General
- Target 2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop
- Size 3.6MB
- Sample260814-pbnavsseqg
- SHA256 b0bc61d4fe5a61450012969d7f9795ed17b4bf705adfe05756b7d3b72f0648aa
- MD5 f03865e8495540993b8a2725212dad5a
- SHA1 ee9c8d1237f42ef0cdc53db97068f632f4adb6a4
- SHA512 77d7eb99bbba67634fb5c0eb959ea26a0fca93de964a3bd4396d0641333332f1d3a78ef2a5ca28ee08c5d271d438d9e765839f88c3a7c6b34fb2f3a64c8a7c88
- SSDEEP 49152:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97R1vJj7rQCcfo:Vg4midTSJ01vJjxx
- TLSH T196067D23BAC4543AC0AB163A847BA7589D3F7A612716CD8F57F0185C8E361807E3A75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop
- Size 3.6MB
- SHA256 b0bc61d4fe5a61450012969d7f9795ed17b4bf705adfe05756b7d3b72f0648aa
- MD5 f03865e8495540993b8a2725212dad5a
- SHA1 ee9c8d1237f42ef0cdc53db97068f632f4adb6a4
- SHA512 77d7eb99bbba67634fb5c0eb959ea26a0fca93de964a3bd4396d0641333332f1d3a78ef2a5ca28ee08c5d271d438d9e765839f88c3a7c6b34fb2f3a64c8a7c88
- SSDEEP 49152:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97R1vJj7rQCcfo:Vg4midTSJ01vJjxx
- TLSH T196067D23BAC4543AC0AB163A847BA7589D3F7A612716CD8F57F0185C8E361807E3A75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Modifies visibility of hidden/system files in Explorer
-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5