2026-09-29_5545d9c6de4d0c60946018bfc48666a8_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_5545d9c6de4d0c60946018bfc48666a8_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos
Size 4.0MB
Sample260930-a64trsvbjf
SHA256 816eb24f3ea0512707a134c4329823ad914c4222a6d6e319ffb3ae1f10181bc1
MD5 5545d9c6de4d0c60946018bfc48666a8
SHA1 fe6d126fd9d8a4073dbd399356b75e41b1eebfe9
SHA512 fea7beea974c963bc2f4c7845ff1f0285aa7c19c4ccbe376b6953b0925302dc8d4cac7431299c74efc63bf049e5853aafbb6e22fe6db6eebb826b450ca88bfee
SSDEEP 49152:nZ8WmWTlNcQGHql7WR33DrChEgCegWR7k0N5cDeuUSZ1xt1iATS2LaRyjwYWlksa:nZN5IvHm78WEPz0N6twY2s80
TLSH
T1B8168D3277E5843AF2B317306D39B65E457DBE711C72C90F63981A4E2A70DC1AA2172B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_5545d9c6de4d0c60946018bfc48666a8_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos

File Explorer

2026-09-29_5545d9c6de4d0c60946018bfc48666a8_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos

.exe 4.0MB

2026-09-29_5545d9c6de4d0c60946018bfc48666a8_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos

IMPHASH 490facefae50f2f7b4857c09b3038ae1
SHA256 816eb24f3ea0512707a134c4329823ad914c4222a6d6e319ffb3ae1f10181bc1
MD5 5545d9c6de4d0c60946018bfc48666a8
SHA1 fe6d126fd9d8a4073dbd399356b75e41b1eebfe9
SHA512 fea7beea974c963bc2f4c7845ff1f0285aa7c19c4ccbe376b6953b0925302dc8d4cac7431299c74efc63bf049e5853aafbb6e22fe6db6eebb826b450ca88bfee
SSDEEP 49152:nZ8WmWTlNcQGHql7WR33DrChEgCegWR7k0N5cDeuUSZ1xt1iATS2LaRyjwYWlksa:nZN5IvHm78WEPz0N6twY2s80
TLSH
T1B8168D3277E5843AF2B317306D39B65E457DBE711C72C90F63981A4E2A70DC1AA2172B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1851317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

d:\dbs\el\o7\target\x86\ship\click2run\en-us\SetupBootstrapper.pdb

advapi32

OpenProcessToken GetTokenInformation RegCreateKeyExW RegOpenKeyExW RegCloseKey EventWrite EventWriteTransfer EventRegister EventUnregister RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegSetValueExW RegDeleteValueW AllocateAndInitializeSid FreeSid EqualSid CreateWellKnownSid IsValidSid GetSidSubAuthorityCount GetSidSubAuthority RevertToSelf OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW GetLengthSid CopySid InitializeAcl AddAccessAllowedAce InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertSidToStringSidA CheckTokenMembership RegNotifyChangeKeyValue

kernel32

CreateMutexW WideCharToMultiByte InitializeCriticalSectionEx DeleteCriticalSection MultiByteToWideChar AttachConsole GetStdHandle WriteConsoleW GetCommandLineW GlobalMemoryStatusEx GetNativeSystemInfo RaiseException DecodePointer QueryPerformanceFrequency GetSystemTimeAsFileTime QueryPerformanceCounter GetProcessTimes GetCurrentThread GetThreadTimes CreateDirectoryW FindFirstFileW GetFullPathNameW FindNextFileW DeviceIoControl RemoveDirectoryW SetEndOfFile FindClose CreateFileW GetFileAttributesW SetFileAttributesW GetFileAttributesExW GetDiskFreeSpaceExW DeleteFileW SetFilePointerEx MoveFileExW CopyFileW AreFileApisANSI UnmapViewOfFile CreateFileMappingA MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LCMapStringW FreeLibrary FormatMessageA GetCurrentThreadId FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetTickCount64 GetModuleHandleExW K32GetProcessMemoryInfo LeaveCriticalSection EnterCriticalSection ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeSRWLock FileTimeToSystemTime GetUserDefaultLocaleName IsValidCodePage SystemTimeToFileTime GetCPInfoExW CreateEventExW GetStringTypeW LoadLibraryExW VerSetConditionMask VerifyVersionInfoW GetVersionExW TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW FindResourceW SizeofResource LoadResource OpenProcess GetComputerNameW FormatMessageW GetLogicalProcessorInformation GetSystemDirectoryW ReleaseMutex GetCurrentProcessId WaitForSingleObjectEx ExpandEnvironmentStringsW GlobalFree ProcessIdToSessionId GetExitCodeThread WaitForMultipleObjects WaitForMultipleObjectsEx SignalObjectAndWait GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace ReadFile GetFileSizeEx GetTempPathW GetTempFileNameW GetTickCount GetThreadLocale SetEvent FindFirstFileExW lstrcmpW CompareFileTime GetFileType WriteFile GetOverlappedResult SetFileInformationByHandle GetFileInformationByHandleEx GetDriveTypeW SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime GetLongPathNameW ReleaseSemaphore OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA GlobalAlloc LocalAlloc HeapAlloc GetPriorityClass GetExitCodeProcess GetTimeZoneInformation IsValidLocale QueryUnbiasedInterruptTime LCMapStringEx CreateEventW WaitForSingleObject CreateThread CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork ResetEvent VirtualProtectEx GetSystemInfo LockResource FlushFileBuffers CancelIoEx LCIDToLocaleName LocaleNameToLCID GetSystemDefaultLCID WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus IsDebuggerPresent CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic OutputDebugStringW VirtualFree VirtualAlloc GetProductInfo SwitchToThread LoadLibraryExA VirtualQuery SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP SetStdHandle EnumSystemLocalesW ExitProcess HeapReAlloc GetACP HeapSize GetConsoleCP GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwind GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount GetCurrentProcess GetProcessHeap HeapFree LocalFree CompareStringEx EncodePointer DuplicateHandle GetDateFormatW GetTimeFormatW DeleteTimerQueueTimer CreateTimerQueueTimer GetUserGeoID OutputDebugStringA GetModuleFileNameW SetLastError LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetLastError IsWow64Process CloseHandle GetLocalTime

ole32

CoRevokeInitializeSpy CoRegisterInitializeSpy CreateStreamOnHGlobal CoTaskMemAlloc CoCreateFreeThreadedMarshaler IIDFromString CoCreateInstance CoSetProxyBlanket CoTaskMemFree CLSIDFromString StringFromGUID2 CoCreateGuid CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

cabinet

ord13 ord14

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

setupapi

SetupIterateCabinetW

gdi32

GetDeviceCaps

rpcrt4

UuidToStringW RpcStringFreeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_5545d9c6de4d0c60946018bfc48666a8_darkgate_elex_floxif_glassworm_luca-stealer_magniber_njrat_remcos

advapi32

kernel32

ole32

oleaut32

cabinet

wintrust

setupapi

gdi32

rpcrt4

generic