2026-08-08_3affd237fb61bfb64600cf5ad1ae5bbc_darkgate_elex_glassworm_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_3affd237fb61bfb64600cf5ad1ae5bbc_darkgate_elex_glassworm_rhadamanthys_stop
Size 2.8MB
Sample260808-ecd4gazbra
SHA256 2f5c9230a702c6c18276fc1888b77f7b63e65e202aabd679497e6f7f72815f31
MD5 3affd237fb61bfb64600cf5ad1ae5bbc
SHA1 bf051aa5034b8a89c83a96bc3e80397b900faf14
SHA512 d429bc48b89d9d982e5f2e3afe3c0eadec7aecbfdce13cceb4fd74ca1a94ecadce8b6927ceaf87a2ad51693cc1ff8ddd51bd95d2a2b759beb7985a51744bf542
SSDEEP 49152:YYCuz7AM5tp2EdoDfbxmAPqbIeHz356wU/asJsv6tWKFdu9C5TfuRLyvL/6mShMJ:XCuz7AW2EmDf9dfQz33GvJsv6tWKFdur
TLSH
T17BD58D11B7D6C177E1B31A76157F923A8536BE22473191CFA2CC3A1A6A303D1A937B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_3affd237fb61bfb64600cf5ad1ae5bbc_darkgate_elex_glassworm_rhadamanthys_stop

File Explorer

2026-08-08_3affd237fb61bfb64600cf5ad1ae5bbc_darkgate_elex_glassworm_rhadamanthys_stop

.exe 2.8MB

2026-08-08_3affd237fb61bfb64600cf5ad1ae5bbc_darkgate_elex_glassworm_rhadamanthys_stop

IMPHASH 7cd9f5ce285d25c42704be7c9b6fd19d
SHA256 2f5c9230a702c6c18276fc1888b77f7b63e65e202aabd679497e6f7f72815f31
MD5 3affd237fb61bfb64600cf5ad1ae5bbc
SHA1 bf051aa5034b8a89c83a96bc3e80397b900faf14
SHA512 d429bc48b89d9d982e5f2e3afe3c0eadec7aecbfdce13cceb4fd74ca1a94ecadce8b6927ceaf87a2ad51693cc1ff8ddd51bd95d2a2b759beb7985a51744bf542
SSDEEP 49152:YYCuz7AM5tp2EdoDfbxmAPqbIeHz356wU/asJsv6tWKFdu9C5TfuRLyvL/6mShMJ:XCuz7AW2EmDf9dfQz33GvJsv6tWKFdur
TLSH
T17BD58D11B7D6C177E1B31A76157F923A8536BE22473191CFA2CC3A1A6A303D1A937B07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1514963

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\_projects\RedefineBSTS\Script\vbkrn2.pdb

shlwapi

PathRemoveFileSpecW StrStrIW PathStripPathW SHDeleteKeyW SHSetValueW PathFileExistsA SHDeleteValueW SHGetValueW PathFileExistsW

ws2_32

WSAAsyncSelect WSAStartup inet_addr WSAGetLastError gethostbyname htons inet_ntoa setsockopt sendto socket recvfrom closesocket

wininet

InternetCrackUrlW InternetReadFile InternetConnectW HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetCloseHandle HttpQueryInfoA InternetOpenW InternetSetOptionW

iphlpapi

GetAdaptersInfo

netapi32

NetWkstaGetInfo

userenv

GetDefaultUserProfileDirectoryW CreateEnvironmentBlock

fltlib

FilterConnectCommunicationPort FilterReplyMessage FilterGetMessage

urlmon

URLDownloadToFileW FindMimeFromData

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

gdiplus

GdiplusStartup

rpcrt4

UuidToStringW UuidFromStringW RpcStringFreeW UuidCreate

wintrust

WinVerifyTrust CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminAcquireContext CryptCATAdminReleaseContext WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain CryptCATAdminCalcHashFromFileHandle CryptCATAdminReleaseCatalogContext WTHelperGetProvCertFromChain

srclient

SRSetRestorePointW

kernel32

LoadResource GetCurrentProcess OpenProcess GetSystemDirectoryW WideCharToMultiByte SizeofResource GetVersionExW GetLastError GetLongPathNameW FindClose LocalAlloc IsWow64Process LockResource FindNextFileW GetWindowsDirectoryW GetCurrentProcessId LocalFree ExpandEnvironmentStringsW MultiByteToWideChar InterlockedIncrement InterlockedDecrement FreeLibrary LoadLibraryW GetProcAddress Sleep GetLocalTime WaitForSingleObjectEx GetModuleHandleW WriteFile CopyFileW GetModuleFileNameW CreateFileW GetTempPathW DeleteFileW CreateDirectoryW CreateFileA GetFileSize GetDriveTypeW CreateProcessW HeapAlloc SystemTimeToFileTime MoveFileExW CompareFileTime GetLogicalDriveStringsW HeapFree GetComputerNameW GetProcessHeap GetDriveTypeA GetProcessTimes GetFileAttributesW TerminateProcess FileTimeToSystemTime ReadFile GetSystemDirectoryA FlushFileBuffers GetFileSizeEx GetLogicalDriveStringsA Process32FirstW RemoveDirectoryW DeviceIoControl Module32FirstW GetSystemInfo WaitForMultipleObjects Process32NextW CreateToolhelp32Snapshot GetFileAttributesExW DeleteCriticalSection SetFileAttributesW GetVolumeInformationW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW FreeResource InterlockedCompareExchange InterlockedExchange SetFilePointer GetSystemTimeAsFileTime SetFileShortNameW SetLastError BackupRead BackupWrite SleepEx SetFileTime TerminateThread GetModuleFileNameA DeleteFileA Thread32First Thread32Next CreateEventW FindResourceW WaitForMultipleObjectsEx QueryDosDeviceW CreateIoCompletionPort GetFileInformationByHandle CreateThread GetUserDefaultLCID GetLocaleInfoW GetSystemTime SetUnhandledExceptionFilter GetTickCount GetExitCodeProcess GetExitCodeThread GetDiskFreeSpaceExW VerifyVersionInfoW VerSetConditionMask FormatMessageW CompareStringW ReleaseSemaphore CreateSemaphoreW GetCommandLineW TlsFree TlsSetValue GetCurrentThreadId SwitchToThread GetCurrentThread TlsAlloc SetThreadPriority ResumeThread GetThreadPriority TlsGetValue DuplicateHandle QueryPerformanceFrequency QueryPerformanceCounter GetDateFormatW GetTimeFormatW GetCurrencyFormatW GetUserDefaultUILanguage SetFilePointerEx GetFileType SetEndOfFile GetLogicalDrives MapViewOfFile CreateFileMappingW UnmapViewOfFile MoveFileW SystemTimeToTzSpecificLocalTime SetErrorMode GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW CompareStringA CreateEventA ReleaseMutex GetVersionExA AreFileApisANSI UnlockFile LockFile LockFileEx UnlockFileEx GetFileAttributesA GetTempPathA FormatMessageA GetFullPathNameA GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileMappingA IsBadReadPtr VirtualAlloc VirtualFree lstrcpynW GetACP GetOEMCP IsValidCodePage GetStdHandle RaiseException DebugBreak lstrcmpA FindResourceExW FindFirstFileW GetQueuedCompletionStatus CloseHandle ResetEvent EnterCriticalSection LeaveCriticalSection InitializeCriticalSection SetEvent WaitForSingleObject SetConsoleCtrlHandler HeapDestroy HeapReAlloc HeapSize UnhandledExceptionFilter IsDebuggerPresent ExitThread ExitProcess GetTimeZoneInformation GetConsoleCP GetConsoleMode SetStdHandle RtlUnwind GetCPInfo LCMapStringW LCMapStringA GetStringTypeW HeapCreate GetStringTypeA SetHandleCount GetStartupInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleA SetEnvironmentVariableA SetEnvironmentVariableW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA EnumSystemLocalesA IsValidLocale FileTimeToLocalFileTime CreateMutexA

user32

wsprintfA wsprintfW OpenWindowStationW SetUserObjectSecurity CloseDesktop GetUserObjectSecurity ExitWindowsEx OpenDesktopW GetProcessWindowStation CloseWindowStation SetProcessWindowStation CharNextExA PeekMessageW PostMessageW CharLowerW SetTimer CallNextHookEx KillTimer GetQueueStatus DefWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW RegisterClassW UnregisterClassW DestroyWindow UnhookWindowsHookEx SetWindowsHookExW DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx

advapi32

AdjustTokenPrivileges RegEnumKeyExW RegOpenKeyExW RegEnumValueW RegOpenCurrentUser LookupPrivilegeValueW LookupAccountNameW ConvertStringSidToSidW RegQueryValueExW OpenServiceW OpenSCManagerW OpenProcessToken CloseServiceHandle RegCloseKey EnumServicesStatusExW SetSecurityDescriptorGroup GetAclInformation CopySid RegCreateKeyExW InitializeSecurityDescriptor SetSecurityDescriptorDacl GetAce GetSecurityDescriptorLength MakeAbsoluteSD InitializeAcl AllocateAndInitializeSid SetSecurityDescriptorOwner GetSecurityDescriptorOwner AddAccessAllowedAce IsValidSid FreeSid AddAce GetSecurityDescriptorSacl MakeSelfRelativeSD GetLengthSid RegSetValueExW GetSecurityDescriptorGroup GetSecurityDescriptorDacl DeleteService QueryServiceStatus ControlService EnumDependentServicesW GetUserNameW RegRestoreKeyW QueryServiceConfigW GetTokenInformation RegEnumKeyW GetSecurityInfo EqualSid SetServiceStatus ChangeServiceConfig2W RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW CreateServiceW RegDeleteKeyW RegSaveKeyExW RegFlushKey RevertToSelf SetEntriesInAclW SetSecurityInfo QueryServiceStatusEx ChangeServiceConfigW RegDeleteValueW ImpersonateLoggedOnUser SetFileSecurityW SetNamedSecurityInfoW RegQueryInfoKeyW RegOpenKeyW CreateProcessAsUserW

shell32

SHGetFolderPathW CommandLineToArgvW SHGetSpecialFolderPathW ord51

ole32

CoRegisterClassObject CoUnmarshalInterface CoUninitialize CoTaskMemFree CoInitialize CoInitializeSecurity CoCreateInstance StringFromCLSID CoGetCallerTID CoSetProxyBlanket CreateStreamOnHGlobal CoMarshalInterface CoInitializeEx

oleaut32

SafeArrayAccessData VariantClear SysAllocString RegisterTypeLi LoadTypeLi LoadRegTypeLi SafeArrayCreate VariantInit SafeArrayUnaccessData SysStringLen VariantCopy SetErrorInfo SysFreeString

imagehlp

CheckSumMappedFile

crypt32

CertGetNameStringW CryptQueryObject CryptDecodeObject CertCloseStore CryptMsgClose CertFreeCertificateContext CertGetCertificateContextProperty CertFindCertificateInStore CryptMsgGetParam

generic

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=10, id=105, version=2067,

count=2, id=150, version=20413,

count=57, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=109, productName=VS2005 build 50727, version=50727,

count=308, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=222, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=132, productName=VS2008 build 21022, version=21022,

count=7, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=41, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=480, id=1, productName=Unmarked objects,

count=125, id=138, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,