2026-05-27_e44624f2f362e926c99b9489dcde1f84_amadey_darkgate_elex_glassworm_mespinoza_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-27_e44624f2f362e926c99b9489dcde1f84_amadey_darkgate_elex_glassworm_mespinoza_rhadamanthys_stop
Size 1.7MB
Sample260527-tml96aby2r
SHA256 c971fc86b1cd6e20406b19e6f43d145d1d0b8c253ba6e6655d4e9844fab79fc0
MD5 e44624f2f362e926c99b9489dcde1f84
SHA1 919b6f9a616bacb88b2848fa67ed231aaebd8ab1
SHA512 aa20a0362fa30918b93bb8a71cde6ae7ed985d164dc6a1929f0d867eb6f7320afb8fa2bcc0845aa866d763fae92df2890d22ab64e73985bbdb1731494a125734
SSDEEP 24576:cKipeP7WUtLpwbtLpwb9rJkQx4tUjS4bQ6t9Wnkdfs7W05jcAkSYqyEcx:VoCbtL2tLYIgjdsk9WnO0ZpYqY
TLSH
T1C1856B12F6548872D062807685A6A75DE6317811CB234FC72245DFEEBFF27E1A936332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-27_e44624f2f362e926c99b9489dcde1f84_amadey_darkgate_elex_glassworm_mespinoza_rhadamanthys_stop

File Explorer

2026-05-27_e44624f2f362e926c99b9489dcde1f84_amadey_darkgate_elex_glassworm_mespinoza_rhadamanthys_stop

.exe 1.7MB

2026-05-27_e44624f2f362e926c99b9489dcde1f84_amadey_darkgate_elex_glassworm_mespinoza_rhadamanthys_stop

IMPHASH 3f45af19ccf31050a09f034f7fc980a6
SHA256 c971fc86b1cd6e20406b19e6f43d145d1d0b8c253ba6e6655d4e9844fab79fc0
MD5 e44624f2f362e926c99b9489dcde1f84
SHA1 919b6f9a616bacb88b2848fa67ed231aaebd8ab1
SHA512 aa20a0362fa30918b93bb8a71cde6ae7ed985d164dc6a1929f0d867eb6f7320afb8fa2bcc0845aa866d763fae92df2890d22ab64e73985bbdb1731494a125734
SSDEEP 24576:cKipeP7WUtLpwbtLpwb9rJkQx4tUjS4bQ6t9Wnkdfs7W05jcAkSYqyEcx:VoCbtL2tLYIgjdsk9WnO0ZpYqY
TLSH
T1C1856B12F6548872D062807685A6A75DE6317811CB234FC72245DFEEBFF27E1A936332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

51:d6:e6:65:2d:61:99:d6:bf:00:07:dc:b5:f1:5e:06:9e:c3:67:75

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 31, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Minor OS version

Major OS version

Entry point

47785

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

P:\Target\x86\ship\misc_hev\x-none\msohtmed.pdb

kernel32

GetUserDefaultLangID GetCommandLineW ReleaseMutex ExitProcess CreateFileW CreateFileMappingW CreateProcessW GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExA GetLastError GetFileAttributesW GlobalFree GlobalAlloc DebugBreak ExpandEnvironmentStringsW GetACP MultiByteToWideChar CloseHandle SetFilePointer CreateMutexW ReadFile FreeLibrary VirtualQuery IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent GetSystemInfo InitializeSListHead SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryExW HeapFree HeapAlloc WerRegisterMemoryBlock VirtualProtect RaiseException GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId HeapSetInformation GetStartupInfoW GetProcessHeap QueryPerformanceCounter IsDebuggerPresent

advapi32

DeregisterEventSource ReportEventW RegSetValueExW RegQueryValueExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegisterEventSourceW

ole32

CoFileTimeNow CoUninitialize StgOpenStorage CoInitialize CoCreateInstance

vcruntime140

memset __telemetry_main_return_trigger __vcrt_InitializeCriticalSectionEx _except_handler4_common __telemetry_main_invoke_trigger

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _initialize_onexit_table _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _register_onexit_function _set_app_type _invalid_parameter_noinfo_noreturn terminate _controlfp_s _crt_atexit _cexit _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-27_e44624f2f362e926c99b9489dcde1f84_amadey_darkgate_elex_glassworm_mespinoza_rhadamanthys_stop

PE Signature issue

kernel32

advapi32

ole32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic