2026-07-23_4f3e29b310ceaa56d9a64484d954ec82_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_4f3e29b310ceaa56d9a64484d954ec82_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos
Size 1.3MB
Sample260723-ylc3bach85
SHA256 a1e1274191a216661acee3685c32829484e5a0eb654e25c2f1e86e41316ceec3
MD5 4f3e29b310ceaa56d9a64484d954ec82
SHA1 8771c6e39dcbb35d038504c0f0774aa284a17356
SHA512 eeafc3551a71d78b7f24594c97991148b843ef5a3cab4477e26cdf5f939b2ff41770d51cd6d37267fd113c246a3c46fbc16b7912b081a17f4f70906fcf19ddc1
SSDEEP 24576:W1JJ3merT5EhVzhBD8uXTTTN+Y1TSWNyBo4kx929bL3Hnx:ImeaVzrDlXTTTNBTSdB+kn3Hnx
TLSH
T19255CF217247D13BE4B205F08D7CAA6A642ABC180F759BDBF3E81B2E19705C15F32B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_4f3e29b310ceaa56d9a64484d954ec82_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

File Explorer

2026-07-23_4f3e29b310ceaa56d9a64484d954ec82_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

.exe 1.3MB

2026-07-23_4f3e29b310ceaa56d9a64484d954ec82_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

IMPHASH 477db47d28aa0e21f6df614e1200885d
SHA256 a1e1274191a216661acee3685c32829484e5a0eb654e25c2f1e86e41316ceec3
MD5 4f3e29b310ceaa56d9a64484d954ec82
SHA1 8771c6e39dcbb35d038504c0f0774aa284a17356
SHA512 eeafc3551a71d78b7f24594c97991148b843ef5a3cab4477e26cdf5f939b2ff41770d51cd6d37267fd113c246a3c46fbc16b7912b081a17f4f70906fcf19ddc1
SSDEEP 24576:W1JJ3merT5EhVzhBD8uXTTTN+Y1TSWNyBo4kx929bL3Hnx:ImeaVzrDlXTTTNBTSdB+kn3Hnx
TLSH
T19255CF217247D13BE4B205F08D7CAA6A642ABC180F759BDBF3E81B2E19705C15F32B56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

365048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builds\ACC\GM\source\dev\target\win32\Release\ElevationManager\AdobeUpdateService.pdb

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

WideCharToMultiByte GetExitCodeProcess VerSetConditionMask VerifyVersionInfoW HeapFree CreateThread HeapAlloc GetProcessHeap InitializeCriticalSectionEx RaiseException DecodePointer DeleteCriticalSection ResumeThread GetFileSizeEx CreateFileW SetLastError HeapSize CreateEventW ProcessIdToSessionId SetEvent GlobalAlloc GlobalFree HeapReAlloc ResetEvent LocalFree GetCurrentProcessId GetModuleHandleW lstrcmpiW lstrcmpW ReadFile SetNamedPipeHandleState EnterCriticalSection WriteFile CreateNamedPipeW LeaveCriticalSection InitializeCriticalSection ConnectNamedPipe SetFilePointer GetCurrentThreadId LocalAlloc GetFileAttributesW CopyFileW FlushFileBuffers GetUserDefaultLangID FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW GetUserDefaultLCID LCMapStringW GetVersionExW GetUserDefaultUILanguage ReadConsoleW SetFilePointerEx EnumSystemLocalesW IsValidLocale GetConsoleMode GetConsoleCP GetFileType GetACP FreeLibrary GetProcAddress CloseHandle Process32FirstW DeleteFileW Process32NextW GetLastError Sleep MultiByteToWideChar CreateToolhelp32Snapshot SetFileAttributesW OpenProcess WaitForSingleObject FindClose GetTempPathW GetModuleFileNameW TerminateProcess GetCurrentProcess FindNextFileW FindFirstFileW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle WriteConsoleW SetEndOfFile GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess GetStdHandle GetTimeZoneInformation LoadLibraryExW RtlUnwind InterlockedPushEntrySList OutputDebugStringW GetStartupInfoW IsDebuggerPresent QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead WaitForSingleObjectEx GetCPInfo GetLocaleInfoW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer GetStringTypeW QueryPerformanceFrequency MoveFileExW

user32

wsprintfW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA SystemFunction036 RegCloseKey RegOpenKeyExW RegQueryValueExW EqualSid AllocateAndInitializeSid FreeSid CreateProcessAsUserW DuplicateTokenEx GetTokenInformation SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW OpenProcessToken

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW

ole32

CLSIDFromString OleRun CLSIDFromProgID CoCreateInstance CoUninitialize StringFromGUID2 CoCreateGuid CoInitialize

oleaut32

GetErrorInfo VariantClear VariantCopy SysAllocString SysFreeString VariantInit

shlwapi

PathAppendW PathFindFileNameW PathRemoveExtensionW PathAddExtensionW PathIsFileSpecW PathRenameExtensionW PathIsDirectoryW PathRemoveFileSpecW PathFileExistsW

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

Name

.text

Size

543KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

600KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_4f3e29b310ceaa56d9a64484d954ec82_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

wtsapi32

userenv

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

wintrust

generic