2026-10-10_b71de99e1c1e366671b1b46b890f6ad1_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_trigona

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_b71de99e1c1e366671b1b46b890f6ad1_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_trigona
Size 4.2MB
Sample261011-e7qqrax13k
SHA256 097254c4c1d36a6e8763a711a55e5918819f411f4b6327d4123b3b042c907ac4
MD5 b71de99e1c1e366671b1b46b890f6ad1
SHA1 6823b6f6f6108a91058d53ff313e82badde3f3d2
SHA512 b44466b088a26662d3ee7defb21bf10f6c5ff5a1425f7b4a76b91f9c48904ad0672b318880587580f1988398a6a3cf226001a7039dfd75ef8591f694ce62f602
SSDEEP 49152:0pJ4a0hu8bGVwS+3kT2660HNkcWqwiQFL/T1Nj3x9UaL5MPYgvH:0nCfgA/bUQlI
TLSH
T132266C2373C7917AF0670A3ADDB6D7A1583E7DE0961AAC1AABEC744C4F352C01C25B46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-10_b71de99e1c1e366671b1b46b890f6ad1_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_trigona

.exe 4.2MB

2026-10-10_b71de99e1c1e366671b1b46b890f6ad1_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_trigona

IMPHASH 876e6b71329bafd39dc10ba7b4f47e77
SHA256 097254c4c1d36a6e8763a711a55e5918819f411f4b6327d4123b3b042c907ac4
MD5 b71de99e1c1e366671b1b46b890f6ad1
SHA1 6823b6f6f6108a91058d53ff313e82badde3f3d2
SHA512 b44466b088a26662d3ee7defb21bf10f6c5ff5a1425f7b4a76b91f9c48904ad0672b318880587580f1988398a6a3cf226001a7039dfd75ef8591f694ce62f602
SSDEEP 49152:0pJ4a0hu8bGVwS+3kT2660HNkcWqwiQFL/T1Nj3x9UaL5MPYgvH:0nCfgA/bUQlI
TLSH
T132266C2373C7917AF0670A3ADDB6D7A1583E7DE0961AAC1AABEC744C4F352C01C25B46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

fb:e1:7e:a1:1e:a2:cd:a8:d7:55:41:1b:22:71:5b:6e:c1:8b:36:41:68:a7:5e:87:4a:1a:65:92:44:94:9f:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=20-19141896-5,CN=PARKHOMENKO\, VASILII,O=PARKHOMENKO\, VASILII,L=Nordelta,ST=Buenos Aires Province,C=AR,1.3.6.1.4.1.311.60.2.1.3=#13024152,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 19, 2026

CN=SSL.com EV Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

Serial Number

08:7d:07:1c:cb:a1:90:5e:6d:97:79:69:65:da:43:4a

Issuer

CN=SSL.com EV Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 1, 2026 - Mar 1, 2027

Subject

CN=SSL.com EV Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6e:dd:4f:25:e7:31:7d:39:81:57:31:34:cf:c1:dc:a0

Issuer

CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2019 - Mar 3, 2034

Subject

CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

2c:29:9c:5b:16:ed:05:95

Issuer

CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 12, 2016 - Feb 12, 2041

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

3581892

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

shell32

SHGetFileInfoW SHGetDesktopFolder SHGetSpecialFolderLocation Shell_NotifyIconW SHGetSpecialFolderPathW SHAppBarMessage SHGetPathFromIDListW

user32

CopyImage SetMenuItemInfoW GetMenuItemInfoW SetCaretPos GetCaretPos DefFrameProcW GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect SendMessageA EnumWindows ShowOwnedPopups GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW EnumChildWindows GetScrollBarInfo UnhookWindowsHookEx SetCapture GetCapture ShowCaret CreatePopupMenu GetMenuItemID CharLowerBuffW ChangeDisplaySettingsW PostMessageW SetWindowLongW IsZoomed SetParent DrawMenuBar GetClientRect IsChild IsIconic CallNextHookEx ShowWindow GetWindowTextW SetForegroundWindow IsDialogMessageW DestroyWindow RegisterClassW EndMenu CharNextW GetFocus GetDC SetFocus ReleaseDC GetClassLongW SetScrollRange DrawTextW PeekMessageA MessageBeep SetClassLongW RemovePropW GetSubMenu DestroyIcon IsWindowVisible DispatchMessageA UnregisterClassW GetTopWindow SendMessageW LoadStringW CreateMenu CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW CharLowerBuffA GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetSysColors SetMenu GetMenuState GetMenu SetRect GetKeyState ValidateRect GetCursor KillTimer WaitMessage TranslateMDISysAccel GetWindowPlacement CreateIconIndirect CreateWindowExW GetMessageW GetDCEx PeekMessageW MonitorFromWindow GetUpdateRect SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW MapVirtualKeyW IsWindowUnicode DispatchMessageW CreateAcceleratorTableW DefMDIChildProcW GetSystemMenu SetScrollPos GetScrollPos DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup GetSystemMetrics CharUpperBuffW SetClipboardData GetClipboardData ClientToScreen SetWindowPlacement SetCaretBlinkTime GetCaretBlinkTime GetMonitorInfoW CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW EnumDisplaySettingsW ActivateKeyboardLayout GetParent MonitorFromRect InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW GetDoubleClickTime EmptyClipboard AdjustWindowRectEx IsWindow DrawIcon EnumThreadWindows InvalidateRect SetKeyboardState GetKeyboardState ScreenToClient DrawFrameControl SetCursor CreateIcon GetDialogBaseUnits RemoveMenu GetKeyboardLayoutNameW OpenClipboard TranslateMessage MapWindowPoints EnumDisplayMonitors CallWindowProcW CloseClipboard DestroyCursor CharUpperBuffA CopyIcon PostQuitMessage ShowScrollBar EnableMenuItem HideCaret FindWindowExW MonitorFromPoint LoadIconW SystemParametersInfoW GetWindow GetWindowRect GetWindowLongW InsertMenuW PostThreadMessageW IsWindowEnabled IsDialogMessageA FindWindowW GetKeyboardLayout DeleteMenu

