General
- Target 2026-08-13_144efa9b90ce9bfdbb885c20ba19dcbc_darkgate_elex_glassworm_maze_remcos
- Size 2.9MB
- Sample260813-2z1bjszgnb
- SHA256 e575c9134b49bd0e0111fec5ef311ad5c1db41cf367a4be26853d94155bdf098
- MD5 144efa9b90ce9bfdbb885c20ba19dcbc
- SHA1 d6b0cb43ef8100097145ce48137d174440fee30a
- SHA512 0d81efd1f2d8b6278daf69f7879f7be8dd58c35e041db02dc7ac5c8a08875e7d8302cd6922e08c7ae8139d1648bcfd5dc3f1fc2f76070688559919a4cfa14adf
- SSDEEP 49152:EFwWwzOx2YlkXEYTy0iTvTEaaKCTZQjX6Y0fxfNrBVgi6hY5PrA4r3:MPwzOPD0cEaBXb0fxfNruOPrA4r3
- TLSH T17CE5D012BBC2C0B3E6A202704C7667255DBABD70573085DBA3D47E1D1E32AD2AD39367
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_144efa9b90ce9bfdbb885c20ba19dcbc_darkgate_elex_glassworm_maze_remcos.exe
Resource
win10v2004-20260513-en
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_144efa9b90ce9bfdbb885c20ba19dcbc_darkgate_elex_glassworm_maze_remcos.exe
Resource
win11ltsc2024-20260709-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-13_144efa9b90ce9bfdbb885c20ba19dcbc_darkgate_elex_glassworm_maze_remcos
- Size 2.9MB
- SHA256 e575c9134b49bd0e0111fec5ef311ad5c1db41cf367a4be26853d94155bdf098
- MD5 144efa9b90ce9bfdbb885c20ba19dcbc
- SHA1 d6b0cb43ef8100097145ce48137d174440fee30a
- SHA512 0d81efd1f2d8b6278daf69f7879f7be8dd58c35e041db02dc7ac5c8a08875e7d8302cd6922e08c7ae8139d1648bcfd5dc3f1fc2f76070688559919a4cfa14adf
- SSDEEP 49152:EFwWwzOx2YlkXEYTy0iTvTEaaKCTZQjX6Y0fxfNrBVgi6hY5PrA4r3:MPwzOPD0cEaBXb0fxfNruOPrA4r3
- TLSH T17CE5D012BBC2C0B3E6A202704C7667255DBABD70573085DBA3D47E1D1E32AD2AD39367
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1