2026-08-06_54643c94de0da12506458ad72163604f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

General

Target
2026-08-06_54643c94de0da12506458ad72163604f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
Size 1.8MB
Sample260806-d9fg5aserc
SHA256 cdd8e7b07f4fdd70a1fa60f298557eecd6e3e61b03e3138ec811d52145e92e12
MD5 54643c94de0da12506458ad72163604f
SHA1 52d661358d6109b6df447ffba266ca64b496893e
SHA512 717df23efe6ec78bd3964c8708a18e00bfde49443fb458e559e7f7fd3179982b731675d750973c700a770f0463392cc7a0415f78618d824e18edfb5e5d90a162
SSDEEP 49152:+OMFLbaFbFgqiGNoJVil8Ctjfyr9VfO3Z:STqxbyhpO
TLSH
T1F7955C017681C83BC6720730CCB5E2F82579BD58ED228B5F7784FF9E3E316416A9166A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_54643c94de0da12506458ad72163604f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-08-06_54643c94de0da12506458ad72163604f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

.exe 1.8MB

2026-08-06_54643c94de0da12506458ad72163604f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

SHA256 cdd8e7b07f4fdd70a1fa60f298557eecd6e3e61b03e3138ec811d52145e92e12
MD5 54643c94de0da12506458ad72163604f
SHA1 52d661358d6109b6df447ffba266ca64b496893e
SHA512 717df23efe6ec78bd3964c8708a18e00bfde49443fb458e559e7f7fd3179982b731675d750973c700a770f0463392cc7a0415f78618d824e18edfb5e5d90a162
SSDEEP 49152:+OMFLbaFbFgqiGNoJVil8Ctjfyr9VfO3Z:STqxbyhpO
TLSH
T1F7955C017681C83BC6720730CCB5E2F82579BD58ED228B5F7784FF9E3E316416A9166A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

217411

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

455KB

Virtual Size

454KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

17B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_54643c94de0da12506458ad72163604f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

generic