2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_mespinoza_njrat_remcos
Size 5.6MB
Sample260712-v3fb8aev2j
SHA256 897dd46ad2a3f181e004497003d21349bc3e91ce0f25ab1f731411e5ec5d50c8
MD5 2eaa9b9c5be8ae7958e5641ed488c633
SHA1 a882de6546c2b6d75bda9c995d5d94b291e86c8b
SHA512 3ec6e49797b6d4c3523b7361fbf5e4560d45eb919ada30e82053346ad85f38b910588417aec1788e3e53b904229a449a4eb7b0cf57bc57f807a2c6e44873809e
SSDEEP 49152:RkCF9MKZQttyVQBG5PVOvx+iig9w4qQv6zJ/T7gH0a0BihL67Sy5BpNTVb6SEiJ0:heXttyVhPVMn0ajE67mqrWETR9b
TLSH
T10646E642A3E944A4F1F32B756A3619714A77BD115F38C88FA68CAC1D0BF3681D530B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_mespinoza_njrat_remcos

.exe 5.6MB

2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_mespinoza_njrat_remcos

IMPHASH c5369c6ae34712211af36885bcd0c09b
SHA256 897dd46ad2a3f181e004497003d21349bc3e91ce0f25ab1f731411e5ec5d50c8
MD5 2eaa9b9c5be8ae7958e5641ed488c633
SHA1 a882de6546c2b6d75bda9c995d5d94b291e86c8b
SHA512 3ec6e49797b6d4c3523b7361fbf5e4560d45eb919ada30e82053346ad85f38b910588417aec1788e3e53b904229a449a4eb7b0cf57bc57f807a2c6e44873809e
SSDEEP 49152:RkCF9MKZQttyVQBG5PVOvx+iig9w4qQv6zJ/T7gH0a0BihL67Sy5BpNTVb6SEiJ0:heXttyVhPVMn0ajE67mqrWETR9b
TLSH
T10646E642A3E944A4F1F32B756A3619714A77BD115F38C88FA68CAC1D0BF3681D530B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1670161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Set-up.pdb

setupapi

CM_Get_DevNode_Status SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW

comctl32

InitCommonControlsEx

shell32

SHGetKnownFolderPath ShellExecuteW SHGetSpecialFolderPathW ord51 CommandLineToArgvW ShellExecuteExW SHCreateDirectoryExW SHGetFolderPathW SHGetPathFromIDListW SHGetFolderLocation SHGetSpecialFolderLocation SHBrowseForFolderW SHGetMalloc ord680

shlwapi

PathIsFileSpecW PathAddExtensionW PathRenameExtensionW PathRemoveBackslashW PathRemoveExtensionW UrlIsW SHGetValueW PathIsSystemFolderW PathAppendW PathFileExistsW PathFileExistsA PathIsDirectoryW PathRemoveFileSpecW PathStripToRootW PathIsNetworkPathW PathFindFileNameW PathIsRootW PathIsRelativeW PathStripPathW PathIsUNCW

kernel32

WideCharToMultiByte GetCurrentProcess GetTempPathW CreateFileW GetVersionExW GetComputerNameExW FileTimeToSystemTime CloseHandle RaiseException LoadLibraryW GetProcAddress LocalFree CreateProcessW GetModuleHandleW FreeLibrary FindFirstFileW FindNextFileW TerminateProcess RemoveDirectoryW GetModuleFileNameW FindClose WaitForSingleObject OpenProcess SetFileAttributesW CreateToolhelp32Snapshot Sleep GetLastError Process32NextW DeleteFileW Process32FirstW CopyFileW GetExitCodeProcess ReadFile SetLastError lstrlenW LocalAlloc GetFileAttributesW FormatMessageW GetDiskFreeSpaceExW GetCurrentDirectoryW SetCurrentDirectoryW MoveFileExW GetFileSize lstrcpyW lstrcmpiW lstrcmpW GetDriveTypeW InitializeCriticalSectionEx DecodePointer DeleteCriticalSection GetFullPathNameW HeapSize HeapReAlloc HeapDestroy EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GlobalAlloc GlobalLock GlobalUnlock MulDiv GetSystemDirectoryW SetDllDirectoryW GetStdHandle AttachConsole FreeConsole GetConsoleWindow CreateMutexW ReleaseMutex InitializeCriticalSectionAndSpinCount AreFileApisANSI TryEnterCriticalSection HeapCreate WriteFile InterlockedCompareExchange GetDiskFreeSpaceW OutputDebugStringA LockFile InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA HeapAlloc GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA GetSystemInfo HeapCompact UnlockFile CreateFileMappingA LockFileEx GetCurrentProcessId SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource LockResource LoadResource FindResourceW MultiByteToWideChar GlobalFree VerSetConditionMask VerifyVersionInfoW GetUserDefaultLCID LCMapStringW DuplicateHandle ProcessIdToSessionId SetEvent TerminateThread CreateThread FindResourceExW ResetEvent GetThreadTimes QueryFullProcessImageNameW WaitForMultipleObjects GetFileSizeEx GetUserDefaultLangID GetUserDefaultUILanguage SetNamedPipeHandleState CreateNamedPipeW ConnectNamedPipe CreateDirectoryW SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetFileTime ReleaseSemaphore OpenSemaphoreW CreateSemaphoreW GetLocalTime GetTimeFormatW GetDateFormatW OpenMutexW GetTimeZoneInformation CreateSymbolicLinkW QueryPerformanceFrequency GetCurrentThread SetFilePointerEx ResumeThread SwitchToThread SignalObjectAndWait CreateTimerQueue VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW CompareStringW GetCPInfo HeapFree TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW EncodePointer LoadLibraryExA VirtualQuery VirtualProtect SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind GetFileType SetStdHandle ExitThread GetModuleHandleExW ExitProcess GetACP IsValidLocale EnumSystemLocalesW GetConsoleMode ReadConsoleW GetConsoleCP FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW CreateEventW SetEnvironmentVariableA WriteConsoleW GetProcessHeap GetDiskFreeSpaceA

