2026-11-01_f119bd0076c3f234f93f91e6f7640c5d_darkgate_elex_phorpiex_stealc_stop

General

Target
2026-11-01_f119bd0076c3f234f93f91e6f7640c5d_darkgate_elex_phorpiex_stealc_stop
Size 392KB
Sample261102-d3zmesew9y
SHA256 cbf892d80625c4478181891c10a5b61166912fe1e2c83972549f8a8b7c69d9ab
MD5 f119bd0076c3f234f93f91e6f7640c5d
SHA1 a0a05f6d37c9dee0657eacbedc433631196517ff
SHA512 95a6d12a1ec9bf6f5ef36a7eec918cd8ca350d1df7d7ac62020a2a3aaaa041db3f3fdc8325a9d84ec2af3139a4e69bf7176ccffab4ff15e4939bd62bc15bcf76
SSDEEP 6144:Lr+6wk98eNNO0GRBk/DXqQrK57Sxh0LNvLeoMhlQiydrfuwANDJ8D6h4:Lqq64NEG/DXvLxujexh4Oh26h4
TLSH
T10F849E00FBD6C0B2E9662A700CBEB715667FB614173489D763E81C5E1F63BE1A831396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_f119bd0076c3f234f93f91e6f7640c5d_darkgate_elex_phorpiex_stealc_stop

File Explorer

2026-11-01_f119bd0076c3f234f93f91e6f7640c5d_darkgate_elex_phorpiex_stealc_stop

.exe 392KB

2026-11-01_f119bd0076c3f234f93f91e6f7640c5d_darkgate_elex_phorpiex_stealc_stop

IMPHASH 242ea5e2c9806b16138fcc3e03d59d58
SHA256 cbf892d80625c4478181891c10a5b61166912fe1e2c83972549f8a8b7c69d9ab
MD5 f119bd0076c3f234f93f91e6f7640c5d
SHA1 a0a05f6d37c9dee0657eacbedc433631196517ff
SHA512 95a6d12a1ec9bf6f5ef36a7eec918cd8ca350d1df7d7ac62020a2a3aaaa041db3f3fdc8325a9d84ec2af3139a4e69bf7176ccffab4ff15e4939bd62bc15bcf76
SSDEEP 6144:Lr+6wk98eNNO0GRBk/DXqQrK57Sxh0LNvLeoMhlQiydrfuwANDJ8D6h4:Lqq64NEG/DXvLxujexh4Oh26h4
TLSH
T10F849E00FBD6C0B2E9662A700CBEB715667FB614173489D763E81C5E1F63BE1A831396
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

479232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Projects\WinRAR\rar\build\rar32\Release\RAR.pdb

kernel32

LocalFree FormatMessageW CloseHandle GetCurrentProcess CreateFileW BackupRead BackupSeek SetFileTime MoveFileW FlushFileBuffers SetFilePointer SetEndOfFile GetFileTime GetFileType CreateFileA ReadFile WriteFile GetDriveTypeA GetDiskFreeSpaceA GetVolumeInformationA GetFileAttributesA GetFileAttributesW SetFileAttributesA SetFileAttributesW MoveFileA DeleteFileA DeleteFileW RemoveDirectoryA RemoveDirectoryW DeviceIoControl CreateDirectoryA CreateDirectoryW ExpandEnvironmentStringsW ExpandEnvironmentStringsA FindClose FindNextFileA FindFirstFileA FindNextFileW FindFirstFileW GetVersionExW CreateThread SetConsoleCtrlHandler GetProcessAffinityMask WaitForSingleObject SetEvent ResetEvent WaitForMultipleObjects CreateEventW GetFullPathNameA GetFullPathNameW GetModuleFileNameA GetModuleFileNameW SetErrorMode FreeLibrary LoadLibraryW LoadLibraryExW CompareStringA SetThreadPriority GetCurrentThread SetPriorityClass SetCurrentDirectoryA GetCurrentDirectoryA LocalFileTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime WideCharToMultiByte MultiByteToWideChar CompareStringW IsDBCSLeadByte GetCPInfo WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle SetEnvironmentVariableA GetLocaleInfoA Sleep GetLastError GetCurrentDirectoryW GetTickCount GetSystemTime SystemTimeToFileTime GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleW GetModuleHandleW GetProcAddress ExitThread SetLastError GetStringTypeW GetStringTypeA GetConsoleCP GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree HeapReAlloc HeapAlloc RtlUnwind GetModuleHandleA ExitProcess GetCommandLineA HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement RaiseException GetACP GetOEMCP IsValidCodePage HeapSize LoadLibraryA GetVersion InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetStartupInfoA

user32

CharLowerW ExitWindowsEx CharUpperA CharLowerA LoadStringW CharUpperW OemToCharBuffW CharToOemA CharToOemBuffA OemToCharA OemToCharBuffA CharToOemBuffW

advapi32

RegQueryValueExW RegOpenKeyExA RegQueryValueExA RegCloseKey GetFileSecurityW GetFileSecurityA GetSecurityDescriptorLength SetFileSecurityW SetFileSecurityA OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW

shell32

SHGetPathFromIDListW SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListA SHFileOperationW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_f119bd0076c3f234f93f91e6f7640c5d_darkgate_elex_phorpiex_stealc_stop

kernel32

user32

advapi32

shell32

generic