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SafeArrayPutElement GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantCopyInd VariantChangeType

advapi32

CloseServiceHandle RegSetValueExW RegSetValueExA RegConnectRegistryW CreateServiceW StartServiceCtrlDispatcherW GetUserNameW LookupAccountNameW DeregisterEventSource RegQueryInfoKeyW SetServiceStatus RegUnLoadKeyW RegSaveKeyW DeleteService RegReplaceKeyW RegisterEventSourceW GetTokenInformation LookupAccountSidW RegCreateKeyExW SetSecurityDescriptorDacl RegisterServiceCtrlHandlerW OpenServiceW RegLoadKeyW RegEnumKeyExW RegDeleteKeyW OpenSCManagerW RegOpenKeyExW RegOpenKeyExA OpenProcessToken RegDeleteValueW ReportEventW RegFlushKey RegQueryValueExW RegQueryValueExA RegEnumValueW InitializeSecurityDescriptor RegCloseKey RegRestoreKeyW

msvcrt

isupper isalpha isalnum toupper memchr memcmp memcpy memset isprint isspace iscntrl isxdigit ispunct isgraph islower tolower

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

kernel32

GetFileType GetACP GetStringTypeExW CloseHandle LocalFree GetCurrentProcessId SizeofResource QueryPerformanceFrequency IsDebuggerPresent GetFullPathNameW VirtualFree GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW GetSystemTime RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetTimeZoneInformation DisconnectNamedPipe SetSystemTime GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW lstrlenA CreateThread CompareStringW LoadLibraryA GetVolumeInformationW ResetEvent MulDiv FreeResource GetVersion RaiseException MoveFileW GlobalAddAtomW FormatMessageW OpenProcess SwitchToThread GetExitCodeThread GetCurrentThread IsBadReadPtr ExpandEnvironmentStringsW LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter GlobalFindAtomW VirtualQuery GlobalFree VirtualQueryEx Sleep EnterCriticalSection SetFilePointer ReleaseMutex FlushFileBuffers GetStringTypeExA LoadResource SuspendThread GetTickCount GetFileSize GlobalDeleteAtom GetStartupInfoW GetFileAttributesW SetCurrentDirectoryW GetCurrentDirectoryW InitializeCriticalSection VerLanguageNameW GetThreadPriority GetCurrentProcess SetThreadPriority GlobalLock VirtualAlloc GetTempPathW GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage GetConsoleOutputCP GetConsoleCP lstrlenW CompareStringA QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar CreateMutexA LoadLibraryW SetEvent GetLocaleInfoW CreateFileW EnumResourceNamesW GetSystemDirectoryW IsDBCSLeadByteEx ConnectNamedPipe GetEnvironmentVariableW GetLocalTime WaitForSingleObject GetSystemPowerStatus GetOEMCP WriteFile CreateNamedPipeW ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW SetComputerNameW IsValidLocale SleepEx TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc CreateEventW WaitForMultipleObjectsEx GetThreadLocale SetThreadLocale

wsock32

WSAStartup WSACleanup gethostbyname gethostname inet_ntoa

ole32

IsEqualGUID OleInitialize CoGetMalloc OleUninitialize CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemAlloc

iphlpapi

GetAdaptersAddresses

gdi32

Pie SetBkMode CreateCompatibleBitmap GetEnhMetaFileHeader RectVisible AngleArc SetAbortProc SetTextColor StretchBlt RoundRect RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx CreatePalette PolyBezierTo CreateICW CreateDCW GetStockObject CreateSolidBrush Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits GetEnhMetaFilePaletteEntries CreatePenIndirect CreateFontIndirectW PolyBezier EndDoc GetObjectW GetWinMetaFileBits SetROP2 GetEnhMetaFileDescriptionW ArcTo Arc SelectPalette ExcludeClipRect MaskBlt SetWindowOrgEx EndPage DeleteEnhMetaFile Chord SetDIBits SetViewportOrgEx SetPixelFormat CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect PatBlt SetEnhMetaFileBits ChoosePixelFormat Rectangle SaveDC DeleteDC FrameRgn BitBlt GetDeviceCaps GetTextExtentPoint32W GetClipBox IntersectClipRect Polyline CreateBitmap SetWinMetaFileBits CombineRgn GetStretchBltMode CreateDIBitmap SetStretchBltMode GetDIBits CreateDIBSection LineTo GetRgnBox EnumFontsW CreateHalftonePalette SelectObject DeleteObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetBrushOrgEx GetCurrentPositionEx GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetPixel EnumFontFamiliesExW StretchDIBits GetPaletteEntries

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

547KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

88B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

286KB

Virtual Size

285KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

378KB

Virtual Size

378KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_b71de99e1c1e366671b1b46b890f6ad1_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_trigona

winspool.drv

comctl32

shell32

user32

version

oleaut32

advapi32

msvcrt

wtsapi32

kernel32

wsock32

ole32

iphlpapi

gdi32

generic