2026-05-07_b2ff72c16374fcfa53df34b37ff37cba_darkgate_elex_glassworm_helldown_luca-stealer_mespinoza_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-07_b2ff72c16374fcfa53df34b37ff37cba_darkgate_elex_glassworm_helldown_luca-stealer_mespinoza_njrat_revil
Size 16.0MB
Sample260507-e5h8wsaz9m
SHA256 336af456ab7d7c978ab77823d06a036f0f56ef7678e53322452b0acbfc8fd142
MD5 b2ff72c16374fcfa53df34b37ff37cba
SHA1 e5069b58c61fe6acf6befbec56fd96f7fddf8de2
SHA512 f944c5d99b3317b71a8e2218c511b6a62ced1030216a6d3784138768ea14aa57850aafd20a9532e0be1fca35dbccb5b3bb58995f55342374f4c2c45ee3e2cdac
SSDEEP 196608:EYaMBdMB07zaB/Jq8eRs5fKCJTqKhBsv+13qRLQyh/QpPX+F/egNOiAkdb/XeE:L7p8Iu+KiMqRP/QpvwWgVdLXeE
TLSH
T1A0F6AE81E78355D2D6860570E96EA73F1B392E1C07E0D9F3F2C0BAE4B8716D13639689
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-07_b2ff72c16374fcfa53df34b37ff37cba_darkgate_elex_glassworm_helldown_luca-stealer_mespinoza_njrat_revil

File Explorer

2026-05-07_b2ff72c16374fcfa53df34b37ff37cba_darkgate_elex_glassworm_helldown_luca-stealer_mespinoza_njrat_revil

.exe 16.0MB

2026-05-07_b2ff72c16374fcfa53df34b37ff37cba_darkgate_elex_glassworm_helldown_luca-stealer_mespinoza_njrat_revil

IMPHASH ef72d33892796eec8e8786b814494f7f
SHA256 336af456ab7d7c978ab77823d06a036f0f56ef7678e53322452b0acbfc8fd142
MD5 b2ff72c16374fcfa53df34b37ff37cba
SHA1 e5069b58c61fe6acf6befbec56fd96f7fddf8de2
SHA512 f944c5d99b3317b71a8e2218c511b6a62ced1030216a6d3784138768ea14aa57850aafd20a9532e0be1fca35dbccb5b3bb58995f55342374f4c2c45ee3e2cdac
SSDEEP 196608:EYaMBdMB07zaB/Jq8eRs5fKCJTqKhBsv+13qRLQyh/QpPX+F/egNOiAkdb/XeE:L7p8Iu+KiMqRP/QpvwWgVdLXeE
TLSH
T1A0F6AE81E78355D2D6860570E96EA73F1B392E1C07E0D9F3F2C0BAE4B8716D13639689
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5236214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

crypt32

CertOpenStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertFreeCertificateContext CertGetCertificateContextProperty

winmm

timeEndPeriod timeGetTime timeBeginPeriod

powrprof

GetCurrentPowerPolicies

winspool.drv

GetPrintProcessorDirectoryA DeletePrinter EnumPrinterDriversW OpenPrinterA EnumPrintProcessorsW ClosePrinter AddPrinterA

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW CM_Get_Device_Interface_ListW CM_Get_Device_Interface_List_SizeW SetupDiGetDeviceInterfaceDetailW SetupDiSetClassInstallParamsW SetupDiChangeState SetupFindFirstLineW SetupOpenInfFileW SetupGetStringFieldW SetupCloseInfFile SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA SetupDiDestroyDeviceInfoList

hid

HidP_GetCaps HidD_GetPreparsedData HidD_FreePreparsedData HidD_SetNumInputBuffers HidD_GetAttributes HidD_GetHidGuid

