2026-06-27_9db0ad63551dc1dfb5e9c00a570681b2_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_9db0ad63551dc1dfb5e9c00a570681b2_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat
Size 1.1MB
Sample260629-e8m19ads3t
SHA256 35582b0a0cae5c315c3bba110c1d51f41ced6bb0c7087a048fe10249e7aba8f3
MD5 9db0ad63551dc1dfb5e9c00a570681b2
SHA1 f5d52260f4f8fd2a8e919c3ff9e1440dbedb411a
SHA512 463fbd6438c08682addb4aa650f4e64c9db5894b289627841d79cb892709aa329f4e07b8bce85f4ae507d2b0fce25e7f1111b1763939ce39345c0d902b2d4ca5
SSDEEP 24576:YPHeMy8QQGeQrRUm7KAd6JtFMGFWwQ5iksXSGBwKMDHreO9w7chAdZrEH7b:kbhSnKAwCWjKmXtgBwpM
TLSH
T1D345CF20B641C2B8EA968071597CEBBA483ED6340B3552CFD3D4193D9E342D16B3B69F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-27_9db0ad63551dc1dfb5e9c00a570681b2_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat

File Explorer

2026-06-27_9db0ad63551dc1dfb5e9c00a570681b2_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat

.exe 1.1MB

2026-06-27_9db0ad63551dc1dfb5e9c00a570681b2_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat

IMPHASH b78757e60c78fbd8d0549e7a1e0d29a1
SHA256 35582b0a0cae5c315c3bba110c1d51f41ced6bb0c7087a048fe10249e7aba8f3
MD5 9db0ad63551dc1dfb5e9c00a570681b2
SHA1 f5d52260f4f8fd2a8e919c3ff9e1440dbedb411a
SHA512 463fbd6438c08682addb4aa650f4e64c9db5894b289627841d79cb892709aa329f4e07b8bce85f4ae507d2b0fce25e7f1111b1763939ce39345c0d902b2d4ca5
SSDEEP 24576:YPHeMy8QQGeQrRUm7KAd6JtFMGFWwQ5iksXSGBwKMDHreO9w7chAdZrEH7b:kbhSnKAwCWjKmXtgBwpM
TLSH
T1D345CF20B641C2B8EA968071597CEBBA483ED6340B3552CFD3D4193D9E342D16B3B69F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8f:99:bd:5c:bb:42:3a:2f:31:c6:78:17:ed:82:fd:8a:40:38:44:84:86:51:84:65:b1:a1:c3:f1:a2:02:8e:a6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Adobe Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 4, 2018

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

0a:28:51:e5:f0:ff:db:46:e2:c9:cb:66:10:e6:51:2f

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 26, 2018 - Nov 3, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

560146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

AdobeIPCBroker.pdb

ws2_32

htonl getsockopt ioctlsocket connect closesocket listen getsockname bind WSAGetLastError WSASetLastError WSAStartup getservbyname getservbyport gethostbyname gethostbyaddr socket send select recv ntohs inet_ntoa inet_addr htons __WSAFDIsSet

kernel32

GetModuleFileNameW EnterCriticalSection LeaveCriticalSection GetLastError DeleteCriticalSection ReleaseSemaphore WaitForSingleObject CreateSemaphoreW FindFirstFileW FindNextFileW InitializeCriticalSectionEx FindClose RaiseException DecodePointer ReleaseMutex CreateMutexA Sleep GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetVersionExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA CreateMutexW FreeLibrary CreateProcessW GetProcAddress CloseHandle LoadLibraryA MultiByteToWideChar GetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW InitializeCriticalSection GetThreadPriority HeapSize HeapFree WriteConsoleW GetProcessHeap SetEnvironmentVariableA GetOEMCP IsValidCodePage FindNextFileA SwitchToThread FreeEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW GetCurrentProcessId ReadFile WriteFile ConnectNamedPipe GetOverlappedResult OpenProcess QueryFullProcessImageNameW GetNamedPipeServerProcessId GetLocalTime GetCurrentThread GetTickCount GetEnvironmentStringsW SetStdHandle SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateFileW FlushFileBuffers GetFileAttributesExW GetFileSizeEx GetFullPathNameW LockFileEx SetEndOfFile SetFilePointerEx UnlockFile GetTempPathW DuplicateHandle PeekNamedPipe CreateNamedPipeW SetEvent ResetEvent CreateEventW GetCurrentProcess SetThreadPriority HeapReAlloc VirtualAlloc VirtualFree GetModuleHandleExW LoadLibraryExW WaitForMultipleObjects GetNamedPipeInfo LocalAlloc LocalReAlloc LocalFree FormatMessageW LCMapStringW SetFilePointer RtlCaptureStackBackTrace TerminateProcess GlobalAlloc GlobalFree GetSystemTimeAsFileTime WaitForSingleObjectEx GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead QueryPerformanceCounter IsDebuggerPresent GetStartupInfoW WideCharToMultiByte EncodePointer SetLastError InitializeCriticalSectionAndSpinCount CompareStringW GetLocaleInfoW GetStringTypeW GetCPInfo OutputDebugStringW RtlUnwind InterlockedPushEntrySList GetDriveTypeW GetFileType SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread GetTimeZoneInformation ExitProcess GetCommandLineA GetACP GetConsoleMode ReadConsoleW GetConsoleCP GetFullPathNameA HeapAlloc FindFirstFileExA

user32

SetWindowLongW RegisterClassW CreateWindowExW SetTimer KillTimer TranslateMessage DispatchMessageW PostMessageW PostQuitMessage DestroyWindow MsgWaitForMultipleObjectsEx GetWindowLongW GetShellWindow EnumWindows GetWindowThreadProcessId DefWindowProcW PeekMessageW

advapi32

GetUserNameW RegCloseKey CreateProcessWithTokenW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid DuplicateTokenEx AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW RegQueryValueExW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx OleRun CoUninitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

shell32

ShellExecuteExW SHCreateDirectoryExW CommandLineToArgvW

Name

.text

Size

748KB

Virtual Size

747KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

596B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_9db0ad63551dc1dfb5e9c00a570681b2_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat

PE Signature issue

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

shell32

generic