2026-10-11_42f3f367f12aac75b1e6fd15245ac75c_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_42f3f367f12aac75b1e6fd15245ac75c_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos
Size 3.3MB
Sample261012-29be6sfa89
SHA256 8b99c64c5a3c918c87faa46f5c55628398c959c3b7d5a1ee407bf59566c5992d
MD5 42f3f367f12aac75b1e6fd15245ac75c
SHA1 07d3fb4a95887098ed46aa0278ee25e84a3a0bdc
SHA512 3e212ada088e502188703890146eb7d6173491a155c05b1043260979bef493629d42e6cc7dcad48a244efe49e573d5d43a1101ba99c5373d877311bdedd125cd
SSDEEP 49152:MY5a8mcnC9p38TkajE860rTpIZgeA84rSLG3b6l4eDmg27RnWGjXarSj8RoTCCW:T5ZCH+VjDSD527BWGjJTy
TLSH
T18DF5DF227782C572E4E201B5AD38BB5A182DBD24477188CBA3E43D5D6E724C35F3AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_42f3f367f12aac75b1e6fd15245ac75c_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-10-11_42f3f367f12aac75b1e6fd15245ac75c_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

.exe 3.3MB

2026-10-11_42f3f367f12aac75b1e6fd15245ac75c_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos

IMPHASH 5b59725478bc7a1ae47d2ded1a0393a1
SHA256 8b99c64c5a3c918c87faa46f5c55628398c959c3b7d5a1ee407bf59566c5992d
MD5 42f3f367f12aac75b1e6fd15245ac75c
SHA1 07d3fb4a95887098ed46aa0278ee25e84a3a0bdc
SHA512 3e212ada088e502188703890146eb7d6173491a155c05b1043260979bef493629d42e6cc7dcad48a244efe49e573d5d43a1101ba99c5373d877311bdedd125cd
SSDEEP 49152:MY5a8mcnC9p38TkajE860rTpIZgeA84rSLG3b6l4eDmg27RnWGjXarSj8RoTCCW:T5ZCH+VjDSD527BWGjJTy
TLSH
T18DF5DF227782C572E4E201B5AD38BB5A182DBD24477188CBA3E43D5D6E724C35F3AB17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1095597

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builds\GoCart\5.0\source\gocartclient\public\ags\binaries\windows\release\AGSService.pdb

netapi32

NetApiBufferFree NetWkstaGetInfo

ws2_32

inet_ntoa

kernel32

SystemTimeToFileTime GetLogicalDriveStringsW GetLocaleInfoA GetComputerNameExW GetVersionExW GetFileAttributesW ResumeThread GetFileTime DosDateTimeToFileTime lstrcatW LocalFileTimeToFileTime FindClose RemoveDirectoryW WideCharToMultiByte GetSystemTime FindNextFileW SetLastError FindFirstFileW QueryDosDeviceW PeekNamedPipe CreatePipe SetHandleInformation GetModuleFileNameW CreateTimerQueue GetTickCount CreateProcessW GetProcessHeap LocalFree HeapAlloc CreateThread CloseHandle SetEvent Sleep CreateEventW GetThreadTimes SwitchToThread WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA QueueUserWorkItem LocalAlloc WaitForSingleObject DeleteTimerQueue HeapFree CreateTimerQueueTimer CreateDirectoryW GetLastError GetFileSize FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage OutputDebugStringA GetEnvironmentVariableA MultiByteToWideChar QueryPerformanceFrequency QueryPerformanceCounter GetModuleHandleExW GetTempPathW CreateFileW SetFileAttributesW CreateSemaphoreW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection WriteFile SetFilePointer GetCurrentThreadId GetCurrentProcess GetCurrentThread GetTimeZoneInformation ReleaseSemaphore GlobalFree WaitForMultipleObjects FreeLibrary GetProcAddress LoadLibraryW ReadFile GetFileSizeEx GetLocalTime GetTimeFormatW GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW SetEndOfFile UnlockFileEx LockFileEx TerminateThread FlushFileBuffers lstrcmpW lstrlenW GetFileAttributesExW MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetCurrentProcessId CreateFileMappingA UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA GetVersionExA LoadLibraryA CreateFileA OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFullPathNameA LockFile GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI InterlockedCompareExchange GetACP MoveFileW InitializeCriticalSectionAndSpinCount OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW RaiseException DecodePointer lstrcmpA ResetEvent WaitForSingleObjectEx GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlUnwind InterlockedPushEntrySList LoadLibraryExW GetDriveTypeW GetFileType SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFileTime MoveFileExW ExitProcess GetStdHandle GetCommandLineA GetCommandLineW SetFilePointerEx GetConsoleMode ReadConsoleW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetCurrentDirectoryW SetStdHandle FindFirstFileExW

advapi32

CryptGenKey CryptGenRandom CryptDestroyKey CryptAcquireContextW CryptExportKey RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl GetSecurityDescriptorDacl GetExplicitEntriesFromAclW CloseServiceHandle CreateWellKnownSid GetNamedSecurityInfoW SetNamedSecurityInfoW SetSecurityInfo OpenProcessToken OpenThreadToken GetTokenInformation EqualSid RegCloseKey RegOpenKeyExW RegQueryValueExW CreateProcessAsUserW CryptReleaseContext OpenSCManagerW CreateServiceW QueryServiceStatus ChangeServiceConfig2W DeleteService DeregisterEventSource QueryServiceStatusEx OpenServiceW InitializeSecurityDescriptor GetFileSecurityW FreeSid EnumDependentServicesW ControlService SetEntriesInAclW AllocateAndInitializeSid SetServiceStatus

shell32

SHGetPathFromIDListW SHGetFolderPathW SHCreateDirectoryExW SHGetFolderLocation

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize

oleaut32

SysAllocString SysStringLen SysFreeString SysAllocStringByteLen VariantClear

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpConnect WinHttpQueryHeaders WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpSetOption WinHttpOpen WinHttpQueryAuthSchemes WinHttpCloseHandle WinHttpCrackUrl WinHttpReceiveResponse WinHttpSetCredentials

setupapi

CM_Get_DevNode_Status SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

GetProcessImageFileNameW

rpcrt4

UuidCreate UuidToStringA UuidToStringW RpcStringFreeA RpcStringFreeW

shlwapi

PathIsFileSpecW PathAddExtensionW PathRemoveExtensionW PathFileExistsW PathFindFileNameW PathAppendW PathIsDirectoryW PathRenameExtensionW PathRemoveBackslashW PathRemoveFileSpecW PathStripPathW

crypt32

CryptDecodeObject CryptMsgClose CertFreeCertificateContext CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW

wintrust

WinVerifyTrust

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

315KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

75KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=241, version=40116,

count=193, id=243, version=40116,

count=31, id=242, version=40116,

count=2, id=261, version=23013,

count=26, id=259, version=24123,

count=38, id=260, version=24123,

count=1, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=128, id=261, version=24123,

count=2, id=203, version=65501,

count=19, id=125, productName=VS2005 build 50727, version=50727,

count=129, id=109, productName=VS2005 build 50727, version=50727,

count=29, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=87, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=349, id=1, productName=Unmarked objects,

count=107, id=265, version=24210,

count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,