2026-09-26_a5deab12ac0702e5358c417aa13f70a6_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_a5deab12ac0702e5358c417aa13f70a6_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos
Size 4.9MB
Sample260926-vsd2eafd33
SHA256 a12ae895fa17f710f51f0ea2f54bd602862a19238bfde7674f22f5a232963b2f
MD5 a5deab12ac0702e5358c417aa13f70a6
SHA1 05e51f44b111bc8125c5043d044e85f6400e2efb
SHA512 52466747e0748b7ce79d8b29ed367ad2c7591b4e5863333528cfe92c55badc6666678b894356ebc6a20e9bc79d7e88db3d5ae68d2cb7eb388ba4faf9bcbf3d22
SSDEEP 98304:q0Ocn0xMTpKZKzRm0fxK2Iy4pXGOU8y1q5utbATwY2hlOC:q0lKuppf34pVU5t0TWl7
TLSH
T1EE36496367D546BEF2B22EB05D397219C779B9F01F32C40F23640A4D5A729C19822BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-26_a5deab12ac0702e5358c417aa13f70a6_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos

File Explorer

2026-09-26_a5deab12ac0702e5358c417aa13f70a6_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos

.exe 4.9MB

2026-09-26_a5deab12ac0702e5358c417aa13f70a6_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos

IMPHASH ecc0a4d1594b4f4dd175adbdf5d53fe8
SHA256 a12ae895fa17f710f51f0ea2f54bd602862a19238bfde7674f22f5a232963b2f
MD5 a5deab12ac0702e5358c417aa13f70a6
SHA1 05e51f44b111bc8125c5043d044e85f6400e2efb
SHA512 52466747e0748b7ce79d8b29ed367ad2c7591b4e5863333528cfe92c55badc6666678b894356ebc6a20e9bc79d7e88db3d5ae68d2cb7eb388ba4faf9bcbf3d22
SSDEEP 98304:q0Ocn0xMTpKZKzRm0fxK2Iy4pXGOU8y1q5utbATwY2hlOC:q0lKuppf34pVU5t0TWl7
TLSH
T1EE36496367D546BEF2B22EB05D397219C779B9F01F32C40F23640A4D5A729C19822BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6c:d4:4c:80:8d:2d:a5:b2:28:78:02:cc:cf:89:f8:86:30:48:42:4d:5f:af:23:a4:90:45:46:9a:c2:df:81:c1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 10, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

55:08:6b:07:86:cc:20:eb:26:02:25:20:29:ea:0d:8e:d2:e7:86:e0

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 10, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 12, 2018 - Jul 26, 2019

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 12, 2018 - Jul 26, 2019

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b1:71:13:79:df:75:f6:35:c8:00:00:00:00:00:b1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

Major OS version

Entry point

2264001

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

F:\Office\Target\x86\ship\click2run\en-us\AdminBootstrapper.pdb

advapi32

RegCreateKeyExW RegCloseKey CryptReleaseContext CryptAcquireContextW EventWrite EventWriteTransfer EventRegister EventUnregister RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegSetValueExW RegDeleteValueW OpenProcessToken GetTokenInformation AllocateAndInitializeSid FreeSid EqualSid CreateWellKnownSid IsValidSid GetSidSubAuthorityCount GetSidSubAuthority RevertToSelf OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW OpenSCManagerW CloseServiceHandle OpenServiceW QueryServiceStatusEx QueryServiceConfigW StartServiceW ControlService EnumDependentServicesW DeleteService CreateServiceW ChangeServiceConfig2W ChangeServiceConfigW SetServiceObjectSecurity GetLengthSid InitializeAcl AddAccessAllowedAce CopySid InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertSidToStringSidA CheckTokenMembership LookupPrivilegeValueW AdjustTokenPrivileges CryptDestroyHash CryptGetHashParam CryptCreateHash CryptHashData RegNotifyChangeKeyValue RegEnumValueA RegDeleteValueA RegSetKeySecurity

