General
- Target 2026-06-28_d606f138d71a25a32022fb4b8488fd24_darkgate_elex_floxif_glassworm_maze_remcos
- Size 2.2MB
- Sample260628-xe59vacv2m
- SHA256 ddcfdee4425deefe3ae16c7a4d8018eab8743b6c59acbc0cf91b5fb9927dcbd1
- MD5 d606f138d71a25a32022fb4b8488fd24
- SHA1 6add6bd013adbd46481b8dae76c13cc125df20d3
- SHA512 073aabfaf239aa3ab2e6d5dd62117378bf5a24dc179a4df8af63a5a8f7c97a29285c20087c0c351672fa8bebd84a4e36ac79977130f901951a1b2a1e9167d5e0
- SSDEEP 49152:IKEzNX8Qv0rTGjsl/TjSvSU+93Ie/JqTTvFMBNSa4LF1SY:IKEzNVv0rd6vSU+1Ies6BN+
- TLSH T19DB5CF63BBC1C0B6E2A20230546AA3294ABEBE75573089CF53D43F1D5D715C2E93A367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-28_d606f138d71a25a32022fb4b8488fd24_darkgate_elex_floxif_glassworm_maze_remcos.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_d606f138d71a25a32022fb4b8488fd24_darkgate_elex_floxif_glassworm_maze_remcos.exe
Resource
win11ltsc2024-20260617-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_d606f138d71a25a32022fb4b8488fd24_darkgate_elex_floxif_glassworm_maze_remcos
- Size 2.2MB
- SHA256 ddcfdee4425deefe3ae16c7a4d8018eab8743b6c59acbc0cf91b5fb9927dcbd1
- MD5 d606f138d71a25a32022fb4b8488fd24
- SHA1 6add6bd013adbd46481b8dae76c13cc125df20d3
- SHA512 073aabfaf239aa3ab2e6d5dd62117378bf5a24dc179a4df8af63a5a8f7c97a29285c20087c0c351672fa8bebd84a4e36ac79977130f901951a1b2a1e9167d5e0
- SSDEEP 49152:IKEzNX8Qv0rTGjsl/TjSvSU+93Ie/JqTTvFMBNSa4LF1SY:IKEzNVv0rd6vSU+1Ies6BN+
- TLSH T19DB5CF63BBC1C0B6E2A20230546AA3294ABEBE75573089CF53D43F1D5D715C2E93A367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.