General

  • Target
    2026-06-04_ebbc690629e1c1d61fa6137f30d22558_darkgate_elex_emotet_gcleaner_glassworm_remcos_wannacry
  • Size 9.3MB
  • Sample260604-1sjvjsf171
  • SHA256 ba83f0f89a8c77b39132556a6cd388151c3b0558db75253398274161d72a3ff4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Signatures

  • Detects executables referencing many email and collaboration clients. Observed in information steale 1 IoCs
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 2026-06-04_ebbc690629e1c1d61fa6137f30d22558_darkgate_elex_emotet_gcleaner_glassworm_remcos_wannacry
    .exe 9.3MB

2026-06-04_ebbc690629e1c1d61fa6137f30d22558_darkgate_elex_emotet_gcleaner_glassworm_remcos_wannacry

  • IMPHASH e5190c5e183d406cdd77111381b80c0e
  • SHA256 ba83f0f89a8c77b39132556a6cd388151c3b0558db75253398274161d72a3ff4
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
396709
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths