2026-10-11_54052544f2cf7abcedb4849f7a2f8f91_darkgate_elex_glassworm_maze_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_54052544f2cf7abcedb4849f7a2f8f91_darkgate_elex_glassworm_maze_remcos
Size 3.6MB
Sample261012-1dcspaa17n
SHA256 f375db375165d313a3e2070b0bcd99c4772d843e4bbd07811f031cefb3839cec
MD5 54052544f2cf7abcedb4849f7a2f8f91
SHA1 48963224f9c4c0d384ee7a26ef8192ed15f73e7b
SHA512 aa08e30215194f4e342471dc47ca7f61dbb4f8a012378b8526d855e7713f10b1d4489e0a8ce0ba2406da7910410793dad4eff30c6dbd0df25797f1df6559c679
SSDEEP 49152:njpKotCJyMFf1Nbe/GWc/nmWWoVrf7usG/HZ7aGgoYgq7uTJWybN2M1CwQ3LNtGF:nIbc4vW6VGhzFq7uT5x2M6Ntq
TLSH
T1F1061241BBC1C133D97201716ABC67B9803CBDA5473969C7E3C93F1E29785C22E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_54052544f2cf7abcedb4849f7a2f8f91_darkgate_elex_glassworm_maze_remcos

File Explorer

2026-10-11_54052544f2cf7abcedb4849f7a2f8f91_darkgate_elex_glassworm_maze_remcos

.exe 3.6MB

2026-10-11_54052544f2cf7abcedb4849f7a2f8f91_darkgate_elex_glassworm_maze_remcos

IMPHASH 0c1134638e02784255eb824c487017d8
SHA256 f375db375165d313a3e2070b0bcd99c4772d843e4bbd07811f031cefb3839cec
MD5 54052544f2cf7abcedb4849f7a2f8f91
SHA1 48963224f9c4c0d384ee7a26ef8192ed15f73e7b
SHA512 aa08e30215194f4e342471dc47ca7f61dbb4f8a012378b8526d855e7713f10b1d4489e0a8ce0ba2406da7910410793dad4eff30c6dbd0df25797f1df6559c679
SSDEEP 49152:njpKotCJyMFf1Nbe/GWc/nmWWoVrf7usG/HZ7aGgoYgq7uTJWybN2M1CwQ3LNtGF:nIbc4vW6VGhzFq7uT5x2M6Ntq
TLSH
T1F1061241BBC1C133D97201716ABC67B9803CBDA5473969C7E3C93F1E29785C22E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

475694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\project_sign_file\360Game\src\setup\installer\bin\Release\uninst.pdb

kernel32

InterlockedExchange SetLastError TerminateThread SuspendThread FlushInstructionCache GetCurrentProcess GetExitCodeProcess MoveFileW WideCharToMultiByte TerminateProcess OpenProcess GetPrivateProfileIntW FindNextFileW RemoveDirectoryW FindClose FindFirstFileW GetPrivateProfileStringW CreateThread Sleep GetTickCount MoveFileExW CopyFileW GetFileAttributesW SetFileAttributesW GetLongPathNameW lstrcmpiW GetCurrentThreadId CreateMutexW GetLocalTime WritePrivateProfileStringW DecodePointer GetTempFileNameW GetTempPathW DeleteFileW RaiseException InitializeCriticalSectionAndSpinCount WaitForSingleObject SetEvent InterlockedDecrement InterlockedIncrement CreateEventW MultiByteToWideChar LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection LocalFree GetLastError CreateProcessW LoadLibraryW GetModuleFileNameW GetCurrentProcessId CloseHandle DeviceIoControl CreateFileW FindResourceExW FindResourceW LoadResource LockResource SizeofResource FreeLibrary LoadLibraryExW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy LoadLibraryExA VirtualQuery VirtualProtect SetThreadContext GetThreadContext ResumeThread ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock GetSystemTime FormatMessageW GetFileSizeEx LocalFileTimeToFileTime SystemTimeToFileTime CreateFileA SetEnvironmentVariableA WriteConsoleW FlushFileBuffers SetStdHandle GetConsoleCP GetCurrentThread GetProcAddress FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTimeZoneInformation GetFileType GetStdHandle ReadConsoleW GetConsoleMode SetFilePointerEx GetModuleHandleExW ExitProcess GetOEMCP GetACP IsValidCodePage GetStartupInfoW SetUnhandledExceptionFilter GetModuleHandleW GetWindowsDirectoryW UnhandledExceptionFilter EnumSystemLocalesW GetUserDefaultLCID IsValidLocale IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree GetStringTypeW EncodePointer WriteFile lstrlenW TlsAlloc TlsFree TlsGetValue TlsSetValue VerifyVersionInfoW VerSetConditionMask GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetFileSize ReadFile MulDiv FreeResource GetVersionExW WaitForMultipleObjects GetSystemTimeAsFileTime ExitThread GetCommandLineW RtlUnwind GetCPInfo GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