kernel32

VirtualFree VirtualAlloc VirtualAllocEx FlushInstructionCache CreateRemoteThread lstrcpyA GetSystemTime GetTempFileNameA ProcessIdToSessionId TerminateThread GetLocalTime SetConsoleCtrlHandler GetSystemTimes CompareFileTime GetDiskFreeSpaceExW GetWindowsDirectoryW DeviceIoControl CreateFileA OutputDebugStringW GetSystemDirectoryW FreeResource VirtualQuery GlobalAddAtomW GlobalSize WaitForSingleObjectEx GetConsoleMode WriteConsoleW GetProcessAffinityMask GetThreadPriority ReadConsoleA GetEnvironmentVariableW GlobalMemoryStatus ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber SwitchToThread CreateWaitableTimerW SetWaitableTimer HeapQueryInformation SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA SetEndOfFile SetStdHandle GetCurrentDirectoryW ReadConsoleW FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID VirtualProtect GetTimeFormatW GetDateFormatW GetACP ExitProcess GetTimeZoneInformation SetFilePointerEx GetConsoleCP GetModuleHandleExW FreeLibraryAndExitThread ExitThread SetConsoleMode GetCommandLineW CreateDirectoryW GetFileAttributesExW GetFileType GetDriveTypeW LoadLibraryExW RtlUnwind SetConsoleTextAttribute GetConsoleScreenBufferInfo CreateSemaphoreA CreateEventA LoadLibraryExA InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetStringTypeW DisconnectNamedPipe PeekNamedPipe CreateNamedPipeA SetUnhandledExceptionFilter OpenMutexW CreateMutexW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetUserDefaultLangID FileTimeToDosDateTime GetFileTime GetSystemDirectoryA QueryPerformanceCounter QueryPerformanceFrequency GetProcessId WriteProcessMemory VerifyVersionInfoW VerSetConditionMask MoveFileExW GetExitCodeThread OpenEventW GetNativeSystemInfo IsValidLocale SetProcessShutdownParameters GetModuleHandleA GetProcAddress GetTickCount HeapFree EnterCriticalSection ReleaseSemaphore InterlockedDecrement WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection InitializeCriticalSection WaitForSingleObject HeapSize CreateEventW GetLastError SetEvent HeapReAlloc CloseHandle RaiseException ResetEvent HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap SetPriorityClass CreateDirectoryA GetTempPathW InterlockedCompareExchange SetLastError GetExitCodeProcess LocalAlloc WritePrivateProfileStringA WritePrivateProfileStringW TryEnterCriticalSection ConnectNamedPipe GlobalUnlock MapViewOfFile CreateFileMappingW WideCharToMultiByte CopyFileW GetModuleHandleW CreateProcessW GetCurrentProcessId LocalFree GlobalLock FindResourceW LoadResource FindResourceExW GetSystemInfo GlobalFree Process32FirstW DeleteFileW GlobalAlloc LockResource GetCurrentThread Process32NextW GetTempPathA CreateToolhelp32Snapshot GetCommandLineA GetVersion UnmapViewOfFile OpenFileMappingW ReleaseMutex GetFileAttributesW CreateFileW CreateMutexA GetModuleFileNameW TerminateProcess FindNextFileW FindFirstFileW SizeofResource GetModuleFileNameA ReadFile LoadLibraryA SystemTimeToFileTime GetVersionExW GetCurrentProcess GetFullPathNameW GetSystemTimeAsFileTime InterlockedExchange TlsFree TlsGetValue CreateThread TlsAlloc Sleep ResumeThread SetThreadPriority TlsSetValue MultiByteToWideChar IsDebuggerPresent FreeLibrary LoadLibraryW GetCurrentThreadId OutputDebugStringA WriteFile GetStdHandle InterlockedIncrement CreateSemaphoreW FindClose

user32

GetClassInfoW WindowFromPoint SetActiveWindow GetIconInfo IsRectEmpty OffsetRect GetDesktopWindow SetRectEmpty RegisterWindowMessageW IntersectRect MsgWaitForMultipleObjects ChangeClipboardChain GetOpenClipboardWindow GetClipboardOwner SetClipboardViewer GetPropW SendMessageTimeoutW PostQuitMessage DrawIconEx GetSysColor PeekMessageW SetWindowPos GetProcessWindowStation GetMonitorInfoA EnumDisplaySettingsA UnregisterClassW ReleaseDC SetForegroundWindow SystemParametersInfoW SetClipboardData GetWindowDC GetClipboardData GetForegroundWindow AttachThreadInput EmptyClipboard CloseClipboard OpenClipboard IsWindow ShowWindow GetKeyboardState IsWindowVisible PostMessageW GetWindowThreadProcessId GetWindowLongW GetDC MessageBoxW SendMessageW FindWindowExW SendInput GetGUIThreadInfo GetClassInfoExW KillTimer PostThreadMessageW SetWindowLongW LoadCursorW TranslateMessage LockWorkStation ClientToScreen SetTimer DispatchMessageW RegisterClassExW GetSystemMetrics CreateWindowExW MapVirtualKeyW CallWindowProcW GetKeyState DefWindowProcW GetMessageW DrawIcon GetClientRect SetWindowsHookExW SetPropW UnhookWindowsHookEx RemovePropW VkKeyScanW RegisterClassW EnumDisplaySettingsW EnumDisplayDevicesW GetCursorPos OpenInputDesktop CloseDesktop GetThreadDesktop SetThreadDesktop GetUserObjectInformationA SetCursorPos SetRect GetClipCursor GetCursorInfo EnumDisplayDevicesA GetMonitorInfoW EnumDisplayMonitors PtInRect SetLayeredWindowAttributes GetDialogBaseUnits GetUpdateRgn RegisterClipboardFormatW CallNextHookEx DialogBoxIndirectParamW EndDialog DestroyWindow GetWindowRect RegisterClipboardFormatA GetPriorityClipboardFormat ChangeDisplaySettingsExA EnumDisplaySettingsExA ExitWindowsEx EnumDisplaySettingsExW ChangeDisplaySettingsExW InvalidateRect SwapMouseButton GetParent OpenDesktopW GetDoubleClickTime BlockInput EnumWindows GetUserObjectInformationW DrawTextW

