2026-04-15_1bac58bbd5d4543fb5e8e1a60cd87e9f_darkgate_elex_glassworm_hawkeye_maze_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-15_1bac58bbd5d4543fb5e8e1a60cd87e9f_darkgate_elex_glassworm_hawkeye_maze_remcos
Size 1.7MB
Sample260415-rl6ajagy2p
SHA256 17e0472d51daf4cd8eac25c36d264dc8dd3e0f0f582d5a2296d1d764fba1c4ca
MD5 1bac58bbd5d4543fb5e8e1a60cd87e9f
SHA1 92924f86d6c7fa068fb0e498fe41b701d0b80ec7
SHA512 11ad7ff858f8edd443c61a6f9900ae7acf4be6d794988922c603752cb919a5f070b8d0603a6c0af378cae8934c4ddc320d531906a2250001d350d06545223331
SSDEEP 24576:XRwofXVav9MkqxzfadB3ImBsbSAOidYrovp4Tp9aQCoGsXHRL:JQv9MRydB3ImBMO+YrovpU/9L
TLSH
T110857B31BE70C43AD66FD9B53A6B975DD029BD3087F001C7E3B95FB8AA601E00636616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_1bac58bbd5d4543fb5e8e1a60cd87e9f_darkgate_elex_glassworm_hawkeye_maze_remcos

File Explorer

2026-04-15_1bac58bbd5d4543fb5e8e1a60cd87e9f_darkgate_elex_glassworm_hawkeye_maze_remcos

.exe 1.7MB

2026-04-15_1bac58bbd5d4543fb5e8e1a60cd87e9f_darkgate_elex_glassworm_hawkeye_maze_remcos

IMPHASH 907cf5b9c00c513e347b1bb4516c2816
SHA256 17e0472d51daf4cd8eac25c36d264dc8dd3e0f0f582d5a2296d1d764fba1c4ca
MD5 1bac58bbd5d4543fb5e8e1a60cd87e9f
SHA1 92924f86d6c7fa068fb0e498fe41b701d0b80ec7
SHA512 11ad7ff858f8edd443c61a6f9900ae7acf4be6d794988922c603752cb919a5f070b8d0603a6c0af378cae8934c4ddc320d531906a2250001d350d06545223331
SSDEEP 24576:XRwofXVav9MkqxzfadB3ImBsbSAOidYrovp4Tp9aQCoGsXHRL:JQv9MRydB3ImBMO+YrovpU/9L
TLSH
T110857B31BE70C43AD66FD9B53A6B975DD029BD3087F001C7E3B95FB8AA601E00636616
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

60571

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AppVDllSurrogate32.pdb

kernel32

DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DecodePointer GetModuleHandleW GetProcAddress GetLastError GetSystemTimeAsFileTime InitializeCriticalSectionEx GetCurrentThreadId Sleep QueryPerformanceCounter IsProcessorFeaturePresent EncodePointer OutputDebugStringW IsDebuggerPresent GetCurrentProcessId GetLocalTime

advapi32

RegOpenKeyExW RegQueryValueExW EventWrite RegCloseKey

ole32

CoGetClassObject CoReleaseMarshalData CoInitializeEx CoMarshalInterface CoRegisterSurrogate CoInitializeSecurity CoUninitialize CoRevokeClassObject CoFreeUnusedLibraries CLSIDFromString CoRegisterClassObject

msvcp120

?_Syserror_map@std@@YAPBDH@Z ?_BADOFF@std@@3_JB ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z ?_Winerror_map@std@@YAPBDH@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?uncaught_exception@std@@YA_NXZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?exceptions@ios_base@std@@QAEXH@Z

msvcr120

_stricmp memmove free _purecall ??2@YAPAXI@Z _wcsicmp _wtoi iswdigit swprintf_s memset _lock _unlock _calloc_crt __dllonexit _onexit ??1type_info@@UAE@XZ _XcptFilter _amsg_exit __wgetmainargs __set_app_type exit _exit _cexit _configthreadlocale __setusermatherr _initterm_e _initterm __winitenv _fmode _commode ?terminate@@YAXXZ _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _except_handler4_common __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s ??3@YAXPAX@Z __CxxFrameHandler3 _CxxThrowException memcpy

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_1bac58bbd5d4543fb5e8e1a60cd87e9f_darkgate_elex_glassworm_hawkeye_maze_remcos

kernel32

advapi32

ole32

msvcp120

msvcr120

generic