kernel32

SetFileAttributesW GetFileAttributesExW GetDiskFreeSpaceExW DeleteFileW CloseHandle GetCurrentDirectoryW GetWindowsDirectoryW GetProcAddress SetFilePointerEx MoveFileExW CopyFileW AreFileApisANSI WideCharToMultiByte UnmapViewOfFile CreateFileMappingA MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LoadLibraryA LCMapStringW FreeLibrary LocalFree FormatMessageA GetTickCount64 GetCurrentThreadId TlsAlloc TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetModuleHandleExW K32GetProcessMemoryInfo GlobalMemoryStatusEx LeaveCriticalSection EnterCriticalSection RaiseException GetModuleHandleW LoadLibraryExW VerSetConditionMask VerifyVersionInfoW GetVersionExW GetStringTypeW InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive OpenProcess GetCurrentProcessId TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW FindResourceW SizeofResource LoadResource GetCPInfoExW GetUserDefaultLocaleName IsValidCodePage SetLastError GetSystemTime SystemTimeToFileTime FileTimeToSystemTime SetErrorMode GetComputerNameW MulDiv FormatMessageW GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW CreateEventW SetEvent WaitForSingleObject ReleaseSemaphore WaitForSingleObjectEx CreateEventExW CreateThread WaitForMultipleObjectsEx CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork LoadLibraryW OutputDebugStringA RtlCaptureStackBackTrace QueryDepthSList FindClose InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList ReleaseMutex SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime CompareFileTime GetTempPathW GetLongPathNameW ExpandEnvironmentStringsW GetCommandLineW GlobalFree ProcessIdToSessionId GetExitCodeThread WaitForMultipleObjects SignalObjectAndWait GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer HeapFree GetProcessHeap ReadFile GetFileSizeEx GetTempFileNameW WriteFile GetTickCount SetEndOfFile GetThreadLocale FindFirstFileExW lstrcmpW GetModuleHandleA GetFileType GetOverlappedResult SetFileInformationByHandle GetFileInformationByHandleEx GetDriveTypeW CreateMutexW OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA LocalAlloc HeapAlloc GlobalAlloc GetPriorityClass GetExitCodeProcess K32EnumProcesses GetTimeZoneInformation IsValidLocale VirtualProtectEx GetSystemInfo ResetEvent LockResource FlushFileBuffers CancelIoEx GetLocaleInfoEx LCIDToLocaleName LocaleNameToLCID GetSystemDefaultLCID LCMapStringEx ResolveLocaleName EnumSystemLocalesEx GetSystemDefaultLocaleName IsProcessorFeaturePresent WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus IsDebuggerPresent CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW VirtualFree VirtualAlloc GetLocaleInfoW GetUserPreferredUILanguages GetACP GetUserGeoID GetProductInfo SwitchToThread GetEnvironmentVariableW RemoveDirectoryW DeviceIoControl FindNextFileW GetFullPathNameW FindFirstFileW CreateDirectoryW GetThreadTimes GetCurrentThread GetProcessTimes QueryPerformanceCounter LoadLibraryExA VirtualQuery SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP SetStdHandle EnumSystemLocalesW ExitProcess HeapReAlloc HeapSize GetConsoleCP ReadConsoleW GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer GetSystemTimeAsFileTime QueryPerformanceFrequency MultiByteToWideChar GetModuleFileNameW IsWow64Process CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwind GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer DuplicateHandle K32GetProcessImageFileNameW GetSystemPreferredUILanguages GetFileAttributesW CreateFileW FlsAlloc FlsFree DeleteCriticalSection CompareStringEx GetLastError InitializeCriticalSectionEx GetCurrentProcess GetDateFormatW GetTimeFormatW OpenThread lstrcmpA FreeConsole WriteConsoleW GetStdHandle AllocConsole AttachConsole DecodePointer TryEnterCriticalSection GetLocalTime

ole32

CoRevokeInitializeSpy CoRegisterInitializeSpy CreateStreamOnHGlobal CoTaskMemAlloc IIDFromString CLSIDFromString CoTaskMemFree CoCreateInstance CoSetProxyBlanket CoCreateFreeThreadedMarshaler StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeEx

oleaut32

VariantInit VariantClear SysFreeString SysAllocString

cabinet

ord13 ord14

wintrust

WTHelperProvDataFromStateData WinVerifyTrust WTHelperGetProvSignerFromChain

setupapi

SetupIterateCabinetW

ws2_32

WSAStartup FreeAddrInfoW GetAddrInfoW

iphlpapi

CreateSortedAddressPairs FreeMibTable

gdi32

GetDeviceCaps CreateSolidBrush SetTextColor SetBkColor GetStockObject CreateFontW SelectObject GetTextMetricsW CreatePen SetDCPenColor Rectangle GetTextExtentPoint32W SetDCBrushColor DeleteObject

gdiplus

GdipDeleteGraphics GdipCreateFromHDC GdipDrawImageRectRectI GdiplusStartup GdipDrawImageRectI GdipFree GdipDisposeImage GdipAlloc GdipCloneImage GdipLoadImageFromStream GdipGetImageHeight GdipFillRectangleI GdipCloneBrush GdipDeleteBrush GdipGetImageWidth GdipGetImageGraphicsContext GdipCreateSolidFill GdipCreateBitmapFromScan0

rpcrt4

RpcStringFreeW UuidToStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_a5deab12ac0702e5358c417aa13f70a6_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos

PE Signature issue

PE Signature issue

advapi32

kernel32

ole32

oleaut32

cabinet

wintrust

setupapi

ws2_32

iphlpapi

gdi32

gdiplus

rpcrt4

generic