2026-07-22_407a23727baf09560288988fc596cac2_darkgate_elex_glassworm_maze_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_407a23727baf09560288988fc596cac2_darkgate_elex_glassworm_maze_revil
Size 2.6MB
Sample260723-cble2sfb37
SHA256 c0a78b91b6d69c0ff525da4220ec3954b362d5a845ceaf0b8130552ee8e26ac6
MD5 407a23727baf09560288988fc596cac2
SHA1 50f2ab693c20fd9cae241267b82977545996eb2b
SHA512 6a9ec4e21a8cc7abf1990a6d1cf79ac2fe2b315a0300b4d6ab2983ea62fac5c37fd762ed9e301eba32120a0a01f10c51a233050562d02f2dbf858e31bfd919d1
SSDEEP 49152:5aF4CQ8Kb10nxZBYzgqvQ/qpyr0kWOWs++9zfFT6cPRSdqQ1vIXXozN:5aFAnfvQ/qpyr0kWbs++5VBSdDvx
TLSH
T116C5BF12FB81C072E9D602B1956EAB3E843DFAA0473499D3D3D41D2D5D316C26B3B39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-22_407a23727baf09560288988fc596cac2_darkgate_elex_glassworm_maze_revil

.exe 2.6MB

2026-07-22_407a23727baf09560288988fc596cac2_darkgate_elex_glassworm_maze_revil

IMPHASH 4d31ed14a7da2d250900a86830aa7618
SHA256 c0a78b91b6d69c0ff525da4220ec3954b362d5a845ceaf0b8130552ee8e26ac6
MD5 407a23727baf09560288988fc596cac2
SHA1 50f2ab693c20fd9cae241267b82977545996eb2b
SHA512 6a9ec4e21a8cc7abf1990a6d1cf79ac2fe2b315a0300b4d6ab2983ea62fac5c37fd762ed9e301eba32120a0a01f10c51a233050562d02f2dbf858e31bfd919d1
SSDEEP 49152:5aF4CQ8Kb10nxZBYzgqvQ/qpyr0kWOWs++9zfFT6cPRSdqQ1vIXXozN:5aFAnfvQ/qpyr0kWbs++5VBSdDvx
TLSH
T116C5BF12FB81C072E9D602B1956EAB3E843DFAA0473499D3D3D41D2D5D316C26B3B39A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

06:3e:b7:b7:55:df:b9:19:c9:bc:2c:78:ab:ff:5d:80:2b:9d:98:d1:70:b9:43:f7:79:88:34:a4:72:b1:52:3d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=53740150,CN=安鈦資訊股份有限公司,O=安鈦資訊股份有限公司,L=中正區,ST=台北市,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e58fb0e58c97e5b882,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

May 30, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:c0:78:4f:c4:a2:82:df:55:95:d0:38:e3:69:36:79

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 14, 2025 - Sep 26, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1732485

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\ChromeSign\Source2\ChromeSign\Release\ATSignServer.pdb

crypt32

CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertEnumCertificatesInStore CertCloseStore

ws2_32

recv WSACleanup setsockopt shutdown accept getnameinfo htons WSAGetLastError select WSASend WSASocketW socket freeaddrinfo WSASetLastError closesocket send getsockopt ntohs WSAStringToAddressW inet_addr sendto bind gethostbyaddr gethostbyname getpeername ioctlsocket WSAAddressToStringW WSAStartup ntohl htonl getaddrinfo listen WSARecv

kernel32

PeekNamedPipe FileTimeToLocalFileTime SetEnvironmentVariableA CreateProcessW GetExitCodeProcess SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA GetEnvironmentVariableW CreateFileA TlsGetValue GetDriveTypeW SetWaitableTimer InterlockedIncrement GetQueuedCompletionStatus VerSetConditionMask GetCommState InterlockedDecrement WaitForSingleObject InterlockedCompareExchange SleepEx WriteFile SetCommState SetCommTimeouts TlsSetValue OpenProcess WideCharToMultiByte TerminateThread InitializeCriticalSectionAndSpinCount SetEvent GetSystemTimeAsFileTime LeaveCriticalSection GetFileAttributesW TerminateProcess ReadFile GetModuleFileNameW GetOverlappedResult MultiByteToWideChar VerifyVersionInfoW InterlockedExchange GetLastError SetLastError GetProcAddress QueueUserAPC EnterCriticalSection Process32FirstW InterlockedExchangeAdd CreateEventW SetCurrentDirectoryW PostQueuedCompletionStatus WaitForMultipleObjects Process32NextW CreateIoCompletionPort GetModuleHandleA CancelIo CreateWaitableTimerW CreateToolhelp32Snapshot DeleteCriticalSection GetCurrentThreadId TlsAlloc CloseHandle GetCurrentProcessId TlsFree GetModuleHandleExW GetStdHandle GetFileType GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber QueryPerformanceCounter GetTickCount GlobalMemoryStatus FreeLibrary LoadLibraryA LoadLibraryW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetSystemTime SystemTimeToFileTime InitializeCriticalSection FindClose FindFirstFileA FindNextFileA OutputDebugStringA lstrcpyA lstrcatA lstrlenA FindFirstFileW FindNextFileW UnregisterWaitEx InitializeSListHead ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes VirtualProtect VirtualFree VirtualAlloc GetVersionExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindFirstFileExW HeapSize OutputDebugStringW GetConsoleCP FlushFileBuffers GetProcessHeap GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW UnregisterWait SetEnvironmentVariableW RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList DuplicateHandle GetCurrentProcess GetCurrentThread GetExitCodeThread EncodePointer DecodePointer GetStringTypeW LocalFree FormatMessageA GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesExW GetFileInformationByHandle GetFileTime GetFullPathNameW RemoveDirectoryW SetEndOfFile SetFilePointerEx DeviceIoControl CopyFileW MoveFileExW AreFileApisANSI RaiseException HeapFree SetConsoleCtrlHandler WriteConsoleW CreateThread ExitThread LoadLibraryExW IsDebuggerPresent IsProcessorFeaturePresent HeapReAlloc GetCommandLineA HeapAlloc ExitProcess RtlUnwind GetTimeZoneInformation GetCPInfo CreateTimerQueue UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep GetStartupInfoW CreateSemaphoreW InterlockedPopEntrySList

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetForegroundWindow

winspool.drv

EndPagePrinter StartPagePrinter ClosePrinter EndDocPrinter WritePrinter OpenPrinterW StartDocPrinterW

advapi32

CryptAcquireContextW RegisterEventSourceW ReportEventW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey RegSetValueExA RegCreateKeyExA RegCloseKey ReportEventA RegisterEventSourceA CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey DeregisterEventSource

shell32

ShellExecuteExW SHGetFolderPathW ShellExecuteW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

mswsock

GetAcceptExSockaddrs AcceptEx

generic

count=5, id=199, version=41118,

count=47, id=223, productName=VS2013 build 21005, version=21005,

count=7, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=140, id=225, productName=VS2013 build 21005, version=21005,

count=281, id=224, productName=VS2013 build 21005, version=21005,

count=4, id=207, productName=VS2012 UPD4 build 61030, version=61030,

count=29, id=206, productName=VS2012 UPD4 build 61030, version=61030,

count=29, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=282, id=1, productName=Unmarked objects,

count=484, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=23, productName=Unmarked objects (old),

count=7, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,