gdi32

StretchBlt GetDIBits GdiFlush SetDIBitsToDevice CreateRectRgn GetRegionData CreateRectRgnIndirect SelectClipRgn CombineRgn GetRgnBox SetDIBColorTable CreateFontIndirectW ExtEscape GetDIBColorTable CreateDCW GetPixel GetBitmapBits GetObjectW BitBlt CreateDIBSection CreateFontW GetStockObject SetTextColor SetBkMode LineTo CreatePen Rectangle MoveToEx Ellipse DeleteObject CreateSolidBrush GetDeviceCaps SelectObject CreateCompatibleDC DeleteDC

advapi32

ChangeServiceConfigW OpenProcessToken CryptReleaseContext RegQueryValueExW CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource RegEnumKeyExW CryptAcquireContextA RegQueryInfoKeyW CryptGenRandom RegCreateKeyW EnumServicesStatusW SetSecurityInfo BuildTrusteeWithSidW GetSecurityInfo QueryServiceStatus UnlockServiceDatabase CloseServiceHandle OpenSCManagerW LockServiceDatabase ControlService StartServiceW OpenServiceW QueryServiceStatusEx LookupPrivilegeValueW AdjustTokenPrivileges SetSecurityDescriptorDacl RegCloseKey CryptAcquireContextW SetTokenInformation AllocateAndInitializeSid SetEntriesInAclW CreateWellKnownSid RegCreateKeyExW CryptCreateHash RegSetValueExW CryptDestroyHash FreeSid CheckTokenMembership InitializeSecurityDescriptor RegOpenKeyExW CreateProcessAsUserW RegDeleteValueW GetUserNameW DuplicateTokenEx

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteExA DragQueryFileW DragQueryPoint ord727 SHGetFileInfoW ShellExecuteExW SHGetFolderPathW

ole32

OleUninitialize OleInitialize CoInitialize ReleaseStgMedium OleSetClipboard DoDragDrop CreateStreamOnHGlobal CoCreateInstance CoUninitialize StringFromGUID2 CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc RegisterDragDrop

oleaut32

SysAllocStringByteLen SysStringByteLen SysFreeString SysAllocString

shlwapi

PathRemoveFileSpecW PathFileExistsW PathFileExistsA PathRemoveFileSpecA StrStrIA PathFindExtensionW PathStripPathW

userenv

CreateEnvironmentBlock

ws2_32

gethostbyname WSAGetLastError setsockopt ioctlsocket getsockopt recv getaddrinfo freeaddrinfo shutdown WSASetLastError inet_addr gethostbyaddr getservbyport ntohs inet_ntoa getservbyname htonl htons __WSAFDIsSet select WSACleanup WSAStartup accept bind closesocket listen getpeername getsockname send socket connect

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

gdiplus

GdipGetImagePixelFormat GdipDisposeImage GdipFree GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImageWidth GdipCreateBitmapFromScan0 GdipDrawImageI GdiplusStartup GdiplusShutdown GdipBitmapLockBits GdipGetImageHeight GdipGetImagePalette GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipAlloc GdipCreateBitmapFromStream

msimg32

TransparentBlt AlphaBlend

dbghelp

SymCleanup SymGetModuleBase64 SymGetModuleInfo64 SymGetLineFromAddr64 SymFunctionTableAccess64 SymInitialize StackWalk64 SymGetSymFromAddr64

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

11.0MB

Virtual Size

11.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

140KB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.custom

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

594KB

Virtual Size

594KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=50, id=241, version=40116,

count=211, id=243, version=40116,

count=67, id=242, version=40116,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=811, id=260, version=24234,

count=3, id=261, version=23013,

count=9, id=199, version=41118,

count=45, id=259, version=24123,

count=41, id=260, version=24123,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=71, id=261, version=24123,

count=2, id=239, version=40116,

count=612, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=212, productName=Unmarked objects (old),

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=744, id=1, productName=Unmarked objects,

count=463, id=265, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,