2026-07-20_4e5c757333fa08e48fe73e2e6df43a29_darkgate_elex_floxif_glassworm_maze

General

Target
2026-07-20_4e5c757333fa08e48fe73e2e6df43a29_darkgate_elex_floxif_glassworm_maze
Size 5.3MB
Sample260720-dpvrbadw3p
SHA256 06bebd81e3cb4abd6f07144c2246dac15755f92a1ddcf6d51b12d96d825b75d7
MD5 4e5c757333fa08e48fe73e2e6df43a29
SHA1 18b3c35f3b296b92a137814b0a5c5b307ef863f2
SHA512 c660cfcc4cea79083a1e22ac98962221b8f3367012d12cf454be33e3257d6168950018a8771a2165139e817c654d25688b86c3bc555929502eed2cf6dadc8c80
SSDEEP 98304:oQLjc9Pu9/rDzRVNYQ0X4gtw5Kb0jYNDse0zHcF0liqh:hLjcMsQ0Igtw5Kb0jYNYdDFl5
TLSH
T14D46AE12FBD6C2FAEEA30671493AA31985B6BD741830C56FE3845F0E5D70A42BD35722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_4e5c757333fa08e48fe73e2e6df43a29_darkgate_elex_floxif_glassworm_maze

File Explorer

2026-07-20_4e5c757333fa08e48fe73e2e6df43a29_darkgate_elex_floxif_glassworm_maze

.exe 5.3MB

2026-07-20_4e5c757333fa08e48fe73e2e6df43a29_darkgate_elex_floxif_glassworm_maze

IMPHASH 9770bcffb8c10abf796c42da471f7202
SHA256 06bebd81e3cb4abd6f07144c2246dac15755f92a1ddcf6d51b12d96d825b75d7
MD5 4e5c757333fa08e48fe73e2e6df43a29
SHA1 18b3c35f3b296b92a137814b0a5c5b307ef863f2
SHA512 c660cfcc4cea79083a1e22ac98962221b8f3367012d12cf454be33e3257d6168950018a8771a2165139e817c654d25688b86c3bc555929502eed2cf6dadc8c80
SSDEEP 98304:oQLjc9Pu9/rDzRVNYQ0X4gtw5Kb0jYNDse0zHcF0liqh:hLjcMsQ0Igtw5Kb0jYNYdDFl5
TLSH
T14D46AE12FBD6C2FAEEA30671493AA31985B6BD741830C56FE3845F0E5D70A42BD35722
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c7:2e:01:1b:c5:b8:49:1f:c9:a9:99:fd:a0:94:20:a8:e6:a9:ad:b2

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Chains

Mar 30, 2015

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=TeamViewer,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Serial Number

56:72:93:00:c7:83:06:c4:26:7c:a4:4a:10:ad:cd:03

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2014 - Sep 5, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

3237022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TeamViewer_Workspace\TeamViewer_10.0_Release_Hotfix\BuildTarget\Release2013\TeamViewer_Service.pdb

