2026-08-08_e0b1a3940e8e83a66a04b03e83f8e821_darkgate_elex_glassworm_maze_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_e0b1a3940e8e83a66a04b03e83f8e821_darkgate_elex_glassworm_maze_remcos
Size 3.0MB
Sample260808-swtj6ahl7x
SHA256 66ceed2dea9077f181e361719f1d873e1c9ab8038ca2aa3fc44c6bfa5644cf2c
MD5 e0b1a3940e8e83a66a04b03e83f8e821
SHA1 6fd76d09a9303d39eca339d4084d3f383682eb4a
SHA512 814c3bda48d874e25262bedc8fb4b5d8edea8cafa538c8baf540e28033b36def550fe230f6ece7e0b14a9c00f0e78f6056ff304ab70ca0540d6be3375ab91ab3
SSDEEP 49152:OjpKotCJyiFf1Nbe/GWc/nmWWoVrf7usG/HZ7aGgoYgq7uTJW8Y:O+bc4vW6VGhzFq7uTrY
TLSH
T151E50241BBC1C173D86201715ABCA7BD903CBEA1473969C7E3C83F1E29785C16E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_e0b1a3940e8e83a66a04b03e83f8e821_darkgate_elex_glassworm_maze_remcos

File Explorer

2026-08-08_e0b1a3940e8e83a66a04b03e83f8e821_darkgate_elex_glassworm_maze_remcos

.exe 3.0MB

2026-08-08_e0b1a3940e8e83a66a04b03e83f8e821_darkgate_elex_glassworm_maze_remcos

IMPHASH 0c1134638e02784255eb824c487017d8
SHA256 66ceed2dea9077f181e361719f1d873e1c9ab8038ca2aa3fc44c6bfa5644cf2c
MD5 e0b1a3940e8e83a66a04b03e83f8e821
SHA1 6fd76d09a9303d39eca339d4084d3f383682eb4a
SHA512 814c3bda48d874e25262bedc8fb4b5d8edea8cafa538c8baf540e28033b36def550fe230f6ece7e0b14a9c00f0e78f6056ff304ab70ca0540d6be3375ab91ab3
SSDEEP 49152:OjpKotCJyiFf1Nbe/GWc/nmWWoVrf7usG/HZ7aGgoYgq7uTJW8Y:O+bc4vW6VGhzFq7uTrY
TLSH
T151E50241BBC1C173D86201715ABCA7BD903CBEA1473969C7E3C83F1E29785C16E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

475694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\project_sign_file\360Game\src\setup\installer\bin\Release\uninst.pdb

kernel32

InterlockedExchange SetLastError TerminateThread SuspendThread FlushInstructionCache GetCurrentProcess GetExitCodeProcess MoveFileW WideCharToMultiByte TerminateProcess OpenProcess GetPrivateProfileIntW FindNextFileW RemoveDirectoryW FindClose FindFirstFileW GetPrivateProfileStringW CreateThread Sleep GetTickCount MoveFileExW CopyFileW GetFileAttributesW SetFileAttributesW GetLongPathNameW lstrcmpiW GetCurrentThreadId CreateMutexW GetLocalTime WritePrivateProfileStringW DecodePointer GetTempFileNameW GetTempPathW DeleteFileW RaiseException InitializeCriticalSectionAndSpinCount WaitForSingleObject SetEvent InterlockedDecrement InterlockedIncrement CreateEventW MultiByteToWideChar LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection LocalFree GetLastError CreateProcessW LoadLibraryW GetModuleFileNameW GetCurrentProcessId CloseHandle DeviceIoControl CreateFileW FindResourceExW FindResourceW LoadResource LockResource SizeofResource FreeLibrary LoadLibraryExW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy LoadLibraryExA VirtualQuery VirtualProtect SetThreadContext GetThreadContext ResumeThread ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock GetSystemTime FormatMessageW GetFileSizeEx LocalFileTimeToFileTime SystemTimeToFileTime CreateFileA SetEnvironmentVariableA WriteConsoleW FlushFileBuffers SetStdHandle GetConsoleCP GetCurrentThread GetProcAddress FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTimeZoneInformation GetFileType GetStdHandle ReadConsoleW GetConsoleMode SetFilePointerEx GetModuleHandleExW ExitProcess GetOEMCP GetACP IsValidCodePage GetStartupInfoW SetUnhandledExceptionFilter GetModuleHandleW GetWindowsDirectoryW UnhandledExceptionFilter EnumSystemLocalesW GetUserDefaultLCID IsValidLocale IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree GetStringTypeW EncodePointer WriteFile lstrlenW TlsAlloc TlsFree TlsGetValue TlsSetValue VerifyVersionInfoW VerSetConditionMask GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetFileSize ReadFile MulDiv FreeResource GetVersionExW WaitForMultipleObjects GetSystemTimeAsFileTime ExitThread GetCommandLineW RtlUnwind GetCPInfo GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

