2026-09-29_1a6a966bbc99827a9efe84526b1b68d3_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_1a6a966bbc99827a9efe84526b1b68d3_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat
Size 8.4MB
Sample260930-fg9llstvgw
SHA256 4141dbc6b6ac8000862fc7a7dc5d5c44943d4dd557ca32c71712d3acfd9d9f23
MD5 1a6a966bbc99827a9efe84526b1b68d3
SHA1 9f21dcfe7e4a01d25726354eab05c35991c7c34f
SHA512 a914964ad9412b0d0eeb15f62f5071216ea1662e6c61ad0cf570e3cd4db3df58d6afe133eba4b5f8f5a514c2597c4aee4e7371d2dba908219a6a74875461fe3f
SSDEEP 98304:kJ5o2kdAUIuYKrOeIkQNUUm7DkiCp0G2EY9NfbZh81jAa0rUAMIucjcfqk/:OipdAfuhjQ47Dks+Afv8xxKlGZ
TLSH
T17496D061B643C172D9C201F15929EBBA893CAD355B2504C7F3D07F69B9322C22A37A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-29_1a6a966bbc99827a9efe84526b1b68d3_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat

.exe 8.4MB

2026-09-29_1a6a966bbc99827a9efe84526b1b68d3_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat

IMPHASH 91470bda703c7f3c7a7e38d6feddff0f
SHA256 4141dbc6b6ac8000862fc7a7dc5d5c44943d4dd557ca32c71712d3acfd9d9f23
MD5 1a6a966bbc99827a9efe84526b1b68d3
SHA1 9f21dcfe7e4a01d25726354eab05c35991c7c34f
SHA512 a914964ad9412b0d0eeb15f62f5071216ea1662e6c61ad0cf570e3cd4db3df58d6afe133eba4b5f8f5a514c2597c4aee4e7371d2dba908219a6a74875461fe3f
SSDEEP 98304:kJ5o2kdAUIuYKrOeIkQNUUm7DkiCp0G2EY9NfbZh81jAa0rUAMIucjcfqk/:OipdAfuhjQ47Dks+Afv8xxKlGZ
TLSH
T17496D061B643C172D9C201F15929EBBA893CAD355B2504C7F3D07F69B9322C22A37A5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

84:2b:88:37:e6:6f:35:be:fa:f2:5a:b0:0f:12:39:59:8a:22:b1:81:5b:7e:79:73:ed:7d:ae:60:05:c9:22:97

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1417258-2,CN=7270356 CANADA INC.,O=7270356 CANADA INC.,L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

Sep 4, 2026

SERIALNUMBER=1417258-2,CN=7270356 CANADA INC.,O=7270356 CANADA INC.,L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=1417258-2,CN=7270356 CANADA INC.,O=7270356 CANADA INC.,L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=1417258-2,CN=7270356 CANADA INC.,O=7270356 CANADA INC.,L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Serial Number

07:52:04:ca:a6:0e:a3:70:ea:53:b8:75:2f:9c:13:8a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 11, 2026 - May 10, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2128368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\de-utilities-builder-1\4\s\_build\bin\x86\Release\installer.pdb

