2026-07-07_43152cc7e0703375f396cb76b2bc7409_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

General

Target
2026-07-07_43152cc7e0703375f396cb76b2bc7409_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil
Size 3.6MB
Sample260707-mn29fac16j
SHA256 02854c893fc294aa2ec121e59377f0579cf9df1dd0cc993703bb691e5dbc570f
MD5 43152cc7e0703375f396cb76b2bc7409
SHA1 3083a9462e7bc93b56f689b5e5e36ee7faf9d81c
SHA512 800ed5a9d74a05fb895950dd26e27f5efaa642d9648aba79e967b3930a5dbb52594c752d8fe22a10b185cab40beb8d4fb11a04b6d96ac16872cbb75f7d11210f
SSDEEP 49152:j3RwC3aQXZmdnEtY2ydoeq25KLVU9kAYoaPqUnUQUgEDhByrM8euYe5L7EKCKVQl:j3RwC3aQX0h27eq25aCkA/ZhgMwnWKm
TLSH
T19A06AD02F7808872E563023094B7633A593EFB5117608DC793D429595DB26E27A3BFEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_43152cc7e0703375f396cb76b2bc7409_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

File Explorer

2026-07-07_43152cc7e0703375f396cb76b2bc7409_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

.exe 3.6MB

2026-07-07_43152cc7e0703375f396cb76b2bc7409_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

SHA256 02854c893fc294aa2ec121e59377f0579cf9df1dd0cc993703bb691e5dbc570f
MD5 43152cc7e0703375f396cb76b2bc7409
SHA1 3083a9462e7bc93b56f689b5e5e36ee7faf9d81c
SHA512 800ed5a9d74a05fb895950dd26e27f5efaa642d9648aba79e967b3930a5dbb52594c752d8fe22a10b185cab40beb8d4fb11a04b6d96ac16872cbb75f7d11210f
SSDEEP 49152:j3RwC3aQXZmdnEtY2ydoeq25KLVU9kAYoaPqUnUQUgEDhByrM8euYe5L7EKCKVQl:j3RwC3aQX0h27eq25aCkA/ZhgMwnWKm
TLSH
T19A06AD02F7808872E563023094B7633A593EFB5117608DC793D429595DB26E27A3BFEB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1744043

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CreateExportObj DestroyExportObj NSISLog libssh2_agent_connect libssh2_agent_disconnect libssh2_agent_free libssh2_agent_get_identity libssh2_agent_init libssh2_agent_list_identities libssh2_agent_userauth libssh2_banner_set libssh2_base64_decode libssh2_channel_close libssh2_channel_direct_tcpip_ex libssh2_channel_eof libssh2_channel_flush_ex libssh2_channel_forward_accept libssh2_channel_forward_cancel libssh2_channel_forward_listen_ex libssh2_channel_free libssh2_channel_get_exit_signal libssh2_channel_get_exit_status libssh2_channel_handle_extended_data libssh2_channel_handle_extended_data2 libssh2_channel_open_ex libssh2_channel_process_startup libssh2_channel_read_ex libssh2_channel_receive_window_adjust libssh2_channel_receive_window_adjust2 libssh2_channel_request_pty_ex libssh2_channel_request_pty_size_ex libssh2_channel_send_eof libssh2_channel_set_blocking libssh2_channel_setenv_ex libssh2_channel_wait_closed libssh2_channel_wait_eof libssh2_channel_window_read_ex libssh2_channel_window_write_ex libssh2_channel_write_ex libssh2_channel_x11_req_ex libssh2_exit libssh2_free libssh2_hostkey_hash libssh2_init libssh2_keepalive_config libssh2_keepalive_send libssh2_knownhost_add libssh2_knownhost_addc libssh2_knownhost_check libssh2_knownhost_checkp libssh2_knownhost_del libssh2_knownhost_free libssh2_knownhost_get libssh2_knownhost_init libssh2_knownhost_readfile libssh2_knownhost_readline libssh2_knownhost_writefile libssh2_knownhost_writeline libssh2_poll libssh2_poll_channel_read libssh2_scp_recv libssh2_scp_send64 libssh2_scp_send_ex libssh2_session_abstract libssh2_session_banner_get libssh2_session_banner_set libssh2_session_block_directions libssh2_session_callback_set libssh2_session_disconnect_ex libssh2_session_flag libssh2_session_free libssh2_session_get_blocking libssh2_session_get_timeout libssh2_session_handshake libssh2_session_hostkey libssh2_session_init_ex libssh2_session_last_errno libssh2_session_last_error libssh2_session_method_pref libssh2_session_methods libssh2_session_set_blocking libssh2_session_set_timeout libssh2_session_startup libssh2_session_supported_algs libssh2_sftp_close_handle libssh2_sftp_fstat_ex libssh2_sftp_fstatvfs libssh2_sftp_get_channel libssh2_sftp_init libssh2_sftp_last_error libssh2_sftp_mkdir_ex libssh2_sftp_open_ex libssh2_sftp_read libssh2_sftp_readdir_ex libssh2_sftp_rename_ex libssh2_sftp_rmdir_ex libssh2_sftp_seek libssh2_sftp_seek64 libssh2_sftp_shutdown libssh2_sftp_stat_ex libssh2_sftp_statvfs libssh2_sftp_symlink_ex libssh2_sftp_tell libssh2_sftp_tell64 libssh2_sftp_unlink_ex libssh2_sftp_write libssh2_trace libssh2_trace_sethandler libssh2_userauth_authenticated libssh2_userauth_hostbased_fromfile_ex libssh2_userauth_keyboard_interactive_ex libssh2_userauth_list libssh2_userauth_password_ex libssh2_userauth_publickey libssh2_userauth_publickey_fromfile_ex

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

609KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

52KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

880KB

Virtual Size

880KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=23, id=241, version=40116,

count=201, id=243, version=40116,

count=30, id=242, version=40116,

count=8, id=199, version=41118,

count=27, id=259, version=24123,

count=5, id=261, productName=VS2017 v15.7.1 build 26428, version=26428,

count=20, productName=Unmarked objects (old),

count=479, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=260, version=25019,

count=37, id=261, version=25019,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=128, id=261, version=24123,

count=39, id=260, version=24123,

count=112, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=499, id=1, productName=Unmarked objects,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=265, version=24234,

count=1, id=256, version=24234,

count=1, id=255, version=24234,

count=1, id=151,

count=1, id=258, version=24234,

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_43152cc7e0703375f396cb76b2bc7409_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil

generic