2026-08-08_073ddbe66a7dae21ee8b15f0a565d535_bkransomware_darkgate_elex_glassworm_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_073ddbe66a7dae21ee8b15f0a565d535_bkransomware_darkgate_elex_glassworm_maze
Size 1.7MB
Sample260808-ww87dseh52
SHA256 d3b40bbaf5ad8976109a400b2a780308c97577a0a795e6a3a696d6911a37c641
MD5 073ddbe66a7dae21ee8b15f0a565d535
SHA1 6e2e36440456b373a884b6359eb9513dc7c853d0
SHA512 612f7cdf8084a21e5faa8e95814751d3094916d46ad157a9dd4d9a4b9f00d5ea611b26ae019d8e2b4fcbe9d33c9b9008fd38e5afc9bd9efa7e9e509ec2119400
SSDEEP 24576:aaSrV1+rr3XgPrOw0BeFw45UyycZO5z31GrvuihbVPaOtVVAc5T7nVC9Q6nenzO7:NSB7OwK5NtMaOzR5XVC9reCHb
TLSH
T1EC85F1227790C07AD6720130996DB6B555BEBE318F264AD7B3C57B0D1A306E0BE39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_073ddbe66a7dae21ee8b15f0a565d535_bkransomware_darkgate_elex_glassworm_maze

File Explorer

2026-08-08_073ddbe66a7dae21ee8b15f0a565d535_bkransomware_darkgate_elex_glassworm_maze

.exe 1.7MB

2026-08-08_073ddbe66a7dae21ee8b15f0a565d535_bkransomware_darkgate_elex_glassworm_maze

IMPHASH a67d0bf67d52385fcee74cd599ac992b
SHA256 d3b40bbaf5ad8976109a400b2a780308c97577a0a795e6a3a696d6911a37c641
MD5 073ddbe66a7dae21ee8b15f0a565d535
SHA1 6e2e36440456b373a884b6359eb9513dc7c853d0
SHA512 612f7cdf8084a21e5faa8e95814751d3094916d46ad157a9dd4d9a4b9f00d5ea611b26ae019d8e2b4fcbe9d33c9b9008fd38e5afc9bd9efa7e9e509ec2119400
SSDEEP 24576:aaSrV1+rr3XgPrOw0BeFw45UyycZO5z31GrvuihbVPaOtVVAc5T7nVC9Q6nenzO7:NSB7OwK5NtMaOzR5XVC9reCHb
TLSH
T1EC85F1227790C07AD6720130996DB6B555BEBE318F264AD7B3C57B0D1A306E0BE39723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

238965

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\project_sign_file\360Game\src\setup\installer\bin\Release\ExtGame.pdb

kernel32

InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WideCharToMultiByte MultiByteToWideChar DuplicateHandle GetCurrentProcess GetFileType SetFilePointer ReadFile SystemTimeToFileTime GetCurrentDirectoryW DosDateTimeToFileTime CreateDirectoryW WriteFile SetFileTime GetFileSize GetFileAttributesW SetEndOfFile SetFileAttributesW DeleteFileW MoveFileW MoveFileExW RemoveDirectoryW FindFirstFileW FindNextFileW FindClose WritePrivateProfileStringW GetTickCount GetPrivateProfileStringW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetCommandLineW GetVersionExW VirtualQuery GetCurrentThreadId WritePrivateProfileStructW CopyFileW TerminateProcess SetUnhandledExceptionFilter GetSystemDirectoryW GetTempPathW GetPrivateProfileIntW GetTempFileNameW VirtualAlloc VirtualFree CreateMutexW CreateEventW SetEvent WaitForSingleObject Sleep IsBadReadPtr IsBadWritePtr TlsSetValue WaitForMultipleObjects CancelWaitableTimer ResetEvent LocalFree SetWaitableTimer GetDiskFreeSpaceExW TlsAlloc TlsFree GetLongPathNameW SetLastError OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeCriticalSectionAndSpinCount RaiseException lstrcmpiW InterlockedDecrement InterlockedIncrement LoadLibraryW FlushInstructionCache ExitProcess LocalAlloc SetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetModuleFileNameW GetCurrentProcessId CloseHandle CreateFileW LoadLibraryExA SetThreadContext GetThreadContext ResumeThread SuspendThread lstrlenA ReleaseMutex HeapWalk HeapLock HeapUnlock CreateWaitableTimerW GetLastError FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FreeLibrary LoadLibraryExW GetCurrentThread GetProcAddress GetModuleHandleW GetCPInfo CreateSemaphoreW GetStartupInfoW TlsGetValue UnhandledExceptionFilter RtlUnwind SetEnvironmentVariableA WriteConsoleW FlushFileBuffers UnregisterWaitEx QueryDepthSList InterlockedFlushSList ExitThread CreateThread ReadProcessMemory VerSetConditionMask VerifyVersionInfoW EncodePointer GetSystemTimeAsFileTime GetStringTypeW GetExitCodeThread IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetThreadPriority CreateProcessW GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait DecodePointer GetWindowsDirectoryW ReleaseSemaphore VirtualProtect GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTimeZoneInformation SetStdHandle GetConsoleCP ReadConsoleW GetConsoleMode GetStdHandle SetFilePointerEx AreFileApisANSI GetModuleHandleExW GetOEMCP GetACP IsValidCodePage GetLogicalProcessorInformation

user32

FindWindowW ShowWindow PostMessageW DefWindowProcW UnregisterClassW CharNextW DispatchMessageW TranslateMessage GetMessageW PeekMessageW DestroyWindow SendMessageTimeoutW SetTimer SetWindowLongW GetWindowLongW CallWindowProcW PostQuitMessage KillTimer IsWindow RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW

advapi32

RegEnumKeyExW RegCreateKeyExW RegSetValueExW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteW ShellExecuteExW

ole32

CoInitializeSecurity CoInitializeEx CoUninitialize CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoSetProxyBlanket CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString SysFreeString VarUI4FromStr VariantInit VariantClear

shlwapi

PathGetDriveNumberW StrStrIW SHSetValueW PathAddBackslashW PathMatchSpecW PathRemoveFileSpecW PathFileExistsW PathIsDirectoryW PathFindFileNameA PathCombineW PathFindFileNameW StrCmpIW PathAppendW SHGetValueW StrStrIA PathIsRootW SHDeleteKeyW

comctl32

InitCommonControlsEx

wininet

InternetSetStatusCallbackW FtpGetFileSize HttpSendRequestW HttpAddRequestHeadersW DeleteUrlCacheEntryW InternetCrackUrlW InternetQueryOptionW InternetSetOptionW InternetGetLastResponseInfoW FtpCommandW InternetWriteFile HttpEndRequestW FtpOpenFileW InternetReadFileExA InternetReadFile HttpQueryInfoW InternetCloseHandle InternetOpenW InternetConnectW InternetSetOptionA HttpOpenRequestW HttpSendRequestExW

Name

.text

Size

452KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

81KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1012KB

Virtual Size

1011KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

95KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=3, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=95, version=2179,

count=3, id=199, version=41118,

count=40, id=223, productName=VS2013 build 21005, version=21005,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=250, id=224, productName=VS2013 build 21005, version=21005,

count=8, id=225, version=20806,

count=146, id=225, productName=VS2013 build 21005, version=21005,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=370, id=1, productName=Unmarked objects,

count=72, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,