2026-10-02_ead384f529916efbafc61ef1d57f509d_darkgate_elex_floxif_glassworm_hijackloader_maze_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_ead384f529916efbafc61ef1d57f509d_darkgate_elex_floxif_glassworm_hijackloader_maze_stealc
Size 2.2MB
Sample261002-3br6psvepg
SHA256 7c47b10e8d41fcd2969dc20832f1dcd07168b914f98cedb99dbe3d88cac9473c
MD5 ead384f529916efbafc61ef1d57f509d
SHA1 2a7f67b0496118d75b58ed96f478dc039b106bcb
SHA512 57a5d4ae7bd0e1d90f3a061ce3867321d85eef017a3c18b00c1c026224715b474255319ff60f6f6ec50c188451637cf5b915a64f03791e0dd5debaf3252664a9
SSDEEP 49152:1MS0XRCBVQlIyLYGJ0mS072wE18vbcm3sYHjyyzxPR6q9gK+IUMphbZ3mcmYywJ:SS0XgBVQlIVGmmS072wE18vbcm8YHjbb
TLSH
T13FB58C25F700C032D85305B2A6AEA76E9978B530175964C3F3C11F6E7AE4AE37A35783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-02_ead384f529916efbafc61ef1d57f509d_darkgate_elex_floxif_glassworm_hijackloader_maze_stealc

File Explorer

2026-10-02_ead384f529916efbafc61ef1d57f509d_darkgate_elex_floxif_glassworm_hijackloader_maze_stealc

.exe 2.2MB

2026-10-02_ead384f529916efbafc61ef1d57f509d_darkgate_elex_floxif_glassworm_hijackloader_maze_stealc

IMPHASH 11bfc66b2c9d5ef8c58563fdc046c3ca
SHA256 7c47b10e8d41fcd2969dc20832f1dcd07168b914f98cedb99dbe3d88cac9473c
MD5 ead384f529916efbafc61ef1d57f509d
SHA1 2a7f67b0496118d75b58ed96f478dc039b106bcb
SHA512 57a5d4ae7bd0e1d90f3a061ce3867321d85eef017a3c18b00c1c026224715b474255319ff60f6f6ec50c188451637cf5b915a64f03791e0dd5debaf3252664a9
SSDEEP 49152:1MS0XRCBVQlIyLYGJ0mS072wE18vbcm3sYHjyyzxPR6q9gK+IUMphbZ3mcmYywJ:SS0XgBVQlIVGmmS072wE18vbcm8YHjbb
TLSH
T13FB58C25F700C032D85305B2A6AEA76E9978B530175964C3F3C11F6E7AE4AE37A35783
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a9:be:37:d7:84:11:fb:14:22:7a:c1:07:c0:4d:a7:bd:69:66:47:a9:5c:b3:28:5e:1f:81:8f:a7:89:cd:2e:66

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Hangzhou Hikvision Digital Technology Co.\, Ltd.,O=Hangzhou Hikvision Digital Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Chains

Nov 5, 2024

CN=Hangzhou Hikvision Digital Technology Co.\, Ltd.,O=Hangzhou Hikvision Digital Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=Hangzhou Hikvision Digital Technology Co.\, Ltd.,O=Hangzhou Hikvision Digital Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=Hangzhou Hikvision Digital Technology Co.\, Ltd.,O=Hangzhou Hikvision Digital Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Hangzhou Hikvision Digital Technology Co.\, Ltd.,O=Hangzhou Hikvision Digital Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Serial Number

3b:ad:0b:71:30:ff:8d:f6:6c:21:e8:aa

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2024 - Jun 27, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1063787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins_ci\workspace\Pack_Web_WebPlugins\WebLocalService\target\vs2013_win32\release\WebPluginService.pdb

ws2_32

freeaddrinfo ntohl inet_ntoa accept listen getsockopt send closesocket WSASetLastError __WSAFDIsSet socket bind getaddrinfo WSACleanup sendto setsockopt shutdown WSAGetLastError recvfrom WSAStartup connect ioctlsocket getsockname htons inet_addr getpeername htonl recv WSASend WSARecv WSAIoctl ntohs select

