2026-08-21_6dc5ac52f42dbafa1879848e5ff1a120_bkransomware_chir_darkgate_elex_glassworm_maze_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_6dc5ac52f42dbafa1879848e5ff1a120_bkransomware_chir_darkgate_elex_glassworm_maze_stealc
Size 2.1MB
Sample260821-e2agkssglc
SHA256 bc24244d2da30a9032b23e897c321cdb092ac438b7df44690124d7295422fb8a
MD5 6dc5ac52f42dbafa1879848e5ff1a120
SHA1 3ab870cb0528ea5925c7cfcb300b9ca7b13b9b56
SHA512 6fb3aa5f81004c3aead3caea5650d92228de1faca584db96557942c83a055087b0faaa2248d3977fd703addb99ee15df46a0ceb0a6deec4ea48566e3f37fc032
SSDEEP 49152:7oXVCC8aXTdd43UKJ3eNzuyk31H3G2IFEO0tZRNNVpRTq+aoyPGw64eRtl+yd:MXoC8aXT3b63eNzuyk31H3G2AEO0ZNNb
TLSH
T1EBA57C25FB00C132D99304B2A6BDA76E9578B530175968C3F3C41F6E2AE49E37A34787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-21_6dc5ac52f42dbafa1879848e5ff1a120_bkransomware_chir_darkgate_elex_glassworm_maze_stealc

File Explorer

2026-08-21_6dc5ac52f42dbafa1879848e5ff1a120_bkransomware_chir_darkgate_elex_glassworm_maze_stealc

.exe 2.1MB

2026-08-21_6dc5ac52f42dbafa1879848e5ff1a120_bkransomware_chir_darkgate_elex_glassworm_maze_stealc

IMPHASH 68278832f1a9767f9655d99ad9c45bb1
SHA256 bc24244d2da30a9032b23e897c321cdb092ac438b7df44690124d7295422fb8a
MD5 6dc5ac52f42dbafa1879848e5ff1a120
SHA1 3ab870cb0528ea5925c7cfcb300b9ca7b13b9b56
SHA512 6fb3aa5f81004c3aead3caea5650d92228de1faca584db96557942c83a055087b0faaa2248d3977fd703addb99ee15df46a0ceb0a6deec4ea48566e3f37fc032
SSDEEP 49152:7oXVCC8aXTdd43UKJ3eNzuyk31H3G2IFEO0tZRNNVpRTq+aoyPGw64eRtl+yd:MXoC8aXT3b63eNzuyk31H3G2AEO0ZNNb
TLSH
T1EBA57C25FB00C132D99304B2A6BDA76E9578B530175968C3F3C41F6E2AE49E37A34787
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b7:e4:fc:79:ca:ce:80:8b:2e:d6:07:e4:cd:2b:f9:c1:8c:bf:2e:0e:36:f3:88:c3:1a:21:e0:ad:73:74:7b:72

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Hangzhou Hikvision Digital Technology Co.\, Ltd.,O=Hangzhou Hikvision Digital Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Chains

Aug 27, 2024

CN=Hangzhou Hikvision Digital Technology Co.\, Ltd.,O=Hangzhou Hikvision Digital Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=Hangzhou Hikvision Digital Technology Co.\, Ltd.,O=Hangzhou Hikvision Digital Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=Hangzhou Hikvision Digital Technology Co.\, Ltd.,O=Hangzhou Hikvision Digital Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Hangzhou Hikvision Digital Technology Co.\, Ltd.,O=Hangzhou Hikvision Digital Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Serial Number

3b:ad:0b:71:30:ff:8d:f6:6c:21:e8:aa

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2024 - Jun 27, 2027

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

3381912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins_ci\workspace\Pack_Web_WebPlugins\WebLocalService\target\vs2013_win32\release\WebPluginService.pdb

ws2_32

freeaddrinfo ntohl inet_ntoa accept listen getsockopt send closesocket WSASetLastError __WSAFDIsSet socket bind getaddrinfo WSACleanup sendto setsockopt shutdown WSAGetLastError recvfrom WSAStartup connect ioctlsocket getsockname htons inet_addr getpeername htonl recv WSASend WSARecv WSAIoctl ntohs select

