Overview

overview

8

Static

static

1

2026-04-15...rm.exe

windows10-2004-x64

8

2026-04-15...rm.exe

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-04-15_751b99c0161b6d3f40fd4209c4ed9e9f_darkgate_elex_glassworm
  • Size 2.0MB
  • Sample260415-1vt4asds71
  • SHA256 2a417d738798c007476729105a66ace3088fe4cefb4b4200f480af779890fc73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverylateral_movementpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      2026-04-15_751b99c0161b6d3f40fd4209c4ed9e9f_darkgate_elex_glassworm
    • Size 2.0MB
    • SHA256 2a417d738798c007476729105a66ace3088fe4cefb4b4200f480af779890fc73
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoverylateral_movementpersistenceprivilege_escalation

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Remote Services: SMB/Windows Admin Shares

      Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

      lateral_movement
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks