2026-08-04_3907feebf18385538fcd8457ad7af370_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_3907feebf18385538fcd8457ad7af370_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat
Size 41.5MB
Sample260804-tmrvmsdd83
SHA256 7d1cedc4bf39520c1be9bb90a7e40478fe8fde1e0e2ea57953dab63f83793651
MD5 3907feebf18385538fcd8457ad7af370
SHA1 56fbf758946bfa8681333646be1b6374d5294229
SHA512 e55510e1d094f884a7359a67971e0e74de881e20a7243c41b80a2b010c03708792b5cf83f496a9eed0a5143efba51c64502f62a6bda3333b1c782f37183bc970
SSDEEP 393216:OhYZeCS0tUtpZxFVfr0OA2aMkWrbRFxDd2M/PpYmAcPW:VRScONf6WnxoMZYB
TLSH
T1D0976C42F79352E5EA4718B0305EB33FEB351909832CDFE3DBF85E20997A7825526909
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_3907feebf18385538fcd8457ad7af370_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat

File Explorer

2026-08-04_3907feebf18385538fcd8457ad7af370_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat

.exe 41.5MB

2026-08-04_3907feebf18385538fcd8457ad7af370_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat

IMPHASH 9a0bed66e2ec87eba49c9549c61a3db8
SHA256 7d1cedc4bf39520c1be9bb90a7e40478fe8fde1e0e2ea57953dab63f83793651
MD5 3907feebf18385538fcd8457ad7af370
SHA1 56fbf758946bfa8681333646be1b6374d5294229
SHA512 e55510e1d094f884a7359a67971e0e74de881e20a7243c41b80a2b010c03708792b5cf83f496a9eed0a5143efba51c64502f62a6bda3333b1c782f37183bc970
SSDEEP 393216:OhYZeCS0tUtpZxFVfr0OA2aMkWrbRFxDd2M/PpYmAcPW:VRScONf6WnxoMZYB
TLSH
T1D0976C42F79352E5EA4718B0305EB33FEB351909832CDFE3DBF85E20997A7825526909
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35035824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

uv.pdb

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile NtOpenFile NtReadFile RtlGetVersion

advapi32

RegOpenKeyExW RegCloseKey RegSetValueExW RegDeleteTreeW RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegDeleteValueW RegQueryInfoKeyW RegEnumKeyExW RegGetValueA RegQueryValueExW SystemFunction036 CredWriteW CredFree CredReadW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken CredDeleteW LookupPrivilegeValueA

kernel32

FindNextFileW GetOEMCP CreateIoCompletionPort SetFileCompletionNotificationModes ReadFile GetOverlappedResult PostQueuedCompletionStatus WriteFile CancelIoEx GetQueuedCompletionStatusEx GetModuleHandleA GetProcAddress DeviceIoControl SetFileInformationByHandle TerminateProcess GetExitCodeProcess GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW GetModuleFileNameW GetCommandLineW GetACP DeleteFileW LocalFree CreateProcessA ExitProcess GetCurrentProcess DuplicateHandle GetCurrentThreadId GetCurrentThread RtlCaptureContext ReleaseMutex SetLastError GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA WideCharToMultiByte GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW ReadFileEx GetModuleHandleW FormatMessageW SetHandleInformation CreateThread SetThreadStackGuarantee GetFullPathNameW FindFirstFileExW ReadConsoleW CreateEventW LockFileEx CreateDirectoryW WaitForMultipleObjects CancelIo CompareStringOrdinal CreateProcessW GetFileAttributesW IsValidCodePage GetTempPathW RemoveDirectoryW GetFinalPathNameByHandleW GetConsoleScreenBufferInfo CopyFileExW MoveFileExW CreateSymbolicLinkW CreateHardLinkW GetFileType RegisterWaitForSingleObject UnregisterWaitEx SetConsoleCtrlHandler CreateSemaphoreA SetUnhandledExceptionFilter SetEnvironmentVariableW AddVectoredExceptionHandler SetCurrentDirectoryW GetFileInformationByHandleEx GetConsoleMode GetStdHandle UnlockFile SetStdHandle GetCurrentProcessId SetFileTime FlushProcessWriteBuffers HeapSize GetFileSizeEx GetFileInformationByHandle SetFilePointerEx BeginUpdateResourceW UpdateResourceW EndUpdateResourceW LoadLibraryExW FreeLibrary FindResourceW SizeofResource LoadResource LockResource GetModuleHandleExA FlushFileBuffers LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue LoadLibraryW FillConsoleOutputAttribute LCMapStringW CompareStringW GetCPInfo GetSystemTimePreciseAsFileTime CreateFileMappingW MapViewOfFile VirtualProtect OutputDebugStringW DecodePointer UnhandledExceptionFilter GetSystemInfo FillConsoleOutputCharacterA WriteFileEx IsDebuggerPresent GetCommandLineA GetModuleHandleExW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree GetStringTypeW SetNamedPipeHandleState GetNumberOfConsoleInputEvents SwitchToThread ReleaseSemaphore WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW Sleep SetConsoleCursorInfo GetConsoleCursorInfo FlsSetValue HeapReAlloc FlsGetValue FlsAlloc RaiseException GetSystemDirectoryW GetWindowsDirectoryW RtlUnwind GetStartupInfoW UnmapViewOfFile InitializeSListHead SleepEx SetConsoleCursorPosition FindClose GetDynamicTimeZoneInformation HeapFree HeapAlloc GetProcessHeap CloseHandle ReadConsoleInputW SetConsoleMode SetEndOfFile GetBinaryTypeW GetLastError SetConsoleTextAttribute GetSystemTimeAsFileTime SetFileAttributesW IsProcessorFeaturePresent WriteConsoleA VirtualQuery VirtualFree VirtualAlloc GetCurrentProcessorNumber GetProcessTimes TryAcquireSRWLockExclusive QueryPerformanceFrequency GetEnvironmentVariableA QueryPerformanceCounter

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

userenv

GetUserProfileDirectoryW

oleaut32

SysFreeString SysStringLen GetErrorInfo

user32

SendMessageTimeoutW

cfgmgr32

CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW

ws2_32

getsockname recv getpeername shutdown send setsockopt ioctlsocket freeaddrinfo WSAIoctl bind closesocket connect WSASocketW getsockopt WSASend WSAStartup getaddrinfo WSAGetLastError WSACleanup

bcrypt

BCryptGenRandom

crypt32

CertSetCertificateContextProperty CertCloseStore CertCreateCertificateChainEngine CertGetCertificateChain CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateChainEngine CertFreeCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateContext

Name

.text

Size

35.3MB

Virtual Size

35.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dep-v0

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

808KB

Virtual Size

808KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_3907feebf18385538fcd8457ad7af370_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat

ntdll

advapi32

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

shell32

ole32

userenv

oleaut32

user32

cfgmgr32

ws2_32

bcrypt

crypt32

generic