kernel32

GetLastError TlsFree TlsAlloc EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetModuleFileNameW InterlockedDecrement InterlockedIncrement InitializeCriticalSectionAndSpinCount GetCurrentThreadId LoadLibraryExA GetSystemDirectoryA CloseHandle lstrcmpiW SetLastError DecodePointer GetModuleHandleW RaiseException FreeLibrary GetProcAddress MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW Sleep CreateEventA SetEvent InterlockedExchange InterlockedExchangeAdd PostQueuedCompletionStatus WaitForSingleObjectEx GetCurrentProcessId OpenEventA ResetEvent GetSystemTimeAsFileTime TlsGetValue SetWaitableTimer WaitForSingleObject SleepEx CreateEventW CreateWaitableTimerW CreateThread ResumeThread GetTickCount DuplicateHandle GetCurrentProcess CreateSemaphoreA ReleaseSemaphore InterlockedCompareExchange CreateIoCompletionPort QueueUserAPC TerminateThread WaitForMultipleObjects InitializeCriticalSection GetLogicalDriveStringsW GetDriveTypeW GetVolumeInformationW FindFirstFileW FindClose FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDateFormatW GetTimeFormatW CreateFileW DeviceIoControl GetFileAttributesW SetFileAttributesW GetFileSize ReadFile GetExitCodeThread FormatMessageW LocalFree MoveFileExW GetTempPathW ExpandEnvironmentStringsW CreateDirectoryW GetVersionExW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW GetSystemInfo GetComputerNameW DeleteFileW SetFilePointer SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte WriteFile SetFileTime GetLocalTime GetFileInformationByHandle UnmapViewOfFile SetThreadAffinityMask GetCurrentThread QueryPerformanceCounter QueryPerformanceFrequency SwitchToThread GetModuleHandleA TlsSetValue FormatMessageA GetProcessHeap HeapFree HeapAlloc SetThreadPriority GetPrivateProfileStringW SetDllDirectoryW HeapSetInformation VerifyVersionInfoW VerSetConditionMask GetQueuedCompletionStatus GetNativeSystemInfo LocalAlloc OpenEventW CreateFileMappingA OpenFileMappingA MapViewOfFileEx OpenProcess FindNextFileW WaitNamedPipeW CreateProcessW TerminateProcess GetProcessId ProcessIdToSessionId WTSGetActiveConsoleSessionId RegisterWaitForSingleObject UnregisterWaitEx LoadLibraryW GetSystemDirectoryW ReleaseMutex SetFilePointerEx CreateMutexW OpenMutexW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetPrivateProfileIntW WritePrivateProfileStringW GetTimeZoneInformation GetOverlappedResult GlobalAlloc GetComputerNameExA GetComputerNameExW GlobalFree OpenThread ExpandEnvironmentStringsA GetThreadTimes lstrlenA SetEnvironmentVariableA PeekNamedPipe WriteConsoleW HeapReAlloc SetUnhandledExceptionFilter HeapSize FileTimeToLocalFileTime GetDiskFreeSpaceExW GetTempFileNameW GetStringTypeW EncodePointer IsDebuggerPresent OutputDebugStringW LoadLibraryA LCMapStringW LCMapStringA GetUserDefaultLCID GetStringTypeExA GetFileAttributesExW GetFullPathNameW RemoveDirectoryW SetEndOfFile CopyFileW AreFileApisANSI WaitForMultipleObjectsEx CreateWaitableTimerA IsProcessorFeaturePresent ExitThread GetCPInfo GetCommandLineW RtlUnwind UnhandledExceptionFilter GetStartupInfoW CompareStringW IsValidLocale EnumSystemLocalesW ExitProcess GetModuleHandleExW GetStdHandle GetFileType GetConsoleCP GetConsoleMode FlushFileBuffers IsValidCodePage GetACP GetOEMCP ReadConsoleW GetEnvironmentStringsW FreeEnvironmentStringsW FindFirstFileExW SetStdHandle

msi

ord141 ord70 ord45 ord16

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

216KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

203KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=5, id=199, version=41118,

count=39, id=223, productName=VS2013 build 21005, version=21005,

count=16, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=7, id=225, version=20806,

count=264, id=224, productName=VS2013 build 21005, version=21005,

count=93, id=225, productName=VS2013 build 21005, version=21005,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=225, productName=VS2013 UPD3 build 30723, version=30723,

count=7, id=224, productName=VS2013 UPD3 build 30723, version=30723,

count=45, id=205, version=50522,

count=126, productName=Unmarked objects (old),

count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=508, id=1, productName=Unmarked objects,

count=734, id=229, version=30723,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD3 build 30723, version=30723,

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_4e5c757333fa08e48fe73e2e6df43a29_darkgate_elex_floxif_glassworm_maze

PE Signature issue

kernel32

msi

generic