2026-07-10_367871ec81a5847b16c8bd3faa95aed5_darkgate_elex_gazer_glassworm_helldown_redline-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_367871ec81a5847b16c8bd3faa95aed5_darkgate_elex_gazer_glassworm_helldown_redline-stealer
Size 595KB
Sample260710-df1afacv5p
SHA256 e68dc3f1a5d9ac78c9180d0999ea0258ebace3e7e8dffe1eab5d7485f08100b5
MD5 367871ec81a5847b16c8bd3faa95aed5
SHA1 e3838d69aa273db730e80c4e9609d646ba2a6534
SHA512 45f621ccee986140e3cc08a4463b9d4c38c20a4b1a18022084212be1f7a2da92ccb71ea9d370b687500e59050773906b1942a36063dcfd76aac09f4c80b02c5c
SSDEEP 6144:ZFJH9xS5K9WQrgz3I6DJKzxqf4kfC4T/MUh1qcJv5TJQjdseLHHRVbsMPhCpvIz0:bJHza0/YZCC1pRT22ixVbsMAwzBQds4X
TLSH
T170D49D11AA92C076E8D312F5A5AE6776BC3A9E34230895F336D23D850E741F5BB38317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-10_367871ec81a5847b16c8bd3faa95aed5_darkgate_elex_gazer_glassworm_helldown_redline-stealer

.exe 595KB

2026-07-10_367871ec81a5847b16c8bd3faa95aed5_darkgate_elex_gazer_glassworm_helldown_redline-stealer

IMPHASH aaab8e0bd73380b8c173b1e4531dfe7e
SHA256 e68dc3f1a5d9ac78c9180d0999ea0258ebace3e7e8dffe1eab5d7485f08100b5
MD5 367871ec81a5847b16c8bd3faa95aed5
SHA1 e3838d69aa273db730e80c4e9609d646ba2a6534
SHA512 45f621ccee986140e3cc08a4463b9d4c38c20a4b1a18022084212be1f7a2da92ccb71ea9d370b687500e59050773906b1942a36063dcfd76aac09f4c80b02c5c
SSDEEP 6144:ZFJH9xS5K9WQrgz3I6DJKzxqf4kfC4T/MUh1qcJv5TJQjdseLHHRVbsMPhCpvIz0:bJHza0/YZCC1pRT22ixVbsMAwzBQds4X
TLSH
T170D49D11AA92C076E8D312F5A5AE6776BC3A9E34230895F336D23D850E741F5BB38317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

4b:c6:db:51:7c:62:28:55:fc:85:97:6e:26:3a:2f:90:93:03:f1:c3:71:50:08:51:14:4f:a8:73:55:c7:d8:bd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1026605606620,CN=AO Proizvodstvennaya Firma SKB Kontur,O=AO Proizvodstvennaya Firma SKB Kontur,STREET=ul Narodnoy voli\, str 19a,L=Yekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#131453766572646c6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 8, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

5d:d8:ba:ec:a2:6f:86:7b:fc:b4:b8:ec

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 20, 2025 - Jun 20, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

302694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\7236625856f3c609\_idsclient\bin\Kontur.Admin.Operator.pdb

