General

  • Target
    2026-06-28_35e1ae56855bb295e698831fc36ea630_amadey_darkgate_elex_glassworm_krakenkeylogger_njrat_poet-rat_pos
  • Size 90.3MB
  • Sample260628-3dheaag19l
  • SHA256 c33934d64df079f97e7eff27ad70a54212b7737eda898002d9c5bef90e5c1653
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Signatures

  • Detects encrypted or obfuscated .NET executables 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 2026-06-28_35e1ae56855bb295e698831fc36ea630_amadey_darkgate_elex_glassworm_krakenkeylogger_njrat_poet-rat_pos
    .exe 90.3MB

2026-06-28_35e1ae56855bb295e698831fc36ea630_amadey_darkgate_elex_glassworm_krakenkeylogger_njrat_poet-rat_pos

  • IMPHASH 6f5425d35e50d19448c3a2a5b99b56a9
  • SHA256 c33934d64df079f97e7eff27ad70a54212b7737eda898002d9c5bef90e5c1653
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Detects encrypted or obfuscated .NET executables

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
6
Entry point
5171088
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x86.Release\Corehost.Static\singlefilehost.pdb