2026-08-01_2b7031408654c87ac041dc4e75ff66ec_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

General

Target
2026-08-01_2b7031408654c87ac041dc4e75ff66ec_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos
Size 3.7MB
Sample260802-bfy19sbj61
SHA256 b7a216e74efa27d77e92709573c03cadf396a8a4c09ace85803c2b85e48a30c5
MD5 2b7031408654c87ac041dc4e75ff66ec
SHA1 0fa7e8bc3aa6b9bda51d3c0d3320ee5507d7e424
SHA512 e44d574c2fc40dd5b712d744ac93836bef19cf07257ad8a6dfd3f8352b7cc84c990e8c1e676e8da20e7634c16ee28ed47f47cca8653c587a414b8665e5434445
SSDEEP 98304:2z7sgtgNfanerpwubth3NQtvqx9XIg/ontIAx:2t4fnr7vqtcXlotIAx
TLSH
T12306F12275408073E2B20231DDBD6B759ABDB6703B7540DBB3D41E2D5DB01D2AA39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_2b7031408654c87ac041dc4e75ff66ec_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-08-01_2b7031408654c87ac041dc4e75ff66ec_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

.exe 3.7MB

2026-08-01_2b7031408654c87ac041dc4e75ff66ec_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

SHA256 b7a216e74efa27d77e92709573c03cadf396a8a4c09ace85803c2b85e48a30c5
MD5 2b7031408654c87ac041dc4e75ff66ec
SHA1 0fa7e8bc3aa6b9bda51d3c0d3320ee5507d7e424
SHA512 e44d574c2fc40dd5b712d744ac93836bef19cf07257ad8a6dfd3f8352b7cc84c990e8c1e676e8da20e7634c16ee28ed47f47cca8653c587a414b8665e5434445
SSDEEP 98304:2z7sgtgNfanerpwubth3NQtvqx9XIg/ontIAx:2t4fnr7vqtcXlotIAx
TLSH
T12306F12275408073E2B20231DDBD6B759ABDB6703B7540DBB3D41E2D5DB01D2AA39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

955668

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CreateExportObj DestroyExportObj NSISLog curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_header curl_easy_init curl_easy_nextheader curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_poll curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_multi_wakeup curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_url_strerror

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

291KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=24, id=241, version=40116,

count=195, id=243, version=40116,

count=31, id=242, version=40116,

count=7, id=199, version=41118,

count=26, id=259, version=24123,

count=121, id=260, version=24234,

count=1, id=260, version=27049,

count=43, id=261, version=27049,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=127, id=261, version=24123,

count=39, id=260, version=24123,

count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=516, id=1, productName=Unmarked objects,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=21, id=265, version=24234,

count=1, id=256, version=24234,

count=1, id=255, version=24234,

count=1, id=151,

count=1, id=258, version=24234,

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_2b7031408654c87ac041dc4e75ff66ec_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

generic