90b76bf411b63fdd062d839cf02d1846468151ec89e93aac59b9ffa7f99b040f

General

Target
2026-09-16_df6f6b72b649913ec7e7864ec78fbae5_darkgate_elex_glassworm_remcos_stealc_stop
Size 7.6MB
Sample260916-tpgsfsdk8x
SHA256 90b76bf411b63fdd062d839cf02d1846468151ec89e93aac59b9ffa7f99b040f
MD5 df6f6b72b649913ec7e7864ec78fbae5
SHA1 0ffcce6fddc342683ae100b23f5de286b3d812ac
SHA512 a45659d05a45330c3665450972b243e4c3441778ce1ec3c2c70d60b7a3167dd7679f500d0b05993dd882194009e5594e00474ed95b8c9f528accb6c186619a3e
SSDEEP 98304:bS0hHtf+NA9Xu3qqP4C18frP3wbzWFimaI7dlo5gpLmfkalwA/Lm:XHF+NA9Xu6VgbzWFimaI7dlvpLZat/L
TLSH
T17886CF51BE4D8176D90B117347299F2A112ABD187B3865D3B2B43E7EEC323C16D3A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-16_df6f6b72b649913ec7e7864ec78fbae5_darkgate_elex_glassworm_remcos_stealc_stop
- Size 7.6MB
- SHA256 90b76bf411b63fdd062d839cf02d1846468151ec89e93aac59b9ffa7f99b040f
- MD5 df6f6b72b649913ec7e7864ec78fbae5
- SHA1 0ffcce6fddc342683ae100b23f5de286b3d812ac
- SHA512 a45659d05a45330c3665450972b243e4c3441778ce1ec3c2c70d60b7a3167dd7679f500d0b05993dd882194009e5594e00474ed95b8c9f528accb6c186619a3e
- SSDEEP 98304:bS0hHtf+NA9Xu3qqP4C18frP3wbzWFimaI7dlo5gpLmfkalwA/Lm:XHF+NA9Xu6VgbzWFimaI7dlvpLZat/L
- TLSH
  T17886CF51BE4D8176D90B117347299F2A112ABD187B3865D3B2B43E7EEC323C16D3A60B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery persistence ransomware spyware stealer trojan
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing bas64 encoded gzip files
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- System Binary Proxy Execution: Verclsid
  Adversaries may abuse Verclsid to proxy execution of malicious code.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2