2026-10-28_99231500aa9f514e5f8a917e4b63ea74_darkgate_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_99231500aa9f514e5f8a917e4b63ea74_darkgate_elex_rhadamanthys_stop
Size 1.4MB
Sample261029-2x3c5agy5j
SHA256 7b6a5317cb7ed4e412b6dbcdc8ca27904e2ed98a001e9909b4f26044c94fc04a
MD5 99231500aa9f514e5f8a917e4b63ea74
SHA1 1da20a86760523ab96264fe4a2359075be020978
SHA512 a2da3357444e39cc068eb6dda1583ec9369c621d1c8e4e2fd64f5a58c887a6097366ee7142a8c4b63b35d7a95fc884476c4c36beffecc03be718a404d7fc3b44
SSDEEP 24576:Hca47LfTVuzVGATCUfN2nlu5mP+igAsaXa:YfTVmRTRfNugANX
TLSH
T1CD65F185BBE5C1B2E951567ACC56BF317A7BB9722B1342C363D40E382D213D16E3630A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_99231500aa9f514e5f8a917e4b63ea74_darkgate_elex_rhadamanthys_stop

File Explorer

2026-10-28_99231500aa9f514e5f8a917e4b63ea74_darkgate_elex_rhadamanthys_stop

.exe 1.4MB

2026-10-28_99231500aa9f514e5f8a917e4b63ea74_darkgate_elex_rhadamanthys_stop

IMPHASH 54d85d6d123e312c89d5f1445ff6c90b
SHA256 7b6a5317cb7ed4e412b6dbcdc8ca27904e2ed98a001e9909b4f26044c94fc04a
MD5 99231500aa9f514e5f8a917e4b63ea74
SHA1 1da20a86760523ab96264fe4a2359075be020978
SHA512 a2da3357444e39cc068eb6dda1583ec9369c621d1c8e4e2fd64f5a58c887a6097366ee7142a8c4b63b35d7a95fc884476c4c36beffecc03be718a404d7fc3b44
SSDEEP 24576:Hca47LfTVuzVGATCUfN2nlu5mP+igAsaXa:YfTVmRTRfNugANX
TLSH
T1CD65F185BBE5C1B2E951567ACC56BF317A7BB9722B1342C363D40E382D213D16E3630A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

253014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\895793\out\Release\360zipUpdate.pdb

kernel32

SizeofResource GetVersionExW LeaveCriticalSection MulDiv GetModuleFileNameW CreateFileW MultiByteToWideChar lstrlenW WritePrivateProfileStringW FlushInstructionCache GetTempPathW RaiseException GetPrivateProfileIntW GetLastError SetLastError GetProcAddress EnterCriticalSection FindClose LockResource CreateEventW lstrcmpiW FindNextFileW DeleteCriticalSection GetCurrentThreadId CloseHandle GetVersion DeleteFileW GetCurrentProcessId LocalFree GetModuleFileNameA CreateProcessW MoveFileExW OpenProcess GetPrivateProfileStringA DeviceIoControl WaitForMultipleObjects InterlockedExchange WideCharToMultiByte GetFileSizeEx GetCPInfoExW SetEndOfFile ReadFile GetCurrentThread GetThreadContext VirtualQuery SetThreadPriority VirtualAlloc OpenThread GetSystemInfo GetThreadPriority VirtualProtect InterlockedDecrement InterlockedIncrement SetStdHandle GetConsoleOutputCP WriteConsoleA GetLocaleInfoW GetModuleHandleA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetStartupInfoA SetHandleCount GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP HeapCreate IsValidCodePage GetOEMCP GetACP CompareStringW GetStringTypeW LCMapStringA LCMapStringW RtlUnwind GetStartupInfoW GetStdHandle GetFileType WriteConsoleW GetCPInfo CreateThread ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsAlloc ReleaseMutex HeapWalk HeapLock HeapUnlock TlsSetValue OutputDebugStringW TlsGetValue SetFilePointerEx LocalFileTimeToFileTime GetSystemTimeAsFileTime SystemTimeToFileTime CreateFileA GetLocaleInfoA LocalAlloc HeapSize HeapReAlloc HeapDestroy VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc Sleep LoadLibraryW GetSystemDirectoryW InitializeCriticalSection WriteFile GetPrivateProfileStringW GetTickCount GetModuleHandleW SetEvent InterlockedCompareExchange WaitForSingleObject GetSystemWindowsDirectoryW SuspendThread GetCurrentProcess LoadLibraryExW LoadResource FreeLibrary FindResourceW FindResourceExW FreeResource SetFilePointer FindFirstFileW CreateMutexW GetTempFileNameW GetCommandLineW GetProcessHeap HeapFree ResumeThread ExitProcess

user32

SetWindowTextW GetWindow UnregisterClassA DispatchMessageW GetMonitorInfoW DefWindowProcW GetLastInputInfo LoadCursorW RegisterClassExW MoveWindow SetWindowRgn SetTimer ScreenToClient PostQuitMessage TrackPopupMenu LoadImageW PostMessageW DrawTextW KillTimer GetSubMenu SetForegroundWindow GetWindowInfo WindowFromPoint GetForegroundWindow LoadIconW OffsetRect InvalidateRect LoadMenuW GetAncestor GetDesktopWindow GetCursorPos IsWindow FindWindowExW CreateWindowExW GetSystemMetrics IsWindowVisible SendMessageW DestroyMenu GetWindowThreadProcessId GetShellWindow EndPaint DestroyWindow GetWindowRect GetMessageW CharNextW DialogBoxParamW GetParent GetClientRect BeginPaint GetDC TranslateMessage GetWindowLongW PeekMessageW ReleaseDC MonitorFromWindow GetDlgItem SetWindowLongW EndDialog SetWindowPos ShowWindow CreateDialogParamW GetActiveWindow MessageBoxW MapWindowPoints IntersectRect

gdi32

CreateDIBSection CreateCompatibleDC GetObjectW SetStretchBltMode SetBkMode DeleteObject SelectObject CreateRoundRectRgn CreateSolidBrush DeleteDC GetDeviceCaps CreateFontW

advapi32

RegOpenKeyExW GetTokenInformation OpenProcessToken RegSetValueExW RegCloseKey RegEnumKeyExW RegQueryValueExA RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegQueryValueExW RegCreateKeyExW

shell32

Shell_NotifyIconW CommandLineToArgvW SHGetSpecialFolderPathW ShellExecuteExW ord165 ShellExecuteW ord680

ole32

OleUninitialize OleInitialize CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoTaskMemAlloc

oleaut32

SysStringLen VariantInit SysAllocStringByteLen VariantClear SysAllocString SysFreeString SysStringByteLen VarUI4FromStr

shlwapi

PathCombineW PathAppendW StrCmpIW SHSetValueW PathAddBackslashW StrStrIW StrStrIA SHGetValueW PathRemoveFileSpecW PathFindFileNameW PathIsRelativeW PathFileExistsW

psapi

GetModuleFileNameExW EnumProcessModules EnumProcesses GetModuleBaseNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_99231500aa9f514e5f8a917e4b63ea74_darkgate_elex_rhadamanthys_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

generic