user32

AttachThreadInput IsZoomed ClientToScreen SetWindowRgn InflateRect ScreenToClient IsRectEmpty InvalidateRect UnionRect SetRectEmpty UpdateLayeredWindow SetCursor TrackMouseEvent IsChild GetCursorPos IntersectRect GetCaretBlinkTime EqualRect CopyRect GetFocus SetCapture ReleaseCapture PtInRect DrawTextW SwitchToThisWindow SystemParametersInfoW OffsetRect SetClassLongW SetRect CharLowerBuffW CharLowerW MonitorFromRect GetSysColor IsClipboardFormatAvailable OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetClipboardData GetWindowThreadProcessId MapVirtualKeyW GetKeyNameTextW DrawIcon DrawIconEx GetIconInfo MonitorFromPoint GetAncestor SubtractRect RegisterClipboardFormatW HideCaret GetAsyncKeyState GetForegroundWindow IsIconic SetWindowPos GetWindowRect PostQuitMessage BeginPaint SetFocus CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW IsWindowVisible SetForegroundWindow BringWindowToTop FindWindowW DestroyWindow MessageBoxW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW KillTimer SendMessageW GetSystemMetrics LoadImageW SetWindowTextW SetTimer GetKeyState PostMessageW EnableWindow GetWindow MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints CallWindowProcW GetWindowLongW SetWindowLongW ShowWindow UnregisterClassW GetParent ReleaseDC GetDC IsWindow DefWindowProcW EndPaint FillRect WindowFromPoint

gdi32

IntersectClipRect SetBkColor ExtTextOutW SelectClipRgn SetROP2 MoveToEx LineTo RectVisible SaveDC RestoreDC GetDeviceCaps GetTextExtentPoint32W CreateRoundRectRgn CombineRgn GetClipBox BitBlt StretchBlt CreateFontW GetObjectA SetTextColor CreateCompatibleBitmap ExcludeClipRect GetTextMetricsW CreatePen CreateSolidBrush Rectangle RoundRect GetStockObject CreateDCW GetDIBits GetBitmapBits SetBitmapBits GetCurrentObject SetStretchBltMode DeleteDC GetObjectW CreateFontIndirectW SetViewportOrgEx CreateCompatibleDC SelectObject CreateRectRgn DeleteObject CreateDIBSection SetBkMode

advapi32

RegQueryValueExA RegQueryValueExW RegEnumValueW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

CommandLineToArgvW ShellExecuteExW SHGetSpecialFolderPathW SHChangeNotify SHGetFolderPathW ShellExecuteW

ole32

CoTaskMemRealloc CoTaskMemFree CoInitialize CoUninitialize CoTaskMemAlloc CoCreateInstance

oleaut32

VarUI4FromStr

shlwapi

SHDeleteValueW SHDeleteKeyW PathUnquoteSpacesW PathRemoveArgsW PathGetArgsW PathAppendW PathMatchSpecW PathFindFileNameW SHGetValueW PathIsDirectoryW PathFileExistsW PathRemoveFileSpecW PathAddBackslashW

comctl32

InitCommonControlsEx

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoW HttpSendRequestW HttpAddRequestHeadersW InternetOpenW HttpOpenRequestW DeleteUrlCacheEntryW InternetConnectW InternetSetOptionW InternetCrackUrlW

Name

.text

Size

607KB

Virtual Size

607KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

56KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

109KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=3, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=2, id=199, version=41118,

count=31, id=223, productName=VS2013 build 21005, version=21005,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=235, id=224, productName=VS2013 build 21005, version=21005,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=85, id=225, productName=VS2013 build 21005, version=21005,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=529, id=1, productName=Unmarked objects,

count=130, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,