2026-11-01_b1d70d930ccb763153921a6fd091174d_darkgate_elex_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_b1d70d930ccb763153921a6fd091174d_darkgate_elex_mafia
Size 1.8MB
Sample261102-nk1f4ssyet
SHA256 2d0c269de5daefd40925c41d6bf4a58daf114a63b08f25ecdaee2263230611e6
MD5 b1d70d930ccb763153921a6fd091174d
SHA1 dce8f435f81a5f3e080ef4f5fe782f8d35bd2bbb
SHA512 5268bbd6093a30de5a5d1873a61f478cb0e3934a0ee4d63cee7720fd3efd515cd5423ffa524d47fbf1ced079369131b6128d94f332b50ff0492a8fa5574d6825
SSDEEP 49152:aSMlD3uDLGB7qfEXtKbAiPy2RbyqT8vxU6u89p:aSMB3unGB7qfEXAAiPTevxUX89
TLSH
T1F695AD21B642C17AE8E311B19968777AD8389E29476418D3F3D83E7DBD70DD2AD3021E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_b1d70d930ccb763153921a6fd091174d_darkgate_elex_mafia

File Explorer

2026-11-01_b1d70d930ccb763153921a6fd091174d_darkgate_elex_mafia

.exe 1.8MB

2026-11-01_b1d70d930ccb763153921a6fd091174d_darkgate_elex_mafia

IMPHASH 79019f76ce61d226ea4e859872983d5d
SHA256 2d0c269de5daefd40925c41d6bf4a58daf114a63b08f25ecdaee2263230611e6
MD5 b1d70d930ccb763153921a6fd091174d
SHA1 dce8f435f81a5f3e080ef4f5fe782f8d35bd2bbb
SHA512 5268bbd6093a30de5a5d1873a61f478cb0e3934a0ee4d63cee7720fd3efd515cd5423ffa524d47fbf1ced079369131b6128d94f332b50ff0492a8fa5574d6825
SSDEEP 49152:aSMlD3uDLGB7qfEXtKbAiPy2RbyqT8vxU6u89p:aSMB3unGB7qfEXAAiPTevxUX89
TLSH
T1F695AD21B642C17AE8E311B19968777AD8389E29476418D3F3D83E7DBD70DD2AD3021E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

988721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\new-wellengine-ec2-new\EnchantedCavern2\bin\EC2.pdb

d3d8

Direct3DCreate8

dbghelp

MiniDumpWriteDump

dinput8

DirectInput8Create

openal32

alSourceUnqueueBuffers alGetError alGetString alBufferData alGenSources alSourcef alSourcePlay alSourcei alSourceStop alDeleteSources alGetSourcei alSourceQueueBuffers alSourcefv alcCloseDevice alcCreateContext alcOpenDevice alListenerf alListenerfv alcDestroyContext alcMakeContextCurrent alDeleteBuffers alGenBuffers

kernel32

GetConsoleCP SetFilePointer InitializeCriticalSectionAndSpinCount SetHandleCount HeapCreate HeapSize GetLocaleInfoW IsDebuggerPresent GetModuleHandleA ExitProcess QueryPerformanceCounter GetCurrentThread QueryPerformanceFrequency SetThreadAffinityMask CreateFileA SetErrorMode SetUnhandledExceptionFilter GetCurrentProcess GetLastError GetCurrentThreadId CloseHandle GetCurrentProcessId Sleep WideCharToMultiByte MultiByteToWideChar FreeLibrary CreateDirectoryA GetProcAddress LoadLibraryA FormatMessageA GetModuleFileNameA IsProcessorFeaturePresent GetVersionExA CreateFileW HeapFree GetProcessHeap WriteFile SetEvent WaitForSingleObject CreateEventA GetProcessAffinityMask GetConsoleMode EnterCriticalSection TlsAlloc SetLastError TlsGetValue GetThreadPriority DuplicateHandle SetThreadPriority TlsSetValue InterlockedDecrement TlsFree DeleteCriticalSection InitializeCriticalSection ResetEvent SetThreadContext GetThreadContext ResumeThread WaitForMultipleObjects UnhandledExceptionFilter TerminateProcess LCMapStringW GetCPInfo RaiseException CreateThread ExitThread GetTimeZoneInformation GetDateFormatA GetExitCodeProcess GetTimeFormatA MoveFileA CreateProcessA GetSystemTimeAsFileTime HeapReAlloc RtlUnwind GetModuleFileNameW GetStdHandle GetFileType WriteConsoleW HeapAlloc ReadFile GetModuleHandleW GetStartupInfoW HeapSetInformation GetCommandLineA DeleteFileA DecodePointer EncodePointer GetStringTypeW InterlockedExchange InterlockedIncrement FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetACP GetOEMCP IsValidCodePage LoadLibraryW CompareStringW GetFileAttributesA CreatePipe IsValidLocale SetStdHandle SetEndOfFile LeaveCriticalSection SetEnvironmentVariableA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA

user32

SetWindowPos ShowWindow ReleaseDC SystemParametersInfoA GetSystemMetrics AdjustWindowRect FindWindowA LoadCursorA RegisterClassA PeekMessageA CreateWindowExA SetWindowLongA SetRect TranslateMessage GetDC SendMessageA LoadIconA SetForegroundWindow IsIconic PostQuitMessage SetCursor MessageBoxA ToUnicodeEx GetKeyboardLayout GetKeyboardState GetCursorPos ScreenToClient CharToOemA DispatchMessageA DefWindowProcA

gdi32

GetDeviceCaps GetStockObject

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyA

shell32

SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation

ws2_32

WSAGetLastError WSASetLastError

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

199KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

99KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

347KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=152, version=20115,

count=70, id=158, productName=VS2010 build 30319, version=30319,

count=75, id=171, productName=VS2010 build 30319, version=30319,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=224, id=170, productName=VS2010 build 30319, version=30319,

count=22, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=2, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=28, version=9178,

count=77, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=5, id=25, version=9210,

count=205, id=1, productName=Unmarked objects,

count=192, id=175, version=30319,

count=1, id=154, productName=VS2010 build 30319, version=30319,

count=1, id=157, productName=VS2010 build 30319, version=30319,