2026-08-02_73e8b999a7de234bab86533f7297fdf1_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_73e8b999a7de234bab86533f7297fdf1_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007
Size 1.7MB
Sample260803-dtvbcabe27
SHA256 aa3769a0f64ae5049c8bc359e1a6a36ed567f6744653e899b11f1368c00f2a7b
MD5 73e8b999a7de234bab86533f7297fdf1
SHA1 b820e724502ef80832944f42c7b40c0bab388751
SHA512 d3363ee4eb85d9624defbee9870dc6c7e88c47e7fd8d956a2a5e9bdcc1a619ea2d5de14096f413a40210f265ad79f83cc1f8c08d0d42d3d7f3b793e7b90d621c
SSDEEP 24576:N+KpP+PFw2EsvYxVQF3V/wKQD1b33UUr/Qmbct/jhqPdvOJurKXMnhURPrRUAEP8:9GEwF3dwKSLz/DPPhOqKXUhURPNmPoZ1
TLSH
T1E485CF13BBC185B2E5A70230A576937F8A7AAA244738C5D7C7D0196C8C312D16B3F7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-02_73e8b999a7de234bab86533f7297fdf1_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007

File Explorer

2026-08-02_73e8b999a7de234bab86533f7297fdf1_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007

.exe 1.7MB

2026-08-02_73e8b999a7de234bab86533f7297fdf1_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007

IMPHASH 929be28ad5f8e5e7e77faa133b583da8
SHA256 aa3769a0f64ae5049c8bc359e1a6a36ed567f6744653e899b11f1368c00f2a7b
MD5 73e8b999a7de234bab86533f7297fdf1
SHA1 b820e724502ef80832944f42c7b40c0bab388751
SHA512 d3363ee4eb85d9624defbee9870dc6c7e88c47e7fd8d956a2a5e9bdcc1a619ea2d5de14096f413a40210f265ad79f83cc1f8c08d0d42d3d7f3b793e7b90d621c
SSDEEP 24576:N+KpP+PFw2EsvYxVQF3V/wKQD1b33UUr/Qmbct/jhqPdvOJurKXMnhURPrRUAEP8:9GEwF3dwKSLz/DPPhOqKXUhURPNmPoZ1
TLSH
T1E485CF13BBC185B2E5A70230A576937F8A7AAA244738C5D7C7D0196C8C312D16B3F7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4a:2f:8b:aa:62:5d:7c:7f:6b:0b:d9:3a:dd:c1:74:68:fa:4e:95:7c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-1986566,CN=VP Inc.,O=VP Inc.,L=Jung-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Jul 1, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

Serial Number

0b:4c:c0:14:64:ca:15:78:00:b7:a0:f6:32:ca:74:ae

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 8, 2023 - Oct 26, 2025

Minor OS version

Major OS version

Entry point

881540

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\pc-eisp\Release\VPWalletDaemon.pdb

kernel32

Process32NextW Process32FirstW CloseHandle GetModuleHandleW WideCharToMultiByte CreateEventW SetEvent ResumeThread Sleep ReadFile WriteFile GetExitCodeProcess CreateProcessA WTSGetActiveConsoleSessionId CreateNamedPipeA ConnectNamedPipe FindResourceW MultiByteToWideChar LockResource TerminateThread GetStdHandle GetFileType GetModuleHandleA FlushConsoleInputBuffer GetCurrentProcess GetCurrentProcessId GetTickCount FreeLibrary LoadLibraryA GlobalMemoryStatus SetLastError GetSystemTime SystemTimeToFileTime GetFullPathNameW GetCurrentDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW CreateToolhelp32Snapshot OpenProcess GetACP TerminateProcess LoadResource GetCPInfo GetModuleFileNameA CreateDirectoryW GetSystemDirectoryA OutputDebugStringW GetCurrentDirectoryA ReleaseMutex GetCurrentThreadId WaitForSingleObject CreateMutexW GetProcAddress UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc GetThreadTimes UnregisterWait RegisterWaitForSingleObject LoadLibraryW GetLastError GetVersionExW QueryPerformanceCounter SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue SetEndOfFile HeapSize WriteConsoleW GetProcessHeap SetEnvironmentVariableW SetEnvironmentVariableA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ResetEvent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead EncodePointer DecodePointer RaiseException TryEnterCriticalSection DuplicateHandle GetCurrentThread GetExitCodeThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList RtlUnwind GetFileAttributesExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess SetConsoleCtrlHandler GetConsoleMode ReadConsoleInputA SetConsoleMode GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree HeapReAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetFilePointerEx FlushFileBuffers GetConsoleCP ReadConsoleW SetStdHandle CreateFileW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW

user32

GetUserObjectInformationW GetProcessWindowStation MessageBoxW MessageBoxA

advapi32

DeregisterEventSource OpenProcessToken ReportEventA RegisterEventSourceA CreateProcessAsUserA DuplicateTokenEx LookupPrivilegeValueW

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

ws2_32

setsockopt WSAGetLastError __WSAFDIsSet inet_addr htons bind listen accept ntohs inet_ntoa ioctlsocket WSAStartup closesocket shutdown WSASetLastError select recv send socket

wtsapi32

WTSQueryUserToken

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

348KB

Virtual Size

347KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_73e8b999a7de234bab86533f7297fdf1_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil_up007

PE Signature issue

kernel32

user32

advapi32

version

ws2_32

wtsapi32

generic