rpcrt4

UuidCreate

winmm

timeKillEvent timeEndPeriod

gdiplus

GdipFree GdipDeleteBrush GdiplusShutdown GdipCloneBrush GdipFillPolygonI GdipCreateSolidFill GdipAlloc GdipCreateFromHDC GdipSetSolidFillColor GdiplusStartup GdipDeletePen GdipDrawLineI GdipCreatePen1 GdipLoadImageFromStream GdipSaveImageToStream GdipGetImageHeight GdipFillPolygon GdipCombineRegionRectI GdipFillRegion GdipDrawImageRectI GdipLoadImageFromFile GdipDrawPolygon GdipDrawLines GdipSetPenColor GdipGetImageEncodersSize GdipDisposeImage GdipDeleteRegion GdipGetImageEncoders GdipCreateRegion GdipFillPieI GdipCloneImage GdipGetImageWidth GdipDeleteGraphics

slf

HIKSLF_WebProcess

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetCPInfo UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue CreateSemaphoreW GetModuleHandleW GetStartupInfoW TerminateProcess CreateEventW InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind LoadLibraryExW ExitThread CreateThread WriteFile CreateFileW GetLastError GetLocalTime CloseHandle GetModuleHandleA GetCurrentProcess CreateDirectoryW GetCurrentThread WideCharToMultiByte GetFileAttributesA GetEnvironmentVariableA MultiByteToWideChar CreateDirectoryA OutputDebugStringA GetDiskFreeSpaceExA HeapReAlloc HeapAlloc HeapFree GetProcessHeap InitializeCriticalSectionEx RaiseException HeapSize DecodePointer DeleteCriticalSection SetFileAttributesA lstrlenA lstrcpynA lstrcatA EnumSystemLocalesW FindClose FreeLibrary GetProcAddress LoadLibraryExA GetSystemTime MulDiv DeleteFileA CreateProcessA GetSystemDirectoryA GetModuleFileNameA CreateMutexA InitializeCriticalSection Sleep MoveFileA LoadLibraryA GetSystemInfo CreateFileA SetFilePointer ReadFile FlushFileBuffers GetFileType FindNextFileA GetFileInformationByHandle LocalFree TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError TlsGetValue WaitForSingleObject TlsSetValue SetThreadPriority GetCurrentThreadId TlsAlloc TlsFree DuplicateHandle QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime FileTimeToSystemTime GetTimeZoneInformation QueryPerformanceFrequency FileTimeToLocalFileTime SetWaitableTimer SetEvent ResetEvent WaitForMultipleObjects GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort CreateSemaphoreA ReleaseSemaphore IsDebuggerPresent IsProcessorFeaturePresent ExitProcess GetModuleHandleExW AreFileApisANSI SystemTimeToTzSpecificLocalTime GetCommandLineA GetStdHandle GetModuleFileNameW GetFileAttributesExW GetStringTypeW DeleteFileW IsValidCodePage GetACP GetOEMCP SetFilePointerEx GetConsoleCP GetConsoleMode ReadConsoleW FindFirstFileExW FindNextFileW GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW MoveFileExW OutputDebugStringW GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualAlloc VirtualFree VirtualProtect InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx SetStdHandle WriteConsoleW LoadLibraryW SetEndOfFile EncodePointer SetEnvironmentVariableA FindFirstFileA

user32

PostQuitMessage RegisterClassExA GetMessageA EnumWindows GetWindowTextA BringWindowToTop GetWindowRgn SendMessageTimeoutA EndPaint ClientToScreen SetCursor SetTimer GetWindowRect SetCapture KillTimer BeginPaint GetDC InvalidateRect ReleaseDC SetClassLongA IsWindow PostMessageA LoadStringA SendMessageA GetClassNameA DialogBoxParamA DrawTextA FrameRect WaitForInputIdle GetForegroundWindow FindWindowA DestroyWindow SetWindowPlacement LoadIconA SetParent GetClientRect SetFocus GetMonitorInfoA GetWindowPlacement SetWindowLongA GetWindowLongA CreateWindowExA MonitorFromWindow DefWindowProcA TranslateMessage TranslateAcceleratorA EndDialog LoadAcceleratorsA ReleaseCapture DispatchMessageA SetWindowPos ShowWindow SetWindowRgn UpdateWindow LoadCursorA RegisterClassA GetWindow MoveWindow DrawTextW RegisterDeviceNotificationA FillRect GetParent

gdi32

Polyline SetStretchBltMode Ellipse CreateCompatibleBitmap CreateCompatibleDC StretchBlt PolyBezier DeleteDC BitBlt SetBkColor CreateRectRgn CreateRoundRectRgn CombineRgn MoveToEx Rectangle LineTo GetTextExtentPoint32W SetTextColor CreateFontA SetBkMode SelectObject CreateFontW CreatePen GetStockObject GetTextCharset GetDeviceCaps CreateSolidBrush DeleteObject