wininet

InternetCanonicalizeUrlW

shell32

ShellExecuteExW SHGetFolderPathW

kernel32

GetCurrentProcess GetComputerNameW DecodePointer GetSystemInfo GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW SetEvent CreateEventA LocalFree FormatMessageW FormatMessageA Sleep AllocConsole SleepEx LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection InitializeCriticalSectionEx WaitForSingleObject CloseHandle CreateMutexW LCMapStringA LoadLibraryA HeapQueryInformation TryEnterCriticalSection HeapCreate GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA DeleteFileA GetNativeSystemInfo HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize SystemTimeToFileTime GetSystemTime CreateFileMappingW WaitForSingleObjectEx IsDBCSLeadByteEx IsValidCodePage GetLocaleInfoA EnumSystemLocalesA FoldStringW LCMapStringW CompareStringW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW ReleaseSemaphore OpenEventA ResetEvent WaitForMultipleObjectsEx GetProcessHeap HeapAlloc HeapFree QueryPerformanceCounter QueryPerformanceFrequency SetWaitableTimer ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleA CreateWaitableTimerA WriteConsoleW GetStringTypeExA DeleteFileW FindFirstFileW GetFileAttributesW GetFileAttributesExW SetFileAttributesW GetTickCount GetFileSizeEx GetFileType GetFileTime ReadFile SetFilePointerEx FileTimeToSystemTime GetExitCodeThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle GetTempPathW CreateFile2 AreFileApisANSI DeviceIoControl CopyFile2 CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW RaiseException InitOnceComplete InitOnceBeginInitialize FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW ReleaseSRWLockShared AcquireSRWLockShared SetLastError LoadLibraryExW EncodePointer LCMapStringEx GetEnvironmentVariableA GetCPInfo IsProcessorFeaturePresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwind InterlockedPushEntrySList FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess TerminateProcess GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime CreateThread ExitThread FreeLibraryAndExitThread SetStdHandle UnhandledExceptionFilter GetCurrentThread VirtualProtect IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetConsoleOutputCP FlushFileBuffers ReadConsoleW HeapReAlloc GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize SetEndOfFile CreateSemaphoreA DuplicateHandle GetStringTypeExW ProcessIdToSessionId GlobalFree CreateJobObjectW CreateIoCompletionPort SetInformationJobObject AssignProcessToJobObject GetQueuedCompletionStatus GetExitCodeProcess CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess VerifyVersionInfoW WaitForMultipleObjects MapViewOfFile GetUserDefaultLCID GetCommandLineW MoveFileExW OutputDebugStringA OutputDebugStringW SizeofResource LockResource LoadResource FindResourceW SetUnhandledExceptionFilter GetLastError GetCurrentThreadId GetConsoleMode GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleA WriteFile GetCurrentProcessId FreeLibrary GetProcAddress LoadLibraryW MultiByteToWideChar WideCharToMultiByte CreateFileW CompareStringEx

user32

LoadStringW PostMessageW LoadStringA SetWindowTextW SendMessageW LoadIconW MessageBoxW

advapi32

GetUserNameW RegOpenKeyExW RegSetValueExW RegCreateKeyExW QueryServiceStatusEx RegOpenUserClassesRoot OpenThreadToken RegOpenCurrentUser RegEnumValueW RegQueryInfoKeyW DeleteService OpenServiceW OpenSCManagerW CloseServiceHandle RegDeleteTreeW RegDeleteValueW RegGetValueW LookupAccountSidW ConvertStringSidToSidW RegCloseKey CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt GetTokenInformation OpenProcessToken RevertToSelf ImpersonateLoggedOnUser RegQueryValueExW

ole32

CoInitializeSecurity CoCreateInstance CoInitializeEx CoUninitialize CoSetProxyBlanket

oleaut32

SysFreeString SysAllocString VariantInit VariantClear SysAllocStringLen VariantTimeToSystemTime SysStringLen VariantCopy

shlwapi

SHDeleteKeyW

msi

ord190 ord70 ord118 ord141 ord115 ord281 ord116 ord205

winhttp

WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpSetTimeouts WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser

bcrypt

BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDeriveKeyPBKDF2

ntdll

VerSetConditionMask

ws2_32

sendto htonl gethostname recvfrom listen ntohs WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent ioctlsocket WSASetLastError setsockopt send recv getsockopt getsockname getpeername connect bind accept socket htons closesocket WSAGetLastError freeaddrinfo getaddrinfo select __WSAFDIsSet WSACleanup WSAIoctl WSAStartup

crypt32

CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertFreeCertificateChain CertOpenStore CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertGetCertificateChain CryptQueryObject CertGetNameStringW CertFindExtension CertFreeCTLContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceW

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

884KB

Virtual Size

883KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

152KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_1a6a966bbc99827a9efe84526b1b68d3_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat

wininet

shell32

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

msi

winhttp

bcrypt

ntdll

ws2_32

crypt32

iphlpapi

secur32

wtsapi32

generic