15f2c97ee3323f2d354fd6f5d1b80613a739766277eb53549e117654469d1dd6

General

Target
2026-07-20_bf4d8e384af9cda7f8840db6c5901392_darkgate_elex_glassworm_remcos_stop
Size 6.3MB
Sample260720-p3a5lsax6p
SHA256 15f2c97ee3323f2d354fd6f5d1b80613a739766277eb53549e117654469d1dd6
MD5 bf4d8e384af9cda7f8840db6c5901392
SHA1 2fa288cb4ea37989179caf88ea9e006bc5a8a3ed
SHA512 4909fef8be92c4884fd8fe466c64cefc221609fc98ee9e052dec49817f51a2c982178a2fdc1e983f0393ae6ac0f6b10e930d36c1bf27457fd46dab555bcb3de4
SSDEEP 98304:WTz31rPWQ6QYq5hwNP43A718frP3wbzWFimaI7dloh9qopX6g:Q1P5tYq7pgbzWFimaI7dl+3
TLSH
T14D66AE52BF4C817AC95A11304B2DAF2A542EBC68773455D3B2743E7EDC723C26C3A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-20_bf4d8e384af9cda7f8840db6c5901392_darkgate_elex_glassworm_remcos_stop
- Size 6.3MB
- SHA256 15f2c97ee3323f2d354fd6f5d1b80613a739766277eb53549e117654469d1dd6
- MD5 bf4d8e384af9cda7f8840db6c5901392
- SHA1 2fa288cb4ea37989179caf88ea9e006bc5a8a3ed
- SHA512 4909fef8be92c4884fd8fe466c64cefc221609fc98ee9e052dec49817f51a2c982178a2fdc1e983f0393ae6ac0f6b10e930d36c1bf27457fd46dab555bcb3de4
- SSDEEP 98304:WTz31rPWQ6QYq5hwNP43A718frP3wbzWFimaI7dloh9qopX6g:Q1P5tYq7pgbzWFimaI7dl+3
- TLSH
  T14D66AE52BF4C817AC95A11304B2DAF2A542EBC68773455D3B2743E7EDC723C26C3A61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery persistence phishing ransomware spyware stealer trojan
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- System Binary Proxy Execution: Verclsid
  Adversaries may abuse Verclsid to proxy execution of malicious code.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2