comdlg32

GetSaveFileNameA GetOpenFileNameA

advapi32

IsTextUnicode GetSecurityInfo

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteExA SHBrowseForFolderA ord680

ole32

CreateStreamOnHGlobal

??0CBaseProtocol@NetSDK@@QAE@ABV01@@Z ??0CCoreSignal@NetSDK@@QAE@ABV01@@Z ??0CCtrlCoreBase@NetSDK@@QAE@ABV01@@Z ??0CCycleBuffer@NetSDK@@QAE@ABV01@@Z ??0CDependLibLoader@NetSDK@@QAE@ABV01@@Z ??0CLinkAsyncIO@NetSDK@@QAE@ABV01@@Z ??0CLinkBase@NetSDK@@QAE@ABV01@@Z ??0CLinkTCP@NetSDK@@QAE@ABV01@@Z ??0CLinkTCPSocks5@NetSDK@@QAE@ABV01@@Z ??0CLongLinkPrivate@NetSDK@@QAE@ABV01@@Z ??0CLongLinkPrivateBase@NetSDK@@QAE@ABV01@@Z ??0CMemberBase@NetSDK@@QAE@ABV01@@Z ??0CMemberMgrBase@NetSDK@@QAE@ABV01@@Z ??0CMultiThreadControl@NetSDK@@QAE@ABV01@@Z ??0CObjectBase@NetSDK@@QAE@ABV01@@Z ??0CObjectBasePrivate@NetSDK@@QAE@ABV01@@Z ??0CRWLock@NetSDK@@QAE@ABV01@@Z ??0CRWLockGuard@NetSDK@@QAE@ABV01@@Z ??0CSSLTransInterface@NetSDK@@QAE@ABV01@@Z ??0CSSLTransInterface@NetSDK@@QAE@XZ ??1CSSLTransInterface@NetSDK@@UAE@XZ ??4CBaseProtocol@NetSDK@@QAEAAV01@ABV01@@Z ??4CCoreSignal@NetSDK@@QAEAAV01@ABV01@@Z ??4CCtrlCoreBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CCycleBuffer@NetSDK@@QAEAAV01@ABV01@@Z ??4CDependLibLoader@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkAsyncIO@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkTCP@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkTCPSocks5@NetSDK@@QAEAAV01@ABV01@@Z ??4CLongLinkPrivate@NetSDK@@QAEAAV01@ABV01@@Z ??4CLongLinkPrivateBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CMemberBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CMemberMgrBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CMultiThreadControl@NetSDK@@QAEAAV01@ABV01@@Z ??4CObjectBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CObjectBasePrivate@NetSDK@@QAEAAV01@ABV01@@Z ??4CRWLock@NetSDK@@QAEAAV01@ABV01@@Z ??4CSSLTransInterface@NetSDK@@QAEAAV01@ABV01@@Z ??4CXmlBase@NetSDK@@QAEAAV01@ABV01@@Z ??_7CBaseProtocol@NetSDK@@6B@ ??_7CCoreSignal@NetSDK@@6B@ ??_7CCtrlCoreBase@NetSDK@@6B@ ??_7CCycleBuffer@NetSDK@@6B@ ??_7CDependLibLoader@NetSDK@@6B@ ??_7CLinkAsyncIO@NetSDK@@6B@ ??_7CLinkBase@NetSDK@@6B@ ??_7CLinkTCP@NetSDK@@6B@ ??_7CLinkTCPSocks5@NetSDK@@6B@ ??_7CLongLinkPrivate@NetSDK@@6B@ ??_7CLongLinkPrivateBase@NetSDK@@6B@ ??_7CMemberBase@NetSDK@@6B@ ??_7CMemberMgrBase@NetSDK@@6B@ ??_7CMultiThreadControl@NetSDK@@6B@ ??_7CObjectBase@NetSDK@@6B@ ??_7CObjectBasePrivate@NetSDK@@6B@ ??_7CRWLock@NetSDK@@6B@ ??_7CRWLockGuard@NetSDK@@6B@ ??_7CSSLTransInterface@NetSDK@@6B@ ?Recv@CLinkBase@NetSDK@@UAEHABIPADH@Z ?SetAsyn@CBaseProtocol@NetSDK@@QAEXH@Z

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_6dc5ac52f42dbafa1879848e5ff1a120_bkransomware_chir_darkgate_elex_glassworm_maze_stealc

PE Signature issue

ws2_32

rpcrt4

winmm

gdiplus

slf

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic