2026-08-09_c9ccbca9ad9989532a243d76ca1428fc_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_c9ccbca9ad9989532a243d76ca1428fc_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos
Size 4.2MB
Sample260809-tez62styds
SHA256 db6f2937ac921fa09ef973f2d9a17ad9dfe4a813447d52001f9dd485c19451bd
MD5 c9ccbca9ad9989532a243d76ca1428fc
SHA1 87d268bdba24409e411ebb07f3df900163369d3d
SHA512 3ef618062e2e1cd1ec552974661cee66b7e53d32fd2847b463a04e248864edeaa23d9d42019ada15d54e766aedd6047ffb7ba2fb7dcfe163528ba3d8368bddb4
SSDEEP 49152:QVCTPTFn3DOLNYXWhAe/xqJzR3KOM3GIl+X1v28O9+WthvuoT03yxKqidJlOqF6F:QVCl3DmN/q1dzM3GQ+MzanD527BWG
TLSH
T18226BF21B9478032E5E2037D817EAB7A656A6E53033450CBC2D47E492E70BD276F762F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_c9ccbca9ad9989532a243d76ca1428fc_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-08-09_c9ccbca9ad9989532a243d76ca1428fc_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

.exe 4.2MB

2026-08-09_c9ccbca9ad9989532a243d76ca1428fc_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

IMPHASH 98a8634ced95e86b973104dc3e38b5c9
SHA256 db6f2937ac921fa09ef973f2d9a17ad9dfe4a813447d52001f9dd485c19451bd
MD5 c9ccbca9ad9989532a243d76ca1428fc
SHA1 87d268bdba24409e411ebb07f3df900163369d3d
SHA512 3ef618062e2e1cd1ec552974661cee66b7e53d32fd2847b463a04e248864edeaa23d9d42019ada15d54e766aedd6047ffb7ba2fb7dcfe163528ba3d8368bddb4
SSDEEP 49152:QVCTPTFn3DOLNYXWhAe/xqJzR3KOM3GIl+X1v28O9+WthvuoT03yxKqidJlOqF6F:QVCl3DmN/q1dzM3GQ+MzanD527BWG
TLSH
T18226BF21B9478032E5E2037D817EAB7A656A6E53033450CBC2D47E492E70BD276F762F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1637344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\docker\Documents\workspace\build-v2\common\hrappstore2\bin\HrAppStoreTray.pdb

kernel32

CreateToolhelp32Snapshot GetProcessTimes GetPrivateProfileStringA OpenMutexW GetPrivateProfileIntA SystemTimeToFileTime GetLocalTime FileTimeToLocalFileTime WritePrivateProfileStringA GetTickCount64 InitializeCriticalSection VirtualFreeEx ReadProcessMemory VirtualAllocEx OpenProcess TerminateProcess GetCurrentProcess LoadLibraryW CloseHandle Sleep WaitForSingleObject CreateMutexW WideCharToMultiByte GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW RaiseException HeapReAlloc LockResource WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindFirstFileExW GetOEMCP IsValidCodePage SetStdHandle GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadConsoleW GetConsoleMode SetFilePointerEx GetTimeZoneInformation GetFileType ExitThread GetModuleHandleExW RtlUnwind ProcessIdToSessionId QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority CreateThread SwitchToThread SignalObjectAndWait CreateTimerQueue GetCurrentDirectoryA SetCurrentDirectoryA InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetStringTypeW GetCurrentThread DuplicateHandle IsDebuggerPresent Process32NextW Process32FirstW WTSGetActiveConsoleSessionId FreeLibrary GetTickCount IsProcessorFeaturePresent GetSystemFirmwareTable QueryPerformanceCounter MapViewOfFile CreateFileMappingW UnregisterWaitEx GetOverlappedResult GetLastError MultiByteToWideChar HeapSize FormatMessageA LockFileEx CreateFileMappingA UnlockFile HeapCompact DeleteFileA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW InitializeCriticalSectionEx HeapCreate TryEnterCriticalSection AreFileApisANSI FlushFileBuffers LeaveCriticalSection EnterCriticalSection HeapFree SizeofResource SetCurrentDirectoryW GetCurrentDirectoryW CreateFileW GetFileSize ReadFile GetModuleFileNameW GlobalLock GlobalUnlock lstrcmpW lstrlenW GetCurrentProcessId MulDiv VerifyVersionInfoW GetACP ExitProcess FreeResource CreateDirectoryW GetFileAttributesW LocalFileTimeToFileTime SetFilePointer SetFileTime WriteFile LocalFree FormatMessageW InitializeCriticalSectionAndSpinCount GlobalAlloc lstrcpynW lstrcmpiW lstrcpyW CreateEventW SetEvent GetFileSizeEx SetConsoleTextAttribute GetStdHandle GetPrivateProfileIntW GetTempPathW GetCurrentThreadId ReleaseMutex OutputDebugStringW DeleteFileW MoveFileW GetStartupInfoW VirtualFree VirtualAlloc GetProcessId GetVersionExW GlobalFree GetNativeSystemInfo GetSystemInfo GetSystemTimeAsFileTime VirtualQuery GetExitCodeProcess SetLastError SetThreadPriority ResumeThread DeviceIoControl FindFirstFileW FindNextFileW RemoveDirectoryW FindClose MoveFileExW CreateDirectoryA GlobalMemoryStatusEx GetPrivateProfileStringW GetSystemTime LoadLibraryExW GetFileAttributesExW GetFullPathNameW CreateFileA ResetEvent GetFileInformationByHandleEx

