2026-08-10_ac3263f171b6f9b68143e996b56263af_darkgate_elex_glassworm_hawkeye_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_ac3263f171b6f9b68143e996b56263af_darkgate_elex_glassworm_hawkeye_maze
Size 434KB
Sample260810-lr98sawcnd
SHA256 31162503b59deca72b51bf287e05bf4d68f2519b55efbe0a1097666b38af5455
MD5 ac3263f171b6f9b68143e996b56263af
SHA1 124033eaa4c6bdfa971c1825ecda54ca646301f3
SHA512 eb865fe3cd79aed1b99fa68b2e74570fb018aadbffd89c8f255f63491f0364d7d52a41dce1b1d9eba68b4e2519b909b52485c342bdf514ac69c41180a10a8712
SSDEEP 12288:2SSxHR4KV85jTw0BGfHVQfKq5C0S4bfHVQfKq5C0S4L2:ot85vRGfH0fHc
TLSH
T189946E003BD1D839F5A30877EDF68569563DBC520B6214D7A3887B6F8930AE27E39712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-10_ac3263f171b6f9b68143e996b56263af_darkgate_elex_glassworm_hawkeye_maze

.exe 434KB

2026-08-10_ac3263f171b6f9b68143e996b56263af_darkgate_elex_glassworm_hawkeye_maze

IMPHASH 137b32ad9bbe6bb6e8a4704d3bfc7230
SHA256 31162503b59deca72b51bf287e05bf4d68f2519b55efbe0a1097666b38af5455
MD5 ac3263f171b6f9b68143e996b56263af
SHA1 124033eaa4c6bdfa971c1825ecda54ca646301f3
SHA512 eb865fe3cd79aed1b99fa68b2e74570fb018aadbffd89c8f255f63491f0364d7d52a41dce1b1d9eba68b4e2519b909b52485c342bdf514ac69c41180a10a8712
SSDEEP 12288:2SSxHR4KV85jTw0BGfHVQfKq5C0S4bfHVQfKq5C0S4L2:ot85vRGfH0fHc
TLSH
T189946E003BD1D839F5A30877EDF68569563DBC520B6214D7A3887B6F8930AE27E39712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

f6:97:6c:0b:be:7a:65:4d:2f:6e:f8:bc:fc:9a:63:6b:b3:f8:b2:6e:92:66:f6:1a:94:79:bf:30:87:a2:af:98

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Chains

Jul 29, 2026

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

82:e9:94:7f:7b:8d:4c:d3:5e:9c:97:1e:03:ac:25:63:22:41:f0:c9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Chains

Jul 29, 2026

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Serial Number

09:74:28:8f:ad:05:a2:88:a7:ca:76:c2:04:46:69:6f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Dec 18, 2026

Minor OS version

Major OS version

Entry point

82451

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\build_9.0\trunk_cn_9_no\simulator\bin\ldtool.pdb

kernel32

EnterCriticalSection LeaveCriticalSection GetCurrentThreadId DeleteFileW FindClose RemoveDirectoryW GetTempPathW GetProcAddress MultiByteToWideChar WideCharToMultiByte WaitForSingleObject GetStdHandle TerminateProcess GetModuleHandleW GetStartupInfoW SetEvent GetLocalTime QueryPerformanceCounter OutputDebugStringW GetProcessHeap HeapAlloc HeapFree DeleteCriticalSection EncodePointer DecodePointer GetCommandLineW RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent ExitProcess GetModuleHandleExW HeapSize GetCurrentThread GetFileType GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree IsValidCodePage GetACP GetOEMCP GetCPInfo GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers LoadLibraryExW HeapReAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW SetStdHandle WriteConsoleW GetExitCodeThread DuplicateHandle InitializeCriticalSection GetThreadTimes InitializeSListHead FindNextFileW FindFirstFileW MoveFileExW GetVersionExW GetCurrentProcess GetLastError CreateProcessW CloseHandle WriteFile CreateFileW GetModuleFileNameW SetLastError Sleep

user32

LoadStringW KillTimer SetWindowLongW CreateWindowExW DestroyWindow DefWindowProcW ExitWindowsEx

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

shlwapi

PathFileExistsW

shell32

ShellExecuteW SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_ac3263f171b6f9b68143e996b56263af_darkgate_elex_glassworm_hawkeye_maze

kernel32

user32

advapi32

shlwapi

shell32

generic