General

  • Target
    2026-10-04_ae38af004eaa3068499e0079aa307546_acrstealer_darkgate_elex_floxif_gcleaner_glassworm_helldown_hijackloader
  • Size 9.7MB
  • Sample261005-gkbdnavbnd
  • SHA256 c4a953426052a2f139303ae6d9cd49e777718c737a3fb2141b5b95583be38bf4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

File Explorer

  • 2026-10-04_ae38af004eaa3068499e0079aa307546_acrstealer_darkgate_elex_floxif_gcleaner_glassworm_helldown_hijackloader
    .exe 9.7MB

2026-10-04_ae38af004eaa3068499e0079aa307546_acrstealer_darkgate_elex_floxif_gcleaner_glassworm_helldown_hijackloader

  • IMPHASH 311fc786b7812b848f4d95e9ad039fe8
  • SHA256 c4a953426052a2f139303ae6d9cd49e777718c737a3fb2141b5b95583be38bf4
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Codesign digest Mismatch

    File was altered after it was signed.

PE Signature issue

Digest
da:c9:70:9c:79:53:f6:3a:99:45:bb:27:14:e2:60:0a:aa:5b:b9:a4:ed:c9:43:d9:da:90:6e:f6:b3:d9:74:1d
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=200204019,CN=VS Revo Group Ltd.,O=VS Revo Group Ltd.,L=Ruse,C=BG,1.3.6.1.4.1.311.60.2.1.3=#13024247,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains

Jan 1, 0001

PE Signature issue

Digest
ab:71:9f:ec:ef:6a:fd:e0:51:33:02:42:57:ba:06:19:70:79:1c:02
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=200204019,CN=VS Revo Group Ltd.,O=VS Revo Group Ltd.,L=Ruse,C=BG,1.3.6.1.4.1.311.60.2.1.3=#13024247,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains

Jan 1, 0001

Minor OS version
0
Major OS version
5
Entry point
6205856
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI
PDB paths