user32

PtInRect PostMessageW EndPaint BeginPaint GetCursorPos RegisterWindowMessageW SetWindowLongW LoadCursorW LoadIconW TranslateMessage TranslateAcceleratorW DispatchMessageW ShowWindow LoadAcceleratorsW RegisterClassExW CreateWindowExW GetMonitorInfoW GetMessageW GetWindowLongW FindWindowExW GetWindowRect SetWindowPos OffsetRect SetTimer MoveWindow IntersectRect KillTimer PostQuitMessage UpdateWindow SetForegroundWindow SendMessageW IsWindow FindWindowW SetProcessDPIAware DefWindowProcW MonitorFromWindow GetWindowThreadProcessId BringWindowToTop SetActiveWindow AttachThreadInput GetForegroundWindow EnumWindows GetDesktopWindow MapVirtualKeyExW GetKeyNameTextW GetKeyboardLayout GetGUIThreadInfo DestroyWindow IsWindowVisible IsIconic IsZoomed CharNextW SetFocus GetActiveWindow GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC GetUpdateRect InvalidateRect GetClientRect ScreenToClient MapWindowPoints GetSysColor UnionRect IsRectEmpty GetParent GetWindow LoadImageW MonitorFromPoint SetCursor InflateRect wsprintfW CallWindowProcW RegisterClassW GetClassInfoExW EnableWindow SetPropW GetPropW SetWindowRgn UpdateLayeredWindow CharPrevW DrawTextW FillRect SetRect DestroyIcon DrawIconEx GetIconInfo CreatePopupMenu DestroyMenu EnableMenuItem AppendMenuW TrackPopupMenu CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen EqualRect SetWindowTextW GetWindowTextW GetWindowTextLengthW IsWindowEnabled wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn

gdi32

LineTo GetDIBits GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect CreatePenIndirect CreateDCW CombineRgn CreateDIBSection CreateRoundRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW PlayEnhMetaFile GetEnhMetaFileHeader SelectClipRgn CloseEnhMetaFile SetBkMode RestoreDC Rectangle RemoveFontMemResourceEx AddFontMemResourceEx GetStockObject GetDeviceCaps EnumFontFamiliesExW DeleteObject CreatePen CreateFontIndirectW CreateDIBitmap CreateCompatibleDC CreateCompatibleBitmap BitBlt ExtSelectClipRgn CreateEnhMetaFileW SetBkColor SelectObject GetTextExtentPoint32W SetBitmapBits DeleteDC StretchBlt SetStretchBltMode SetTextColor GetObjectA MoveToEx SaveDC TextOutW GetBitmapBits GetTextExtentPointA CreatePatternBrush GdiFlush

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl OpenServiceW RegOpenKeyExA StartServiceW ControlService OpenSCManagerW RegQueryValueExA CloseServiceHandle QueryServiceStatus RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegFlushKey

shell32

SHFileOperationW SHGetSpecialFolderPathW SHCreateDirectoryExW DragQueryFileW SHGetSpecialFolderPathA Shell_NotifyIconW Shell_NotifyIconGetRect ShellExecuteExW

ole32

CLSIDFromString CLSIDFromProgID OleLockRunning CoInitialize CoSetProxyBlanket CreateStreamOnHGlobal ReleaseStgMedium CoCreateInstance OleDuplicateData CoUninitialize DoDragDrop CoInitializeSecurity CoInitializeEx RegisterDragDrop

oleaut32

VariantClear SysAllocString SysFreeString VariantChangeType VariantInit

ws2_32

gethostname WSAStartup gethostbyname

libcrypto-3

RC4_set_key SHA256_Update SHA256_Final SHA256_Init RC4 AES_set_decrypt_key AES_cbc_encrypt

libcurl

curl_slist_free_all curl_easy_perform curl_easy_cleanup curl_slist_append curl_easy_setopt curl_easy_init

shlwapi

PathFindFileNameW PathIsDirectoryW PathRemoveFileSpecW PathAppendW PathIsDirectoryA PathFileExistsW

gdiplus

GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipStringFormatGetGenericTypographic GdipGetPropertyItemSize GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipMeasureString GdiplusStartup GdipImageSelectActiveFrame GdipAlloc GdipSetPenMode GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromScan0 GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawImageRectI GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipCreatePath GdipDeletePath GdipAddPathLine GdipCreateHBITMAPFromBitmap GdipGetPropertyItem GdipCreateTexture GdipAddPathArc GdiplusShutdown GdipBitmapUnlockBits GdipSetTextureTransform GdipLoadImageFromFile GdipGetImageThumbnail GdipFillEllipseI GdipTranslateWorldTransform GdipRotateWorldTransform GdipBitmapLockBits GdipCreateMatrix

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

wininet

InternetCloseHandle InternetConnectW InternetSetOptionW HttpAddRequestHeadersW HttpSendRequestExW InternetQueryDataAvailable InternetQueryOptionW HttpSendRequestW InternetGetConnectedStateExW InternetReadFile InternetAttemptConnect HttpEndRequestW HttpQueryInfoW InternetOpenW InternetWriteFile HttpOpenRequestW

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmDisableIME

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoExW GetFileVersionInfoSizeExW

dxgi

CreateDXGIFactory1

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

pdh

PdhOpenQueryW PdhAddCounterW PdhCollectQueryData PdhGetFormattedCounterValue

ntdll

VerSetConditionMask

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

943KB

Virtual Size

942KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

471KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

716KB

Virtual Size

720KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=38, id=241, version=40116,

count=196, id=243, version=40116,

count=38, id=242, version=40116,

count=3, id=199, version=41118,

count=27, id=259, version=24123,

count=129, id=261, version=24123,

count=39, id=260, version=24123,

count=2, id=261, version=23013,

count=4, id=257, version=30145,

count=113, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=54, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=209, version=65501,

count=17, id=206, version=65501,

count=4, id=208, version=65501,

count=55, id=203, version=65501,

count=795, id=1, productName=Unmarked objects,

count=129, id=265, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,