rpcrt4

UuidCreate

winmm

timeKillEvent timeEndPeriod

gdiplus

GdipFree GdipDeleteBrush GdiplusShutdown GdipCloneBrush GdipFillPolygonI GdipCreateSolidFill GdipAlloc GdipCreateFromHDC GdipSetSolidFillColor GdiplusStartup GdipDeletePen GdipDrawLineI GdipCreatePen1 GdipLoadImageFromStream GdipSaveImageToStream GdipGetImageHeight GdipFillPolygon GdipCombineRegionRectI GdipFillRegion GdipDrawImageRectI GdipLoadImageFromFile GdipDrawPolygon GdipDrawLines GdipSetPenColor GdipGetImageEncodersSize GdipDisposeImage GdipDeleteRegion GdipGetImageEncoders GdipCreateRegion GdipFillPieI GdipCloneImage GdipGetImageWidth GdipDeleteGraphics

slf

HIKSLF_WebProcess

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetCPInfo UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue CreateSemaphoreW GetModuleHandleW GetStartupInfoW TerminateProcess CreateEventW InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind LoadLibraryExW ExitThread CreateThread WriteFile CreateFileW GetLastError GetLocalTime CloseHandle GetModuleHandleA GetCurrentProcess CreateDirectoryW GetCurrentThread WideCharToMultiByte GetFileAttributesA GetEnvironmentVariableA MultiByteToWideChar CreateDirectoryA OutputDebugStringA GetDiskFreeSpaceExA HeapReAlloc HeapAlloc HeapFree GetProcessHeap InitializeCriticalSectionEx RaiseException HeapSize DecodePointer DeleteCriticalSection SetFileAttributesA lstrlenA lstrcpynA lstrcatA EnumSystemLocalesW FindClose FreeLibrary GetProcAddress LoadLibraryExA GetSystemTime MulDiv DeleteFileA CreateProcessA GetSystemDirectoryA GetModuleFileNameA CreateMutexA InitializeCriticalSection Sleep MoveFileA LoadLibraryA GetSystemInfo CreateFileA SetFilePointer ReadFile FlushFileBuffers GetFileType FindNextFileA GetFileInformationByHandle LocalFree TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError TlsGetValue WaitForSingleObject TlsSetValue SetThreadPriority GetCurrentThreadId TlsAlloc TlsFree DuplicateHandle QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime FileTimeToSystemTime GetTimeZoneInformation QueryPerformanceFrequency FileTimeToLocalFileTime SetWaitableTimer SetEvent ResetEvent WaitForMultipleObjects GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort CreateSemaphoreA ReleaseSemaphore IsDebuggerPresent IsProcessorFeaturePresent ExitProcess GetModuleHandleExW AreFileApisANSI SystemTimeToTzSpecificLocalTime GetCommandLineA GetStdHandle GetModuleFileNameW GetFileAttributesExW GetStringTypeW DeleteFileW IsValidCodePage GetACP GetOEMCP SetFilePointerEx GetConsoleCP GetConsoleMode ReadConsoleW FindFirstFileExW FindNextFileW GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW MoveFileExW OutputDebugStringW GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualAlloc VirtualFree VirtualProtect InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx SetStdHandle WriteConsoleW LoadLibraryW SetEndOfFile EncodePointer SetEnvironmentVariableA FindFirstFileA

user32

TranslateMessage LoadStringA PostQuitMessage RegisterClassExA GetMessageA GetWindowTextA BringWindowToTop GetWindowRgn SendMessageTimeoutA GetCursorPos EndPaint ClientToScreen SetCursor SetTimer GetWindowRect SetCapture KillTimer BeginPaint GetDC InvalidateRect ReleaseDC SetClassLongA IsWindow TranslateAcceleratorA ReleaseCapture SendMessageA GetClassNameA DrawTextW DrawTextA FrameRect WaitForInputIdle GetForegroundWindow FindWindowA DestroyWindow SetWindowPlacement LoadIconA SetParent GetClientRect SetFocus GetMonitorInfoA GetWindowPlacement SetWindowLongA GetWindowLongA CreateWindowExA MonitorFromWindow DefWindowProcA EndDialog LoadAcceleratorsA DispatchMessageA DialogBoxParamA PostMessageA RegisterDeviceNotificationA SetWindowPos ShowWindow GetParent WindowFromPoint UpdateWindow LoadCursorA RegisterClassA GetWindow MoveWindow FillRect SetWindowRgn EnumWindows

gdi32

Polyline SetStretchBltMode Ellipse CreateCompatibleBitmap CreateCompatibleDC StretchBlt PolyBezier DeleteDC BitBlt SetBkColor CreateRectRgn CreateRoundRectRgn CombineRgn MoveToEx Rectangle LineTo GetTextExtentPoint32W SetTextColor CreateFontA SetBkMode SelectObject CreateFontW CreatePen GetStockObject GetTextCharset GetDeviceCaps CreateSolidBrush DeleteObject

