportOrgEx SetBkColor SetTextColor

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW ShellExecuteExW SHGetFolderPathW SHFileOperationW

ole32

CoTaskMemFree

Name

.text

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

429KB

Virtual Size

429KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.BadDay

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_b434e9d9864c3f7a8cff3c20e9c99be9_badda_darkgate_elex_rhadamanthys_stop

uxtheme

kernel32

user32

gdi32

advapi32

shell32

ole32

generic