2026-09-16_8a096d051b62661be6aaf5f276392ce2_darkgate_elex_glassworm_hijackloader_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_8a096d051b62661be6aaf5f276392ce2_darkgate_elex_glassworm_hijackloader_mespinoza
Size 2.4MB
Sample260916-m4e4vayhrd
SHA256 7cc83948481cb14351739e888dde8ea55656d2de5287ac35fd673702b9e03045
MD5 8a096d051b62661be6aaf5f276392ce2
SHA1 a8d6ad7b09353199368738d67879b8b1a41ce89b
SHA512 bf99a02f92cb6c71fbabea505c8252e84706bb9327b1feb616a3f5c787d1ecf106fd80ec50ed6c57442c55d11d945d79b9fe03529f993d751b511522c01e180c
SSDEEP 49152:5vQw6bkG5nP91mAgh58TL8zaNNakJBIs7sH2up:5CNnP2hPSakJByH
TLSH
T1D3C5BE01BA5692F2D6D39437C3D8D2733B79651A8DB75193B3A0CB2A99B48C1DD803CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_8a096d051b62661be6aaf5f276392ce2_darkgate_elex_glassworm_hijackloader_mespinoza

File Explorer

2026-09-16_8a096d051b62661be6aaf5f276392ce2_darkgate_elex_glassworm_hijackloader_mespinoza

.exe 2.4MB

2026-09-16_8a096d051b62661be6aaf5f276392ce2_darkgate_elex_glassworm_hijackloader_mespinoza

IMPHASH f879a035b60bcf7f6cdbcc8f6012d2c4
SHA256 7cc83948481cb14351739e888dde8ea55656d2de5287ac35fd673702b9e03045
MD5 8a096d051b62661be6aaf5f276392ce2
SHA1 a8d6ad7b09353199368738d67879b8b1a41ce89b
SHA512 bf99a02f92cb6c71fbabea505c8252e84706bb9327b1feb616a3f5c787d1ecf106fd80ec50ed6c57442c55d11d945d79b9fe03529f993d751b511522c01e180c
SSDEEP 49152:5vQw6bkG5nP91mAgh58TL8zaNNakJBIs7sH2up:5CNnP2hPSakJByH
TLSH
T1D3C5BE01BA5692F2D6D39437C3D8D2733B79651A8DB75193B3A0CB2A99B48C1DD803CE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

611413

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\code\xunyou7.0\XunYouCrash\3rd-tool\other\xy_crash\bin\CrashSender.pdb

ws2_32

recv ntohs inet_ntoa inet_addr htons htonl connect closesocket send socket gethostbyaddr gethostbyname getservbyport getservbyname WSAStartup WSACleanup WSASetLastError WSAGetLastError

dnsapi

DnsFree DnsQuery_W

wininet

InternetQueryOptionW InternetSetOptionW InternetWriteFile InternetReadFile HttpSendRequestExW HttpEndRequestW HttpQueryInfoW InternetCloseHandle InternetConnectW HttpOpenRequestW InternetOpenW

rpcrt4

RpcStringFreeA UuidToStringA

psapi

GetProcessMemoryInfo

gdi32

GetDIBits CreateDCW SetViewportOrgEx TextOutW SetLayout CreateCompatibleBitmap CreateCompatibleDC CreateHalftonePalette CreatePen DeleteDC DeleteObject GetStockObject SelectObject SetBkMode SetTextColor GetObjectW Polygon CreateSolidBrush SetBkColor BitBlt CreateFontW CreatePalette CreateRectRgn RealizePalette SelectClipRgn SelectPalette SetDIBits StretchBlt SetStretchBltMode CreateDIBSection GetDIBColorTable CreateFontIndirectW

shell32

SHFileOperationW ExtractIconW SHGetFileInfoW ShellExecuteW CommandLineToArgvW Shell_NotifyIconW SHGetSpecialFolderPathW

comdlg32

GetSaveFileNameW GetOpenFileNameW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetProcessHeap HeapFree IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter WaitForSingleObjectEx GetStartupInfoW HeapAlloc EncodePointer IsDebuggerPresent QueryPerformanceCounter FlushInstructionCache GetTimeZoneInformation CloseHandle GetSystemInfo CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile lstrlenW CreateDirectoryW GetFileAttributesW GetFileAttributesExW GetTempFileNameW GetTempPathW DebugBreak OutputDebugStringW GetLastError GetCurrentProcess FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress GlobalAlloc GlobalFree FormatMessageW lstrlenA LoadLibraryW GetPrivateProfileStringW WritePrivateProfileStringW SystemTimeToTzSpecificLocalTime SystemTimeToFileTime MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObject CreateEventW WideCharToMultiByte CreateFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx GetFullPathNameW SetLastError GetProcessTimes OpenProcess GetSystemTime ReadProcessMemory CopyFileW FileTimeToSystemTime GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW DecodePointer RaiseException GetCurrentThreadId LoadLibraryExW LoadResource SizeofResource MulDiv lstrcmpW lstrcmpiW FindResourceW CompareStringW GetVersionExW InitializeCriticalSection GlobalMemoryStatusEx GetModuleFileNameA GetPrivateProfileStringA GetFileInformationByHandle ReadFile WriteFile CreateMutexW GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateThread CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW Sleep GlobalLock GlobalUnlock GetSystemDirectoryA LoadLibraryA GetSystemTimeAsFileTime

user32

SetMenuItemInfoW SetWindowTextW CheckMenuRadioItem MonitorFromPoint MonitorFromWindow GetMonitorInfoW PostQuitMessage FlashWindow DialogBoxParamW EnableWindow GetMenu DrawIcon DrawTextExW AdjustWindowRectEx MessageBoxW CopyRect LoadIconW GetIconInfo IsDialogMessageW PostMessageW SetProcessDefaultLayout CharUpperW SetTimer KillTimer DrawTextExA SetScrollInfo GetScrollInfo AnimateWindow OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetSystemMetrics IntersectRect EnumWindows GetWindowThreadProcessId EnumDisplayMonitors GetCursorInfo TrackPopupMenu GetWindowTextLengthW GetClassNameW RedrawWindow InvalidateRect EndPaint DestroyMenu ReleaseDC UpdateWindow DrawTextW IsWindowEnabled ReleaseCapture SetCapture GetCapture GetKeyState GetFocus SetFocus GetDlgCtrlID GetDlgItem CreateDialogParamW IsWindowVisible SetWindowPos ShowWindow DestroyWindow IsWindow CreateWindowExW UnregisterClassW CallWindowProcW DefWindowProcW SendMessageW PeekMessageW GetParent GetDesktopWindow PtInRect OffsetRect SetRectEmpty FillRect DrawFocusRect GetSysColorBrush DeleteMenu GetSubMenu EnableMenuItem DispatchMessageW TranslateMessage GetMessageW GetGuiResources GetWindow SetWindowLongW GetWindowLongW MapWindowPoints GetWindowRect GetClientRect GetDC CharNextW MoveWindow LoadMenuW GetActiveWindow EndDialog SystemParametersInfoW LoadImageW DestroyIcon BeginPaint LoadCursorW GetSysColor ScreenToClient GetCursorPos GetWindowTextW SetCursor LoadStringW

advapi32

RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges RegQueryInfoKeyW OpenProcessToken CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptEncrypt CryptDeriveKey CryptReleaseContext CryptAcquireContextW RegSetValueExW RegEnumKeyExW

ole32

CoCreateGuid CoUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize

oleaut32

VarDecCmp VarR8FromStr VarDateFromStr VarUI4FromStr SysFreeString VarI4FromStr VarDecFromStr

shlwapi

PathFileExistsA PathAddBackslashW PathRemoveFileSpecW

comctl32

_TrackMouseEvent ImageList_Create ImageList_ReplaceIcon ImageList_Remove InitCommonControlsEx

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??Bid@locale@std@@QAEIXZ ?uncaught_exception@std@@YA_NXZ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?good@ios_base@std@@QBE_NXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBE_JXZ ?width@ios_base@std@@QAE_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_BADOFF@std@@3_JB ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ

vcruntime140

memmove __std_type_info_destroy_list _except_handler4_common __vcrt_InitializeCriticalSectionEx longjmp strchr __CxxLongjmpUnwind _setjmp3 __std_exception_destroy __std_exception_copy __std_terminate _purecall memcmp memchr wcsstr wcsrchr wcschr __CxxFrameHandler3 _CxxThrowException memset memcpy

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _errno _invalid_parameter_noinfo_noreturn terminate _set_app_type _seh_filter_dll _configure_narrow_argv _configure_wide_argv _invalid_parameter_noinfo _initialize_wide_environment _crt_at_quick_exit _initialize_narrow_environment _controlfp_s _get_wide_winmain_command_line _initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _c_exit _execute_onexit_table _initterm _crt_atexit _exit exit _initterm_e abort _cexit

api-ms-win-crt-string-l1-1-0

strcpy wcscspn strlen isspace strncmp isalpha tolower wcslen strncpy isalnum toupper iswspace iswdigit wcspbrk wcscpy_s strncpy_s strcat_s strcpy_s isdigit strcmp wcsncmp wcsncpy_s _wcsicmp wcstok_s wcscmp

api-ms-win-crt-heap-l1-1-0

_recalloc _callnewh calloc realloc malloc free _set_new_mode

api-ms-win-crt-convert-l1-1-0

_wtoi strtod atof strtoul atoi _wtol

api-ms-win-crt-environment-l1-1-0

_wdupenv_s getenv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __stdio_common_vsprintf fseek __acrt_iob_func tmpfile ftell __stdio_common_vsnprintf_s fopen_s _set_fmode __p__commode _wfopen_s rewind __stdio_common_vsprintf_s fread fclose feof __stdio_common_vfwprintf ungetc __stdio_common_vswprintf_s fopen _wfopen _ftelli64 setvbuf fwrite _fseeki64 fsetpos fputc fgetpos fgetc fflush _get_stream_buffer_pointers __stdio_common_vfprintf ferror

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime _gmtime64_s _gmtime64 wcsftime

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32 _unlock_file _lock_file remove

api-ms-win-crt-utility-l1-1-0

labs srand rand qsort abs

api-ms-win-crt-math-l1-1-0

ceil pow _except1 __setusermatherr fabs

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

617KB

Virtual Size

617KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

530KB

Virtual Size

530KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_8a096d051b62661be6aaf5f276392ce2_darkgate_elex_glassworm_hijackloader_mespinoza

ws2_32

dnsapi

wininet

rpcrt4

psapi

gdi32

shell32

comdlg32

version

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic