2026-09-26_58ed300226a21650fa64aebbfb432e36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

General

Target
2026-09-26_58ed300226a21650fa64aebbfb432e36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil
Size 2.5MB
Sample260926-2b4dastt6l
SHA256 b63d3ca6b27dcfe378cedd1a2b91e92d301ba09a52065aba4c79b3a28f0b4718
MD5 58ed300226a21650fa64aebbfb432e36
SHA1 4177ccfe53d709e90da6d722f9659f574500a638
SHA512 0ffd6eb41ccd9753883928b57ef4372a7444e487ba1d7cd4adb682e37f7ed23a97f168685f5db87e2413d247c996acc7b69c74f42bd7c329166dbf7dc1e1800c
SSDEEP 49152:xfTGDfBoRdiyBRusf8yLZY/3dEJpu9p1RdrqDM7ZsaoSqaA9pvLSkdYPuKTHFpM6:xfTGDfBoqspep17eDMiaA9hfGFpMaQlg
TLSH
T174C5BF23BA828172E5A30231957BA77F4939BA30233985D7D3D41D2D4D706D36B3A39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-26_58ed300226a21650fa64aebbfb432e36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

File Explorer

2026-09-26_58ed300226a21650fa64aebbfb432e36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

.exe 2.5MB

2026-09-26_58ed300226a21650fa64aebbfb432e36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

SHA256 b63d3ca6b27dcfe378cedd1a2b91e92d301ba09a52065aba4c79b3a28f0b4718
MD5 58ed300226a21650fa64aebbfb432e36
SHA1 4177ccfe53d709e90da6d722f9659f574500a638
SHA512 0ffd6eb41ccd9753883928b57ef4372a7444e487ba1d7cd4adb682e37f7ed23a97f168685f5db87e2413d247c996acc7b69c74f42bd7c329166dbf7dc1e1800c
SSDEEP 49152:xfTGDfBoRdiyBRusf8yLZY/3dEJpu9p1RdrqDM7ZsaoSqaA9pvLSkdYPuKTHFpM6:xfTGDfBoqspep17eDMiaA9hfGFpMaQlg
TLSH
T174C5BF23BA828172E5A30231957BA77F4939BA30233985D7D3D41D2D4D706D36B3A39B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

740445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

457KB

Virtual Size

457KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=18, id=241, version=40116,

count=196, id=243, version=40116,

count=29, id=242, version=40116,

count=20, productName=Unmarked objects (old),

count=9, id=199, version=41118,

count=26, id=259, version=24123,

count=13, id=265, version=24215,

count=86, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=37, id=260, version=24123,

count=70, id=261, version=24123,

count=2, id=261, version=23013,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=474, id=1, productName=Unmarked objects,

count=478, id=260, version=24225,

count=50, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_58ed300226a21650fa64aebbfb432e36_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_revil

generic