2026-07-09_2d19e18ecc7729e3f62840ad42d4c180_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_2d19e18ecc7729e3f62840ad42d4c180_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos
Size 1.2MB
Sample260709-krydjsgt71
SHA256 7d4c8c104600fafa07b1e4fe820c7851abe3db10357b9aa6887a63b11a7cd2ac
MD5 2d19e18ecc7729e3f62840ad42d4c180
SHA1 3fd9765538fdb177ffd96a835cd07cc6c27bee0e
SHA512 478be65cf1e19414e5a97ada7725aae60d0221e714f09fbf4c061201d26e7891af0a5fdc6cafdec91536028d3013d57fd742333fa93dd4ef9023da917d89a48d
SSDEEP 24576:7R2DdnfEgsaUInwtj0sVwRvXkSHCytY4eWLiaomWDgrEH7u:73gsHmowRvFLWDO
TLSH
T199458E2037C6813AF6B211726E7C966B507DBA760F3281CF6298465E6D70DC21E37B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-09_2d19e18ecc7729e3f62840ad42d4c180_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-07-09_2d19e18ecc7729e3f62840ad42d4c180_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos

.exe 1.2MB

2026-07-09_2d19e18ecc7729e3f62840ad42d4c180_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos

IMPHASH db240a9d39dbf1a9200d6f243df63db0
SHA256 7d4c8c104600fafa07b1e4fe820c7851abe3db10357b9aa6887a63b11a7cd2ac
MD5 2d19e18ecc7729e3f62840ad42d4c180
SHA1 3fd9765538fdb177ffd96a835cd07cc6c27bee0e
SHA512 478be65cf1e19414e5a97ada7725aae60d0221e714f09fbf4c061201d26e7891af0a5fdc6cafdec91536028d3013d57fd742333fa93dd4ef9023da917d89a48d
SSDEEP 24576:7R2DdnfEgsaUInwtj0sVwRvXkSHCytY4eWLiaomWDgrEH7u:73gsHmowRvFLWDO
TLSH
T199458E2037C6813AF6B211726E7C966B507DBA760F3281CF6298465E6D70DC21E37B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f7:cc:d5:3a:d9:e4:d8:63:92:af:38:8a:1d:0a:6c:f9:c3:50:94:03:70:65:f6:56:fc:1d:d2:3c:2f:b3:0c:a4

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Jul 8, 2026

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Serial Number

01:73:8d:40:bc:79:77:7d:20:39:9e:29:bb:c9:14:e0

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 10, 2018 - May 15, 2019

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

483832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\PROG\HPCASL\Release\hpqwmiex.pdb

setupapi

SetupDiGetClassDevsW CM_Get_DevNode_Status CM_Get_Device_ID_Size CM_Get_Device_IDW CM_Locate_DevNodeW CM_Get_Parent CM_Get_Child SetupDiOpenDeviceInfoW CM_Get_Sibling SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailW

kernel32

CreateTimerQueueTimer WaitForSingleObject GetCommandLineW CreateThread LocalFree FormatMessageW LoadLibraryW CreateProcessW GetExitCodeProcess CreateTimerQueue OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP CreateEventW ProcessIdToSessionId GetSystemPowerStatus LocalAlloc GetCurrentThread GetCurrentProcess SetEnvironmentVariableW GetCurrentProcessId K32GetProcessImageFileNameW OpenProcess K32EnumProcesses GetCurrentThreadId DeleteTimerQueue DecodePointer DeleteFileW CreateFileW GetModuleFileNameW LoadLibraryExW MultiByteToWideChar RaiseException lstrcmpiW FreeLibrary GetLocalTime LeaveCriticalSection EnterCriticalSection InitializeCriticalSection InitializeCriticalSectionEx DeleteCriticalSection TerminateThread WaitForMultipleObjects SetEvent Sleep GetModuleHandleW GetProcAddress CloseHandle PulseEvent OpenEventW GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetFileType IsValidCodePage FindFirstFileExW IsDebuggerPresent SetEndOfFile WriteConsoleW SetFilePointerEx ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetStdHandle ExitProcess VirtualProtect VirtualAlloc GetSystemInfo GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread VirtualQuery RtlUnwind DeviceIoControl GetFirmwareEnvironmentVariableW GlobalFree GlobalAlloc WriteFile ExpandEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP VerifyVersionInfoW VerSetConditionMask MoveFileW QueryUnbiasedInterruptTime CreateMutexW ReleaseMutex GetTempFileNameW GetFullPathNameW GetFileAttributesExW WideCharToMultiByte GetStringTypeW EncodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead CreateDirectoryW FindClose FindFirstFileW FindNextFileW

user32

CharNextW PostThreadMessageW LoadStringW CharUpperW GetMessageW TranslateMessage DispatchMessageW UnregisterDeviceNotification RegisterDeviceNotificationW

advapi32

EqualSid FreeSid CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptImportKey DeregisterEventSource ReportEventW RegisterEventSourceW QueryServiceStatus StartServiceW InitializeAcl GetAclInformation GetAce AddAce AddAccessAllowedAce SetSecurityDescriptorDacl CreateWellKnownSid OpenThreadToken OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner IsValidSid GetLengthSid CopySid SetSecurityDescriptorGroup InitializeSecurityDescriptor StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW ChangeServiceConfigW DeleteService ControlService OpenServiceW CreateServiceW OpenSCManagerW CloseServiceHandle RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegOpenKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegCloseKey CryptCreateHash CryptHashData CryptDestroyHash CryptVerifySignatureW AllocateAndInitializeSid

ole32

StringFromGUID2 CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoInitializeSecurity CoInitializeEx CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoAddRefServerProcess CoReleaseServerProcess OleRun CLSIDFromString CoInitialize CoSetProxyBlanket CoDisconnectObject

shell32

SHGetFolderPathW CommandLineToArgvW SHCreateDirectoryExW

oleaut32

SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate GetErrorInfo SysStringLen VarBstrCat SafeArrayDestroy SafeArrayGetElement SafeArrayPutElement SafeArrayCreateVector RegisterTypeLi UnRegisterTypeLi LoadTypeLi LoadRegTypeLi VarUI4FromStr VarCmp SysAllocStringByteLen SysStringByteLen SysAllocString SysAllocStringLen VariantCopy VariantInit VariantClear SysFreeString

shlwapi

StrCmpNIW StrTrimW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

744KB

Virtual Size

743KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

284KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

924B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_2d19e18ecc7729e3f62840ad42d4c180_darkgate_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos

PE Signature issue

setupapi

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

version

generic