user32

AttachThreadInput IsZoomed ClientToScreen SetWindowRgn InflateRect ScreenToClient IsRectEmpty InvalidateRect UnionRect SetRectEmpty UpdateLayeredWindow SetCursor TrackMouseEvent IsChild GetCursorPos IntersectRect GetCaretBlinkTime EqualRect CopyRect GetFocus SetCapture ReleaseCapture PtInRect DrawTextW SwitchToThisWindow SystemParametersInfoW OffsetRect SetClassLongW SetRect CharLowerBuffW CharLowerW MonitorFromRect GetSysColor IsClipboardFormatAvailable OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetClipboardData GetWindowThreadProcessId MapVirtualKeyW GetKeyNameTextW DrawIcon DrawIconEx GetIconInfo MonitorFromPoint GetAncestor SubtractRect RegisterClipboardFormatW HideCaret GetAsyncKeyState GetForegroundWindow IsIconic SetWindowPos GetWindowRect PostQuitMessage BeginPaint SetFocus CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW IsWindowVisible SetForegroundWindow BringWindowToTop FindWindowW DestroyWindow MessageBoxW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW KillTimer SendMessageW GetSystemMetrics LoadImageW SetWindowTextW SetTimer GetKeyState PostMessageW EnableWindow GetWindow MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints CallWindowProcW GetWindowLongW SetWindowLongW ShowWindow UnregisterClassW GetParent ReleaseDC GetDC IsWindow DefWindowProcW EndPaint FillRect WindowFromPoint

gdi32

IntersectClipRect SetBkColor ExtTextOutW SelectClipRgn SetROP2 MoveToEx LineTo RectVisible SaveDC RestoreDC GetDeviceCaps GetTextExtentPoint32W CreateRoundRectRgn CombineRgn GetClipBox BitBlt StretchBlt CreateFontW GetObjectA SetTextColor CreateCompatibleBitmap ExcludeClipRect GetTextMetricsW CreatePen CreateSolidBrush Rectangle RoundRect GetStockObject CreateDCW GetDIBits GetBitmapBits SetBitmapBits GetCurrentObject SetStretchBltMode DeleteDC GetObjectW CreateFontIndirectW SetViewportOrgEx CreateCompatibleDC SelectObject CreateRectRgn DeleteObject CreateDIBSection SetBkMode

advapi32

RegQueryValueExA RegQueryValueExW RegEnumValueW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

CommandLineToArgvW ShellExecuteExW SHGetSpecialFolderPathW SHChangeNotify SHGetFolderPathW ShellExecuteW

ole32

CoTaskMemRealloc CoTaskMemFree CoInitialize CoUninitialize CoTaskMemAlloc CoCreateInstance

oleaut32

VarUI4FromStr

shlwapi

SHDeleteValueW SHDeleteKeyW PathUnquoteSpacesW PathRemoveArgsW PathGetArgsW PathAppendW PathMatchSpecW PathFindFileNameW SHGetValueW PathIsDirectoryW PathFileExistsW PathRemoveFileSpecW PathAddBackslashW

comctl32

InitCommonControlsEx

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoW HttpSendRequestW HttpAddRequestHeadersW InternetOpenW HttpOpenRequestW DeleteUrlCacheEntryW InternetConnectW InternetSetOptionW InternetCrackUrlW

Name

.text

Size

607KB

Virtual Size

607KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

56KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

802KB

Virtual Size

804KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=3, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=2, id=199, version=41118,

count=31, id=223, productName=VS2013 build 21005, version=21005,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=235, id=224, productName=VS2013 build 21005, version=21005,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=85, id=225, productName=VS2013 build 21005, version=21005,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=529, id=1, productName=Unmarked objects,

count=130, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,