2026-08-01_b0621dedcd67322916a7f0cc62f71a03_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_b0621dedcd67322916a7f0cc62f71a03_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007
Size 1.6MB
Sample260801-bep2zavalc
SHA256 86064617870129f88a5cb2016f013800cdc6de0b7f660d31f0d0518925a5866e
MD5 b0621dedcd67322916a7f0cc62f71a03
SHA1 6fbcbf317773315c08a3019353223e4b7f894611
SHA512 c69088873f6ccec85e11d23849d44e75ae559158f7ba7ccc0eb50355d509aaccc133a9643b4ea059da5b43037bf13a75d3613ce0a404c9e26020ce14fdc2f5ba
SSDEEP 49152:3ricRL2MGhRcvguWIxn28bhDRRPNTdz4ZP:3rtRNGhevguWIxp1Fc
TLSH
T12685CF13BBC285B6E5970230A577937E8A3AAA244739C5D3C7D01C698C312D16B3F7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-01_b0621dedcd67322916a7f0cc62f71a03_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007

File Explorer

2026-08-01_b0621dedcd67322916a7f0cc62f71a03_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007

.exe 1.6MB

2026-08-01_b0621dedcd67322916a7f0cc62f71a03_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007

IMPHASH 46369eb55e3232e6ff931a233195ae8b
SHA256 86064617870129f88a5cb2016f013800cdc6de0b7f660d31f0d0518925a5866e
MD5 b0621dedcd67322916a7f0cc62f71a03
SHA1 6fbcbf317773315c08a3019353223e4b7f894611
SHA512 c69088873f6ccec85e11d23849d44e75ae559158f7ba7ccc0eb50355d509aaccc133a9643b4ea059da5b43037bf13a75d3613ce0a404c9e26020ce14fdc2f5ba
SSDEEP 49152:3ricRL2MGhRcvguWIxn28bhDRRPNTdz4ZP:3rtRNGhevguWIxp1Fc
TLSH
T12685CF13BBC285B6E5970230A577937E8A3AAA244739C5D3C7D01C698C312D16B3F7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

61:08:6d:f5:b5:b4:a3:88:02:bc:4f:67:60:c7:03:eb:f4:e5:94:cb

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=220-81-89229,CN=VP Inc.,O=VP Inc.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130a47616e676e616d2d6775,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Dec 7, 2017

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

0f:6b:62:d3:60:ee:b2:5a:4a:7c:e3:2f:37:f3:c5:00

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 23, 2017 - Oct 23, 2019

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2014 - Mar 3, 2024

Minor OS version

Major OS version

Entry point

881157

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\VP_EISP\Release\VPWalletDaemon.pdb

kernel32

Process32FirstW CloseHandle GetModuleHandleW WideCharToMultiByte CreateEventW SetEvent ResumeThread Sleep ReadFile WriteFile GetExitCodeProcess CreateProcessA WTSGetActiveConsoleSessionId CreateNamedPipeA ConnectNamedPipe FindResourceW LoadResource Process32NextW TerminateThread GetStdHandle GetFileType GetModuleHandleA FlushConsoleInputBuffer QueryPerformanceCounter GetCPInfo GetTickCount FreeLibrary LoadLibraryA GlobalMemoryStatus SetLastError GetSystemTime SystemTimeToFileTime GetFullPathNameW GetCurrentDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess GetACP LockResource TerminateProcess GetCurrentProcess GetModuleFileNameA GetSystemDirectoryA OutputDebugStringW GetCurrentDirectoryA ReleaseMutex GetCurrentThreadId WaitForSingleObject CreateMutexW GetProcAddress UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc GetThreadTimes UnregisterWait RegisterWaitForSingleObject LoadLibraryW GetLastError GetVersionExW GetCurrentProcessId SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue SetEndOfFile HeapSize WriteConsoleW GetProcessHeap SetEnvironmentVariableW SetEnvironmentVariableA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ResetEvent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead EncodePointer DecodePointer RaiseException TryEnterCriticalSection DuplicateHandle GetCurrentThread GetExitCodeThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList RtlUnwind GetFileAttributesExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess SetConsoleCtrlHandler GetConsoleMode ReadConsoleInputA SetConsoleMode GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree HeapReAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetFilePointerEx CreateDirectoryW FlushFileBuffers GetConsoleCP ReadConsoleW SetStdHandle CreateFileW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW

user32

GetUserObjectInformationW GetProcessWindowStation MessageBoxW MessageBoxA

advapi32

DeregisterEventSource OpenProcessToken ReportEventA RegisterEventSourceA CreateProcessAsUserA DuplicateTokenEx LookupPrivilegeValueW

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

ws2_32

setsockopt WSAGetLastError recv inet_addr htons bind listen accept ntohs inet_ntoa ioctlsocket WSAStartup closesocket shutdown WSASetLastError select __WSAFDIsSet send socket

wtsapi32

WTSQueryUserToken

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

347KB

Virtual Size

347KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_b0621dedcd67322916a7f0cc62f71a03_darkgate_elex_floxif_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007

PE Signature issue

kernel32

user32

advapi32

version

ws2_32

wtsapi32

generic