kernel32

OutputDebugStringA GetCurrentThreadId IsDebuggerPresent TerminateProcess SetEnvironmentVariableW GetCurrentProcess UnregisterWait AttachConsole GetStdHandle FreeConsole WriteFile GetFileSize WaitForMultipleObjects RegisterWaitForSingleObject ExitProcess GlobalFree GetLastError ExpandEnvironmentStringsW lstrcmpiW GetCurrentDirectoryW GetModuleFileNameW GetCommandLineW lstrcpyA LocalFree GetCurrentProcessId lstrcmpiA SetLastError GetFileSizeEx lstrlenW MultiByteToWideChar CreateFileW ReadFile GetFileAttributesW GetVersionExW WideCharToMultiByte OpenProcess GetModuleHandleW SetFilePointerEx CreateThread CloseHandle TerminateThread LoadLibraryA CreateEventW GetLocalTime ResetEvent EnterCriticalSection GetProcAddress LeaveCriticalSection Sleep LoadLibraryW InitializeCriticalSection SetEvent WaitForSingleObject lstrlenA lstrcmpA CreateIoCompletionPort SetThreadPriority GetEnvironmentVariableW ProcessIdToSessionId CreateProcessW LocalAlloc InterlockedCompareExchange PostQueuedCompletionStatus GetQueuedCompletionStatus lstrcmpW GetModuleHandleA GetProcessTimes CreateToolhelp32Snapshot Process32FirstW Thread32First Thread32Next Process32NextW GetProcessId GetSystemTime SystemTimeToFileTime RaiseException GlobalAlloc GlobalLock GlobalUnlock lstrcpyW HeapSize GetProcessHeap IsProcessorFeaturePresent VirtualQuery HeapReAlloc HeapAlloc WriteConsoleW InterlockedExchange FlushFileBuffers GetCommandLineA HeapSetInformation GetStartupInfoW DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter EncodePointer GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection RtlUnwind HeapFree GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode LCMapStringW GetStringTypeW SetStdHandle

user32

MessageBoxW wsprintfW wsprintfA PostMessageW OpenClipboard EmptyClipboard SetClipboardData EnumThreadWindows CloseClipboard

advapi32

RegCloseKey RegQueryInfoKeyW CryptGenRandom RegOpenKeyExA OpenProcessToken ConvertSidToStringSidA GetTokenInformation RegEnumKeyExW SetTokenInformation DuplicateTokenEx CreateProcessAsUserW QueryServiceConfigW FreeSid CheckTokenMembership AllocateAndInitializeSid CloseServiceHandle ChangeServiceConfigW OpenServiceW OpenSCManagerW ChangeServiceConfig2W CreateServiceW DeleteService StartServiceW QueryServiceStatusEx ControlService AdjustTokenPrivileges LookupPrivilegeValueW ImpersonateLoggedOnUser DuplicateToken RevertToSelf EqualSid RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCreateKeyExW CryptGetHashParam CryptDestroyHash CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextW ConvertSidToStringSidW IsValidSid RegQueryValueExA

shell32

ShellExecuteExW SHFileOperationW SHCreateDirectoryExW SHGetPathFromIDListW SHBrowseForFolderW SHParseDisplayName ShellExecuteA CommandLineToArgvW

ole32

CoTaskMemFree

oleaut32

VarI4FromStr VarUI8FromStr

ws2_32

inet_ntoa WSAGetLastError htons setsockopt recv socket connect gethostbyname send getaddrinfo accept listen bind WSACleanup getsockname ntohs inet_addr WSAStartup WSARecv WSASend closesocket shutdown freeaddrinfo

crypt32

CertCreateCertificateContext CertOpenStore CertFreeCertificateContext CertAddCertificateContextToStore CertCloseStore CertGetCertificateChain CryptProtectData CryptUnprotectData CertVerifyCertificateChainPolicy

iphlpapi

GetTcpTable GetAdaptersAddresses

winhttp

WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpReadData WinHttpGetProxyForUrl WinHttpOpen WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpSetTimeouts WinHttpConnect WinHttpGetIEProxyConfigForCurrentUser WinHttpSendRequest

shlwapi

StrToIntA PathRemoveFileSpecW StrStrW StrStrIW StrPBrkA StrStrIA PathFindFileNameW ord157 wvnsprintfA SHGetValueW SHDeleteKeyW StrStrA

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

secur32

GetUserNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_367871ec81a5847b16c8bd3faa95aed5_darkgate_elex_gazer_glassworm_helldown_redline-stealer

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

crypt32

iphlpapi

winhttp

shlwapi

version

userenv

secur32

generic