2026-08-17_cdea9d6301cc8dd6898f9e8383be72e9_chir_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-17_cdea9d6301cc8dd6898f9e8383be72e9_chir_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos
Size 550KB
Sample260817-mlrd6aywex
SHA256 4bc8900853f5514a6f77f76c02e66e6471adb293f177cc18d29c32e0817bf1f7
MD5 cdea9d6301cc8dd6898f9e8383be72e9
SHA1 14d0132e488e8b8384aae5c9de0d72c9ce78681e
SHA512 d535423f32423556a307c41783cc6c0af074125beabe645fa98e7206e1c7a4b58ef2681ce905dc77481bb6b445b6483c7a457f92ce18db9de72746061d6ffa5a
SSDEEP 12288:GWoOFdQfKYVRIIBgDcNr8yKvu+ksK8j0cqYFEmX84Ja5PubaWsWU:ZozKAIIBgDcNr8yKvu+ksK8jWmX9aRuH
TLSH
T1ECC4AD213AA1C133D96181B04DACE74A647FED700F6249DFB3D81A6E1E756C12B32A73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-17_cdea9d6301cc8dd6898f9e8383be72e9_chir_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-08-17_cdea9d6301cc8dd6898f9e8383be72e9_chir_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

.exe 550KB

2026-08-17_cdea9d6301cc8dd6898f9e8383be72e9_chir_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

IMPHASH d1e5a623ef70ddc632b94cc6e860f684
SHA256 4bc8900853f5514a6f77f76c02e66e6471adb293f177cc18d29c32e0817bf1f7
MD5 cdea9d6301cc8dd6898f9e8383be72e9
SHA1 14d0132e488e8b8384aae5c9de0d72c9ce78681e
SHA512 d535423f32423556a307c41783cc6c0af074125beabe645fa98e7206e1c7a4b58ef2681ce905dc77481bb6b445b6483c7a457f92ce18db9de72746061d6ffa5a
SSDEEP 12288:GWoOFdQfKYVRIIBgDcNr8yKvu+ksK8j0cqYFEmX84Ja5PubaWsWU:ZozKAIIBgDcNr8yKvu+ksK8jWmX9aRuH
TLSH
T1ECC4AD213AA1C133D96181B04DACE74A647FED700F6249DFB3D81A6E1E756C12B32A73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6b:cc:ff:29:bb:97:f5:46:13:c3:0c:05:f0:94:83:94:4d:ed:fc:f9:0d:8d:24:92:e9:8f:7a:b0:49:54:2d:3d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Chains

Dec 8, 2020

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

50:0a:28:9b:ea:bf:38:78:ae:0c:11:00:2e:81:d3:d8:ec:f8:23:1c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Chains

Dec 8, 2020

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Serial Number

6f:13:bc:d5:09:63:d2:f3:09:43:9e:37:fd:45:9c:7c

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 4, 2019 - Dec 16, 2022

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

Major OS version

Entry point

589528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

X:\jenkins-workspace\workspace\client-builder-remoteieframe\ut_win\Build\Win32\Release\RemoteIEFrame.pdb

urlmon

UrlMkSetSessionOption

kernel32

CloseHandle GetTickCount MultiByteToWideChar WideCharToMultiByte InterlockedDecrement InterlockedIncrement ReadFile GetModuleFileNameA VirtualAlloc CreateFileW GetCurrentProcessId SetUnhandledExceptionFilter GetSystemTimeAsFileTime DebugBreak CreateDirectoryW TerminateProcess WaitForSingleObject GetVersion CreateEventW Sleep SetEvent TerminateThread GlobalAlloc LoadLibraryW CreateThread LocalFree ExitProcess VerSetConditionMask GetModuleHandleW GetLocaleInfoW WriteFile CreateNamedPipeW DisconnectNamedPipe GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetLastError GetCommandLineW WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetTimeZoneInformation GetProcessHeap SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP GetFileType GetACP GetStdHandle GetModuleHandleA GetCurrentThreadId GetDriveTypeW GetModuleFileNameW GetProcAddress LoadLibraryA GetCurrentProcess GetVolumeInformationA GetLastError HeapSize VerifyVersionInfoW GetModuleHandleExW HeapFree HeapReAlloc HeapAlloc LoadLibraryExW FreeLibrary RtlUnwind RaiseException InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetCPInfo LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection GetStringTypeW EnterCriticalSection

user32

FindWindowW SetWindowLongW GetClientRect PostQuitMessage GetParent InvalidateRect GetCursorPos BeginPaint EndPaint PtInRect GetWindowLongW GetMessageW DefWindowProcW GetKeyState PostMessageW GetWindowRect LoadCursorA DestroyWindow SetWindowPos CreateWindowExW RegisterClassExW ShowWindow DispatchMessageW TrackMouseEvent GetForegroundWindow MoveWindow TranslateMessage

shell32

CommandLineToArgvW DragFinish SHGetSpecialFolderPathW DragQueryFileW

ole32

ReleaseStgMedium OleUninitialize OleSetContainedObject CoTaskMemAlloc OleCreate CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal OleInitialize StgCreateStorageEx

oleaut32

SysAllocString SysFreeString VariantClear VariantInit SysStringLen DispGetParam

shlwapi

PathFindFileNameW PathFileExistsW PathRemoveFileSpecW PathCombineW

Name

.text

Size

391KB

Virtual Size

390KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-17_cdea9d6301cc8dd6898f9e8383be72e9_chir_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

PE Signature issue

PE Signature issue

urlmon

kernel32

user32

shell32

ole32

oleaut32

shlwapi

generic