2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_mespinoza_njrat_remcos
Size 5.6MB
Sample260820-nb8fcsyvhs
SHA256 68aede89d8a1716cd659c44044a72e85cc9c492aadc6ce49085d760abdfda7ba
MD5 de921f61913c7a7c00dd0fb3b19a9c0d
SHA1 0558d23260bbd74dfe25152073a8e6c76e473a7b
SHA512 0fd354396296c79fdf8b2fb79dc9c995b7919ed95a15a39974c1af582834e7f489ccd0c8adc37d562fa27a42b9de1a9234895731c5380da92e68ccf4b5e030ac
SSDEEP 49152:5kCv9MKZQttyVQBG5PVOvx+iig9w4qQv6zJ/TeJH0a0BihL67Sy5BpNTVb6SEiJN:reXttyVhPVMn0aHE6HLjY
TLSH
T18C46E642A2E944A4F1F32B75AE3619714A77BD115F38C88FA58CAC1D0BF3681D530B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_mespinoza_njrat_remcos

.exe 5.6MB

2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalocker_mespinoza_njrat_remcos

IMPHASH c5369c6ae34712211af36885bcd0c09b
SHA256 68aede89d8a1716cd659c44044a72e85cc9c492aadc6ce49085d760abdfda7ba
MD5 de921f61913c7a7c00dd0fb3b19a9c0d
SHA1 0558d23260bbd74dfe25152073a8e6c76e473a7b
SHA512 0fd354396296c79fdf8b2fb79dc9c995b7919ed95a15a39974c1af582834e7f489ccd0c8adc37d562fa27a42b9de1a9234895731c5380da92e68ccf4b5e030ac
SSDEEP 49152:5kCv9MKZQttyVQBG5PVOvx+iig9w4qQv6zJ/TeJH0a0BihL67Sy5BpNTVb6SEiJN:reXttyVhPVMn0aHE6HLjY
TLSH
T18C46E642A2E944A4F1F32B75AE3619714A77BD115F38C88FA58CAC1D0BF3681D530B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1670161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Set-up.pdb

setupapi

CM_Get_DevNode_Status SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW

comctl32

InitCommonControlsEx

shell32

SHGetKnownFolderPath ShellExecuteW SHGetSpecialFolderPathW ord51 CommandLineToArgvW ShellExecuteExW SHCreateDirectoryExW SHGetFolderPathW SHGetPathFromIDListW SHGetFolderLocation SHGetSpecialFolderLocation SHBrowseForFolderW SHGetMalloc ord680

shlwapi

PathIsFileSpecW PathAddExtensionW PathRenameExtensionW PathRemoveBackslashW PathRemoveExtensionW UrlIsW SHGetValueW PathIsSystemFolderW PathAppendW PathFileExistsW PathFileExistsA PathIsDirectoryW PathRemoveFileSpecW PathStripToRootW PathIsNetworkPathW PathFindFileNameW PathIsRootW PathIsRelativeW PathStripPathW PathIsUNCW

kernel32

WideCharToMultiByte GetCurrentProcess GetTempPathW CreateFileW GetVersionExW GetComputerNameExW FileTimeToSystemTime CloseHandle RaiseException LoadLibraryW GetProcAddress LocalFree CreateProcessW GetModuleHandleW FreeLibrary FindFirstFileW FindNextFileW TerminateProcess RemoveDirectoryW GetModuleFileNameW FindClose WaitForSingleObject OpenProcess SetFileAttributesW CreateToolhelp32Snapshot Sleep GetLastError Process32NextW DeleteFileW Process32FirstW CopyFileW GetExitCodeProcess ReadFile SetLastError lstrlenW LocalAlloc GetFileAttributesW FormatMessageW GetDiskFreeSpaceExW GetCurrentDirectoryW SetCurrentDirectoryW MoveFileExW GetFileSize lstrcpyW lstrcmpiW lstrcmpW GetDriveTypeW InitializeCriticalSectionEx DecodePointer DeleteCriticalSection GetFullPathNameW HeapSize HeapReAlloc HeapDestroy EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GlobalAlloc GlobalLock GlobalUnlock MulDiv GetSystemDirectoryW SetDllDirectoryW GetStdHandle AttachConsole FreeConsole GetConsoleWindow CreateMutexW ReleaseMutex InitializeCriticalSectionAndSpinCount AreFileApisANSI TryEnterCriticalSection HeapCreate WriteFile InterlockedCompareExchange GetDiskFreeSpaceW OutputDebugStringA LockFile InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA HeapAlloc GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA GetSystemInfo HeapCompact UnlockFile CreateFileMappingA LockFileEx GetCurrentProcessId SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource LockResource LoadResource FindResourceW MultiByteToWideChar GlobalFree VerSetConditionMask VerifyVersionInfoW GetUserDefaultLCID LCMapStringW DuplicateHandle ProcessIdToSessionId SetEvent TerminateThread CreateThread FindResourceExW ResetEvent GetThreadTimes QueryFullProcessImageNameW WaitForMultipleObjects GetFileSizeEx GetUserDefaultLangID GetUserDefaultUILanguage SetNamedPipeHandleState CreateNamedPipeW ConnectNamedPipe CreateDirectoryW SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetFileTime ReleaseSemaphore OpenSemaphoreW CreateSemaphoreW GetLocalTime GetTimeFormatW GetDateFormatW OpenMutexW GetTimeZoneInformation CreateSymbolicLinkW QueryPerformanceFrequency GetCurrentThread SetFilePointerEx ResumeThread SwitchToThread SignalObjectAndWait CreateTimerQueue VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW CompareStringW GetCPInfo HeapFree TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW EncodePointer LoadLibraryExA VirtualQuery VirtualProtect SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind GetFileType SetStdHandle ExitThread GetModuleHandleExW ExitProcess GetACP IsValidLocale EnumSystemLocalesW GetConsoleMode ReadConsoleW GetConsoleCP FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW CreateEventW SetEnvironmentVariableA WriteConsoleW GetProcessHeap GetDiskFreeSpaceA

