2026-09-28_b81e624f378167c21857396803bcc73e_bkransomware_darkgate_elex_glassworm_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_b81e624f378167c21857396803bcc73e_bkransomware_darkgate_elex_glassworm_maze
Size 1.7MB
Sample260928-prfkysvxey
SHA256 95b485bc9d9d031f945fa199d6fdbc9d7a01560bb429888463ab7e95cf7d94dd
MD5 b81e624f378167c21857396803bcc73e
SHA1 2abac2ee37f692d6c64dc1df5058eaabe56c1a49
SHA512 49cb82a0476b1e1c8461657f07b973d198e59c1bef914a34d9de2560e5561f5dc87b94aeff5b82ab00d3c2fac7a1e8f69c445780581d8808fbccae5079186172
SSDEEP 24576:daSrV1+rr3XgPrOw0SeFw45UyycZO5z31GrvuihbVPaOtVVAc5T7nVC9Q6nenzOH:QSB7OwV5NtMaOzR5XVC9reCH
TLSH
T10385E1227390C076D67201319A6DB2B555BEBE318F264AD7B3D97B0D1A305E0BE39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_b81e624f378167c21857396803bcc73e_bkransomware_darkgate_elex_glassworm_maze

File Explorer

2026-09-28_b81e624f378167c21857396803bcc73e_bkransomware_darkgate_elex_glassworm_maze

.exe 1.7MB

2026-09-28_b81e624f378167c21857396803bcc73e_bkransomware_darkgate_elex_glassworm_maze

IMPHASH a67d0bf67d52385fcee74cd599ac992b
SHA256 95b485bc9d9d031f945fa199d6fdbc9d7a01560bb429888463ab7e95cf7d94dd
MD5 b81e624f378167c21857396803bcc73e
SHA1 2abac2ee37f692d6c64dc1df5058eaabe56c1a49
SHA512 49cb82a0476b1e1c8461657f07b973d198e59c1bef914a34d9de2560e5561f5dc87b94aeff5b82ab00d3c2fac7a1e8f69c445780581d8808fbccae5079186172
SSDEEP 24576:daSrV1+rr3XgPrOw0SeFw45UyycZO5z31GrvuihbVPaOtVVAc5T7nVC9Q6nenzOH:QSB7OwV5NtMaOzR5XVC9reCH
TLSH
T10385E1227390C076D67201319A6DB2B555BEBE318F264AD7B3D97B0D1A305E0BE39723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

238965

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\project_sign_file\360Game\src\setup\installer\bin\Release\ExtGame.pdb

kernel32

InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WideCharToMultiByte MultiByteToWideChar DuplicateHandle GetCurrentProcess GetFileType SetFilePointer ReadFile SystemTimeToFileTime GetCurrentDirectoryW DosDateTimeToFileTime CreateDirectoryW WriteFile SetFileTime GetFileSize GetFileAttributesW SetEndOfFile SetFileAttributesW DeleteFileW MoveFileW MoveFileExW RemoveDirectoryW FindFirstFileW FindNextFileW FindClose WritePrivateProfileStringW GetTickCount GetPrivateProfileStringW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetCommandLineW GetVersionExW VirtualQuery GetCurrentThreadId WritePrivateProfileStructW CopyFileW TerminateProcess SetUnhandledExceptionFilter GetSystemDirectoryW GetTempPathW GetPrivateProfileIntW GetTempFileNameW VirtualAlloc VirtualFree CreateMutexW CreateEventW SetEvent WaitForSingleObject Sleep IsBadReadPtr IsBadWritePtr TlsSetValue WaitForMultipleObjects CancelWaitableTimer ResetEvent LocalFree SetWaitableTimer GetDiskFreeSpaceExW TlsAlloc TlsFree GetLongPathNameW SetLastError OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeCriticalSectionAndSpinCount RaiseException lstrcmpiW InterlockedDecrement InterlockedIncrement LoadLibraryW FlushInstructionCache ExitProcess LocalAlloc SetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetModuleFileNameW GetCurrentProcessId CloseHandle CreateFileW LoadLibraryExA SetThreadContext GetThreadContext ResumeThread SuspendThread lstrlenA ReleaseMutex HeapWalk HeapLock HeapUnlock CreateWaitableTimerW GetLastError FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FreeLibrary LoadLibraryExW GetCurrentThread GetProcAddress GetModuleHandleW GetCPInfo CreateSemaphoreW GetStartupInfoW TlsGetValue UnhandledExceptionFilter RtlUnwind SetEnvironmentVariableA WriteConsoleW FlushFileBuffers UnregisterWaitEx QueryDepthSList InterlockedFlushSList ExitThread CreateThread ReadProcessMemory VerSetConditionMask VerifyVersionInfoW EncodePointer GetSystemTimeAsFileTime GetStringTypeW GetExitCodeThread IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetThreadPriority CreateProcessW GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait DecodePointer GetWindowsDirectoryW ReleaseSemaphore VirtualProtect GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTimeZoneInformation SetStdHandle GetConsoleCP ReadConsoleW GetConsoleMode GetStdHandle SetFilePointerEx AreFileApisANSI GetModuleHandleExW GetOEMCP GetACP IsValidCodePage GetLogicalProcessorInformation

user32

FindWindowW ShowWindow PostMessageW DefWindowProcW UnregisterClassW CharNextW DispatchMessageW TranslateMessage GetMessageW PeekMessageW DestroyWindow SendMessageTimeoutW SetTimer SetWindowLongW GetWindowLongW CallWindowProcW PostQuitMessage KillTimer IsWindow RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW

advapi32

RegEnumKeyExW RegCreateKeyExW RegSetValueExW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteW ShellExecuteExW

ole32

CoInitializeSecurity CoInitializeEx CoUninitialize CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoSetProxyBlanket CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString SysFreeString VarUI4FromStr VariantInit VariantClear

shlwapi

PathGetDriveNumberW StrStrIW SHSetValueW PathAddBackslashW PathMatchSpecW PathRemoveFileSpecW PathFileExistsW PathIsDirectoryW PathFindFileNameA PathCombineW PathFindFileNameW StrCmpIW PathAppendW SHGetValueW StrStrIA PathIsRootW SHDeleteKeyW

comctl32

InitCommonControlsEx

wininet

InternetSetStatusCallbackW FtpGetFileSize HttpSendRequestW HttpAddRequestHeadersW DeleteUrlCacheEntryW InternetCrackUrlW InternetQueryOptionW InternetSetOptionW InternetGetLastResponseInfoW FtpCommandW InternetWriteFile HttpEndRequestW FtpOpenFileW InternetReadFileExA InternetReadFile HttpQueryInfoW InternetCloseHandle InternetOpenW InternetConnectW InternetSetOptionA HttpOpenRequestW HttpSendRequestExW

Name

.text

Size

452KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

81KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1012KB

Virtual Size

1011KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

103KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=3, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=95, version=2179,

count=3, id=199, version=41118,

count=40, id=223, productName=VS2013 build 21005, version=21005,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=250, id=224, productName=VS2013 build 21005, version=21005,

count=8, id=225, version=20806,

count=146, id=225, productName=VS2013 build 21005, version=21005,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=370, id=1, productName=Unmarked objects,

count=72, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,