2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze
Size 3.2MB
Sample260730-aevf1sha67
SHA256 3dcd8458ac6771a3bd6615fce05a0bda1470e711cf90b7b1c6f795b9f0062f16
MD5 5bd243418235c18aa709715cecd4c3cb
SHA1 d7901f2e7ec087d5930f855f5ff06495abfcdb18
SHA512 0a2a16f433a9e13e02476582695252e74c6b42233b5ccf57d4859873b37672eeb51b9d65611354618ff835f818fd2271d5e04358ca73fbc87f91124754818e84
SSDEEP 49152:WT5KdQcqomqoXu5nEMcSVr2sRSxT1MlzrXJhBHkLNiXicJFFRGNzj3:WTrv7q0/xjsnC7wRGpj3
TLSH
T1ABF5B032B782C0B5E9B301B2496EA75E146DBB64073449CFE3D41E1E6F306D26A3A717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze

File Explorer

2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze

.exe 3.2MB

2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze

IMPHASH 32d16879415af46f423f3702fba5cdbb
SHA256 3dcd8458ac6771a3bd6615fce05a0bda1470e711cf90b7b1c6f795b9f0062f16
MD5 5bd243418235c18aa709715cecd4c3cb
SHA1 d7901f2e7ec087d5930f855f5ff06495abfcdb18
SHA512 0a2a16f433a9e13e02476582695252e74c6b42233b5ccf57d4859873b37672eeb51b9d65611354618ff835f818fd2271d5e04358ca73fbc87f91124754818e84
SSDEEP 49152:WT5KdQcqomqoXu5nEMcSVr2sRSxT1MlzrXJhBHkLNiXicJFFRGNzj3:WTrv7q0/xjsnC7wRGpj3
TLSH
T1ABF5B032B782C0B5E9B301B2496EA75E146DBB64073449CFE3D41E1E6F306D26A3A717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1401444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builds\Updater\9.0\source\build\updateinstaller\vc\outdir-Release\updateinstaller.pdb

iphlpapi

GetIfTable

setupapi

SetupDiEnumDeviceInfo CM_Get_DevNode_Status SetupDiGetDeviceInstanceIdW SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList

msi

ord88 ord141 ord175 ord137

shell32

CommandLineToArgvW ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderPathW SHFileOperationW SHGetSpecialFolderLocation SHCreateDirectoryExW

shlwapi

PathAddExtensionW PathAppendW PathFindFileNameW PathRemoveExtensionW PathRenameExtensionW PathStripToRootA PathRemoveFileSpecW PathIsFileSpecW PathFileExistsW PathIsDirectoryW

winhttp

WinHttpSetOption WinHttpReceiveResponse WinHttpSetTimeouts WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpSetCredentials WinHttpQueryAuthSchemes

crypt32

CertGetNameStringW CryptQueryObject CertFreeCertificateContext CertFindCertificateInStore CryptMsgGetParam CryptImportPublicKeyInfo

kernel32

CreateWaitableTimerA lstrlenA ExitThread SetWaitableTimer CreateNamedPipeW SearchPathA CreateProcessA CreatePipe ConnectNamedPipe WaitForMultipleObjects OpenEventA WaitNamedPipeW GlobalFree ResumeThread GetTickCount CreateEventA CloseHandle SetEvent GetSystemTimeAsFileTime GetLocalTime GetFileSize WriteFile GetFileAttributesW ReadFile CreateFileW GetProcessHeap ReleaseSemaphore HeapAlloc HeapFree WaitForSingleObject Sleep FreeLibrary LoadLibraryW GetProcAddress DuplicateHandle GetCurrentProcess CreateSemaphoreA GetCommandLineW SetDllDirectoryW LocalFree CreateProcessW GetLastError FindFirstFileW GetEnvironmentStringsW GetExitCodeProcess FindClose FreeEnvironmentStringsW FindNextFileW CreateThread InitializeCriticalSectionAndSpinCount RaiseException DecodePointer DeleteCriticalSection SystemTimeToFileTime InterlockedDecrement TerminateThread GetExitCodeThread SetLastError CreateMutexA ReleaseMutex SetFilePointer EncodePointer HeapReAlloc IsDebuggerPresent IsProcessorFeaturePresent GetCurrentThreadId ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte HeapSize IsValidCodePage GetACP GetOEMCP GetCPInfo GetTimeZoneInformation FileTimeToLocalFileTime GetFileType GetFullPathNameW GetModuleHandleW GetStdHandle GetModuleFileNameW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW CreateSemaphoreW EnterCriticalSection LeaveCriticalSection GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx RtlUnwind QueryPerformanceCounter GetCurrentProcessId LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW SetStdHandle SetEndOfFile OutputDebugStringW WriteConsoleW FlushFileBuffers GetFullPathNameA SetEnvironmentVariableA InterlockedIncrement GetFileTime GetTempFileNameW GetDiskFreeSpaceExW CreateDirectoryW RemoveDirectoryW SetFileAttributesW DeleteFileW CopyFileW MoveFileExW GetVolumeInformationW GetVersionExW GetLongPathNameW GetTempPathW GetEnvironmentVariableW InitializeCriticalSection GetFileSizeEx CreateMutexW OpenMutexW ResetEvent LocalAlloc GetSystemTime CreateFileA HeapCompact MapViewOfFile UnmapViewOfFile UnlockFile LockFile UnlockFileEx FormatMessageA FormatMessageW HeapDestroy GetFileAttributesA HeapCreate HeapValidate LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetTempPathA DeleteFileA

user32

wsprintfW

advapi32

RegSetValueExW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetEntriesInAclW OpenProcessToken GetTokenInformation EqualSid AllocateAndInitializeSid FreeSid CheckTokenMembership SetNamedSecurityInfoW RegCreateKeyExA CryptVerifySignatureW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW GetUserNameW RegCloseKey

ole32

CoSetProxyBlanket CoInitializeEx CoInitialize CoInitializeSecurity CoUninitialize CoCreateInstance

oleaut32

SysStringLen SysFreeString SysAllocStringByteLen VariantClear SysAllocString

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WTHelperGetProvCertFromChain

wininet

InternetCrackUrlA InternetCanonicalizeUrlA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFileExA InternetSetOptionA InternetSetStatusCallbackA InternetSetStatusCallbackW HttpOpenRequestA HttpSendRequestA HttpQueryInfoA

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

383KB

Virtual Size

383KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

122KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

672KB

Virtual Size

676KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=7, id=225, version=20806,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=219, productName=Unmarked objects (old),

count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=3, id=206, productName=VS2012 UPD4 build 61030, version=61030,

count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=203, version=65501,

count=339, id=1, productName=Unmarked objects,

count=1, id=208, version=65501,

count=116, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=3, id=199, version=41118,

count=97, id=225, productName=VS2013 build 21005, version=21005,

count=35, id=223, productName=VS2013 build 21005, version=21005,

count=260, id=224, productName=VS2013 build 21005, version=21005,

count=118, id=229, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,