2026-08-08_586f738c268ddfbfed6f74706e4e89d2_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_586f738c268ddfbfed6f74706e4e89d2_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos
Size 1.3MB
Sample260808-nzhvlsdd26
SHA256 b21024d10b3f176ee3fb085cfec105c15070e9ea34b7adee183e7fbe9b61c000
MD5 586f738c268ddfbfed6f74706e4e89d2
SHA1 488b42997ca70136cf272e98ae7e9def723d0e48
SHA512 a2dabc8bfc3506f2cbc6afffd0d019baf0a90bf26245a7f91ee49787a2feb77d1b64b97b049eac6045a2783b1813d8f846db575017203666ac411514c23d7976
SSDEEP 24576:/dGxIoI6YVtv1tCjIk0LPTz0rUAfLsqjnhMgeiCl7G0nehbGZpbD:hoc1tyIfPTz0AAf/Dmg27RnWGj
TLSH
T14055CF217647D13BE4B205F049BCAA6B642EBC180F749ADBF3D81B2D29705C15F32B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_586f738c268ddfbfed6f74706e4e89d2_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

File Explorer

2026-08-08_586f738c268ddfbfed6f74706e4e89d2_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

.exe 1.3MB

2026-08-08_586f738c268ddfbfed6f74706e4e89d2_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

IMPHASH 520a628b190e1e82c03815ba7a42df75
SHA256 b21024d10b3f176ee3fb085cfec105c15070e9ea34b7adee183e7fbe9b61c000
MD5 586f738c268ddfbfed6f74706e4e89d2
SHA1 488b42997ca70136cf272e98ae7e9def723d0e48
SHA512 a2dabc8bfc3506f2cbc6afffd0d019baf0a90bf26245a7f91ee49787a2feb77d1b64b97b049eac6045a2783b1813d8f846db575017203666ac411514c23d7976
SSDEEP 24576:/dGxIoI6YVtv1tCjIk0LPTz0rUAfLsqjnhMgeiCl7G0nehbGZpbD:hoc1tyIfPTz0AAf/Dmg27RnWGj
TLSH
T14055CF217647D13BE4B205F049BCAA6B642EBC180F749ADBF3D81B2D29705C15F32B66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

365093

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builds\ACC\GM\source\dev\target\win32\Release\ElevationManager\AdobeUpdateService.pdb

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

WideCharToMultiByte GetExitCodeProcess VerSetConditionMask VerifyVersionInfoW HeapFree CreateThread HeapAlloc GetProcessHeap InitializeCriticalSectionEx RaiseException DecodePointer DeleteCriticalSection ResumeThread GetFileSizeEx CreateFileW SetLastError HeapSize CreateEventW ProcessIdToSessionId SetEvent GlobalAlloc GlobalFree HeapReAlloc ResetEvent LocalFree GetCurrentProcessId GetModuleHandleW lstrcmpiW lstrcmpW ReadFile SetNamedPipeHandleState EnterCriticalSection WriteFile CreateNamedPipeW LeaveCriticalSection InitializeCriticalSection ConnectNamedPipe SetFilePointer GetCurrentThreadId LocalAlloc GetFileAttributesW CopyFileW MoveFileExW FlushFileBuffers GetUserDefaultLangID FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW GetUserDefaultLCID LCMapStringW GetVersionExW GetUserDefaultUILanguage ReadConsoleW SetFilePointerEx EnumSystemLocalesW IsValidLocale GetConsoleMode GetConsoleCP GetFileType GetACP FreeLibrary GetProcAddress CloseHandle Process32FirstW DeleteFileW Process32NextW GetLastError Sleep MultiByteToWideChar CreateToolhelp32Snapshot SetFileAttributesW OpenProcess WaitForSingleObject FindClose GetTempPathW GetModuleFileNameW TerminateProcess GetCurrentProcess FindNextFileW FindFirstFileW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle WriteConsoleW SetEndOfFile GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess GetStdHandle GetTimeZoneInformation LoadLibraryExW RtlUnwind InterlockedPushEntrySList OutputDebugStringW GetStartupInfoW IsDebuggerPresent QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead WaitForSingleObjectEx GetCPInfo GetLocaleInfoW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer GetStringTypeW QueryPerformanceFrequency

user32

wsprintfW

advapi32

GetTokenInformation CryptGenRandom CryptReleaseContext CryptAcquireContextA SystemFunction036 RegCloseKey RegOpenKeyExW RegQueryValueExW EqualSid AllocateAndInitializeSid FreeSid CreateProcessAsUserW DuplicateTokenEx SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW OpenProcessToken

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW

ole32

CLSIDFromString OleRun CLSIDFromProgID CoCreateInstance CoUninitialize StringFromGUID2 CoCreateGuid CoInitialize

oleaut32

GetErrorInfo VariantClear VariantCopy SysAllocString SysFreeString VariantInit

shlwapi

PathAppendW PathFindFileNameW PathRemoveExtensionW PathAddExtensionW PathIsFileSpecW PathRenameExtensionW PathIsDirectoryW PathRemoveFileSpecW PathFileExistsW

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

Name

.text

Size

543KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

600KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_586f738c268ddfbfed6f74706e4e89d2_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

wtsapi32

userenv

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

wintrust

generic