user32

IsWindow InvalidateRgn DispatchMessageW RedrawWindow ClientToScreen DestroyAcceleratorTable IsChild AttachThreadInput ShowWindow RegisterClassExW SetWindowTextW ScreenToClient CreateWindowExW FillRect DestroyWindow GetFocus GetWindow GetSysColor GetActiveWindow PostMessageW CallWindowProcW GetForegroundWindow MoveWindow CreateAcceleratorTableW SetFocus CharNextW DefWindowProcW GetMessageW GetClassInfoExW GetWindowTextLengthW GetWindowThreadProcessId BringWindowToTop TranslateAcceleratorW TranslateMessage LoadCursorW GetClassNameW SetCapture SetWindowLongW GetClientRect GetDlgItem PostQuitMessage GetParent RegisterWindowMessageW ReleaseCapture SetForegroundWindow InvalidateRect IsIconic BeginPaint EndPaint GetWindowTextW GetWindowRect GetDC SetWindowPos MessageBoxW SendMessageW GetDesktopWindow ReleaseDC UnregisterClassW GetWindowLongW wsprintfW PostThreadMessageW EnumWindows GetShellWindow AllowSetForegroundWindow LoadImageW SystemParametersInfoW EnableMenuItem LoadIconW GetSystemMetrics GetSystemMenu GetClassLongW AppendMenuW GetAsyncKeyState SetClassLongW

gdi32

BitBlt CreateSolidBrush DeleteObject DeleteDC GetStockObject CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject GetObjectW

advapi32

SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW GetTokenInformation CreateWellKnownSid LookupPrivilegeValueW RegCloseKey AdjustTokenPrivileges SystemFunction036 RegCreateKeyExW RegFlushKey LookupAccountSidW RegSetValueExW RegOpenKeyExW EqualSid InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid SetSecurityDescriptorDacl DuplicateTokenEx ConvertSidToStringSidW ImpersonateLoggedOnUser ConvertStringSidToSidW RevertToSelf CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueExW GetUserNameW OpenProcessToken

ole32

CoAddRefServerProcess OleRun CoReleaseServerProcess CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoInitialize OleLockRunning CLSIDFromString OleInitialize CreateStreamOnHGlobal CLSIDFromProgID CoTaskMemAlloc OleUninitialize CoGetClassObject CoCreateInstance StringFromGUID2 CoTaskMemFree CoCreateGuid CoInitializeEx

oleaut32

VariantClear SysAllocStringLen SysStringLen SysAllocString OleCreateFontIndirect LoadTypeLi VariantInit LoadRegTypeLi VariantChangeType SysAllocStringByteLen VariantCopy SysStringByteLen DispCallFunc GetErrorInfo SysFreeString

crypt32

CertGetIssuerCertificateFromStore CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WinVerifyTrust WTHelperProvDataFromStateData

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

672KB

Virtual Size

676KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=21, id=241, version=40116,

count=200, id=243, version=40116,

count=32, id=242, version=40116,

count=4, id=261, version=23013,

count=1, id=199, version=41118,

count=25, id=259, version=23907,

count=39, id=260, version=23907,

count=136, id=261, version=23907,

count=9, id=206, version=65501,

count=24, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=260, productName=VS2015 UPD1 build 23506, version=23506,

count=8, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=2, id=208, version=65501,

count=35, id=203, version=65501,

count=530, id=1, productName=Unmarked objects,

count=200, id=265, version=23918,

count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,