comdlg32

GetSaveFileNameA GetOpenFileNameA

advapi32

IsTextUnicode GetSecurityInfo

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteExA SHBrowseForFolderA ord680

ole32

CreateStreamOnHGlobal

??0CBaseProtocol@NetSDK@@QAE@ABV01@@Z ??0CCoreSignal@NetSDK@@QAE@ABV01@@Z ??0CCtrlCoreBase@NetSDK@@QAE@ABV01@@Z ??0CCycleBuffer@NetSDK@@QAE@ABV01@@Z ??0CDependLibLoader@NetSDK@@QAE@ABV01@@Z ??0CLinkAsyncIO@NetSDK@@QAE@ABV01@@Z ??0CLinkBase@NetSDK@@QAE@ABV01@@Z ??0CLinkTCP@NetSDK@@QAE@ABV01@@Z ??0CLinkTCPSocks5@NetSDK@@QAE@ABV01@@Z ??0CLongLinkPrivate@NetSDK@@QAE@ABV01@@Z ??0CLongLinkPrivateBase@NetSDK@@QAE@ABV01@@Z ??0CMemberBase@NetSDK@@QAE@ABV01@@Z ??0CMemberMgrBase@NetSDK@@QAE@ABV01@@Z ??0CMultiThreadControl@NetSDK@@QAE@ABV01@@Z ??0CObjectBase@NetSDK@@QAE@ABV01@@Z ??0CObjectBasePrivate@NetSDK@@QAE@ABV01@@Z ??0CRWLock@NetSDK@@QAE@ABV01@@Z ??0CRWLockGuard@NetSDK@@QAE@ABV01@@Z ??0CSSLTransInterface@NetSDK@@QAE@ABV01@@Z ??0CSSLTransInterface@NetSDK@@QAE@XZ ??1CSSLTransInterface@NetSDK@@UAE@XZ ??4CBaseProtocol@NetSDK@@QAEAAV01@ABV01@@Z ??4CCoreSignal@NetSDK@@QAEAAV01@ABV01@@Z ??4CCtrlCoreBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CCycleBuffer@NetSDK@@QAEAAV01@ABV01@@Z ??4CDependLibLoader@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkAsyncIO@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkTCP@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkTCPSocks5@NetSDK@@QAEAAV01@ABV01@@Z ??4CLongLinkPrivate@NetSDK@@QAEAAV01@ABV01@@Z ??4CLongLinkPrivateBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CMemberBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CMemberMgrBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CMultiThreadControl@NetSDK@@QAEAAV01@ABV01@@Z ??4CObjectBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CObjectBasePrivate@NetSDK@@QAEAAV01@ABV01@@Z ??4CRWLock@NetSDK@@QAEAAV01@ABV01@@Z ??4CSSLTransInterface@NetSDK@@QAEAAV01@ABV01@@Z ??4CXmlBase@NetSDK@@QAEAAV01@ABV01@@Z ??_7CBaseProtocol@NetSDK@@6B@ ??_7CCoreSignal@NetSDK@@6B@ ??_7CCtrlCoreBase@NetSDK@@6B@ ??_7CCycleBuffer@NetSDK@@6B@ ??_7CDependLibLoader@NetSDK@@6B@ ??_7CLinkAsyncIO@NetSDK@@6B@ ??_7CLinkBase@NetSDK@@6B@ ??_7CLinkTCP@NetSDK@@6B@ ??_7CLinkTCPSocks5@NetSDK@@6B@ ??_7CLongLinkPrivate@NetSDK@@6B@ ??_7CLongLinkPrivateBase@NetSDK@@6B@ ??_7CMemberBase@NetSDK@@6B@ ??_7CMemberMgrBase@NetSDK@@6B@ ??_7CMultiThreadControl@NetSDK@@6B@ ??_7CObjectBase@NetSDK@@6B@ ??_7CObjectBasePrivate@NetSDK@@6B@ ??_7CRWLock@NetSDK@@6B@ ??_7CRWLockGuard@NetSDK@@6B@ ??_7CSSLTransInterface@NetSDK@@6B@ ?Recv@CLinkBase@NetSDK@@UAEHABIPADH@Z ?SetAsyn@CBaseProtocol@NetSDK@@QAEXH@Z

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_ead384f529916efbafc61ef1d57f509d_darkgate_elex_floxif_glassworm_hijackloader_maze_stealc

PE Signature issue

ws2_32

rpcrt4

winmm

gdiplus

slf

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic