2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc

General

Target
2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc
Size 400KB
Sample261029-weld1a115k
SHA256 659275c1fb82c7631ccc200a73c38841eafce776bfad8712cbbdf099fb530aed
MD5 055732476a4601b151a711902448c7e9
SHA1 61607b7bc4b52fa8470bab842ba326cd06368f61
SHA512 7b45e2de7a50ff207c96dc96e2ac7dba44d5727748bdedc685c85fff188a506bebfc5cdf9a6eb8d678b14f406c91d68dc08de73389e2f9229eee13484bece602
SSDEEP 12288:7wNdg2w9xtb6ruQmft1+B/5jrBuPAWONk:MN36j6ruPl1+B/JMUNk
TLSH
T174945C04B190D43DE1A251FA4969F62242BCBAA233B595C7BFD84D4D4BB48E07B3731B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc

File Explorer

2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc

.exe 400KB

2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc

IMPHASH a937ee21afc8da8c636807fc65975a17
SHA256 659275c1fb82c7631ccc200a73c38841eafce776bfad8712cbbdf099fb530aed
MD5 055732476a4601b151a711902448c7e9
SHA1 61607b7bc4b52fa8470bab842ba326cd06368f61
SHA512 7b45e2de7a50ff207c96dc96e2ac7dba44d5727748bdedc685c85fff188a506bebfc5cdf9a6eb8d678b14f406c91d68dc08de73389e2f9229eee13484bece602
SSDEEP 12288:7wNdg2w9xtb6ruQmft1+B/5jrBuPAWONk:MN36j6ruPl1+B/JMUNk
TLSH
T174945C04B190D43DE1A251FA4969F62242BCBAA233B595C7BFD84D4D4BB48E07B3731B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

164004

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess CreateThread GetModuleHandleA GetProcAddress EncodePointer DecodePointer GetLastError ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA RaiseException RtlUnwind IsProcessorFeaturePresent HeapSize IsDebuggerPresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FatalAppExitA UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetTickCount GetModuleHandleW CreateSemaphoreW GetStdHandle WriteFile GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThread GetCurrentThreadId GetProcessHeap FindClose FindFirstFileExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CloseHandle FlushFileBuffers GetConsoleCP GetConsoleMode GetFileType GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc OutputDebugStringW GetStringTypeW FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetFullPathNameW SetCurrentDirectoryW GetCurrentDirectoryW CreateFileW SetStdHandle SetFilePointerEx WriteConsoleW GetTimeZoneInformation SetEndOfFile ReadFile ReadConsoleW GetFullPathNameA SetEnvironmentVariableA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc

kernel32

generic