user32

IsWindow InvalidateRgn DispatchMessageW RedrawWindow ClientToScreen DestroyAcceleratorTable IsChild AttachThreadInput ShowWindow RegisterClassExW SetWindowTextW ScreenToClient CreateWindowExW FillRect DestroyWindow GetFocus GetWindow GetSysColor GetActiveWindow PostMessageW CallWindowProcW GetForegroundWindow MoveWindow CreateAcceleratorTableW SetFocus CharNextW DefWindowProcW GetMessageW GetClassInfoExW GetWindowTextLengthW GetWindowThreadProcessId BringWindowToTop TranslateAcceleratorW TranslateMessage LoadCursorW GetClassNameW SetCapture SetWindowLongW GetClientRect GetDlgItem PostQuitMessage GetParent RegisterWindowMessageW ReleaseCapture SetForegroundWindow InvalidateRect IsIconic BeginPaint EndPaint GetWindowTextW GetWindowRect GetDC SetWindowPos MessageBoxW SendMessageW GetDesktopWindow ReleaseDC UnregisterClassW GetWindowLongW wsprintfW PostThreadMessageW EnumWindows GetShellWindow AllowSetForegroundWindow LoadImageW SystemParametersInfoW EnableMenuItem LoadIconW GetSystemMetrics GetSystemMenu GetClassLongW AppendMenuW GetAsyncKeyState SetClassLongW

gdi32

BitBlt CreateSolidBrush DeleteObject DeleteDC GetStockObject CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject GetObjectW

advapi32

SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW GetTokenInformation CreateWellKnownSid LookupPrivilegeValueW RegCloseKey AdjustTokenPrivileges SystemFunction036 RegCreateKeyExW RegFlushKey LookupAccountSidW RegSetValueExW RegOpenKeyExW EqualSid InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid SetSecurityDescriptorDacl DuplicateTokenEx ConvertSidToStringSidW ImpersonateLoggedOnUser ConvertStringSidToSidW RevertToSelf CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueExW GetUserNameW OpenProcessToken

ole32

CoAddRefServerProcess OleRun CoReleaseServerProcess CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoInitialize OleLockRunning CLSIDFromString OleInitialize CreateStreamOnHGlobal CLSIDFromProgID CoTaskMemAlloc OleUninitialize CoGetClassObject CoCreateInstance StringFromGUID2 CoTaskMemFree CoCreateGuid CoInitializeEx

oleaut32

VariantClear SysAllocStringLen SysStringLen SysAllocString OleCreateFontIndirect LoadTypeLi VariantInit LoadRegTypeLi VariantChangeType SysAllocStringByteLen VariantCopy SysStringByteLen DispCallFunc GetErrorInfo SysFreeString

crypt32

CertGetIssuerCertificateFromStore CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WinVerifyTrust WTHelperProvDataFromStateData

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

672KB

Virtual Size

676KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=21, id=241, version=40116,

count=200, id=243, version=40116,

count=32, id=242, version=40116,

count=4, id=261, version=23013,

count=1, id=199, version=41118,

count=25, id=259, version=23907,

count=39, id=260, version=23907,

count=136, id=261, version=23907,

count=9, id=206, version=65501,

count=24, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=260, productName=VS2015 UPD1 build 23506, version=23506,

count=8, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=2, id=208, version=65501,

count=35, id=203, version=65501,

count=530, id=1, productName=Unmarked objects,

count=200, id=265, version=23918,

count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,