2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat
Size 1.6MB
Sample261012-trmfqagw8n
SHA256 c18b6258b2cd228d0dca7de227341ad7dec7933f0823129a8c1c62d36406a595
MD5 8e68bc1a07afcaf50adda67445689c85
SHA1 3f0ecb3a62f8aa6c301ac83cc94456ba5e4247c9
SHA512 27129e460d15383ccb98b5de0c0d692049a815056cfc3b230db583dae2297ba260fb67d29d72990a6379d992e0511c502fd540367367e7dfeb12799a4590a477
SSDEEP 49152:0bhSnKAwCWjimXtgBwpje30jaNf1TWbdz:04nKAybd5U023W
TLSH
T12275E020B64180B4EA96817149BCEBBA443EE631473552DFE3E41D3D9E302D16B3B69F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat

File Explorer

2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat

.exe 1.6MB

2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat

IMPHASH b78757e60c78fbd8d0549e7a1e0d29a1
SHA256 c18b6258b2cd228d0dca7de227341ad7dec7933f0823129a8c1c62d36406a595
MD5 8e68bc1a07afcaf50adda67445689c85
SHA1 3f0ecb3a62f8aa6c301ac83cc94456ba5e4247c9
SHA512 27129e460d15383ccb98b5de0c0d692049a815056cfc3b230db583dae2297ba260fb67d29d72990a6379d992e0511c502fd540367367e7dfeb12799a4590a477
SSDEEP 49152:0bhSnKAwCWjimXtgBwpje30jaNf1TWbdz:04nKAybd5U023W
TLSH
T12275E020B64180B4EA96817149BCEBBA443EE631473552DFE3E41D3D9E302D16B3B69F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

560146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

AdobeIPCBroker.pdb

ws2_32

htonl getsockopt ioctlsocket connect closesocket listen getsockname bind WSAGetLastError WSASetLastError WSAStartup getservbyname getservbyport gethostbyname gethostbyaddr socket send select recv ntohs inet_ntoa inet_addr htons __WSAFDIsSet

kernel32

GetModuleFileNameW EnterCriticalSection LeaveCriticalSection GetLastError DeleteCriticalSection ReleaseSemaphore WaitForSingleObject CreateSemaphoreW FindFirstFileW FindNextFileW InitializeCriticalSectionEx FindClose RaiseException DecodePointer ReleaseMutex CreateMutexA Sleep GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetVersionExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA CreateMutexW FreeLibrary CreateProcessW GetProcAddress CloseHandle LoadLibraryA MultiByteToWideChar GetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW InitializeCriticalSection GetThreadPriority HeapSize HeapFree WriteConsoleW GetProcessHeap SetEnvironmentVariableA GetOEMCP IsValidCodePage FindNextFileA SwitchToThread FreeEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW GetCurrentProcessId ReadFile WriteFile ConnectNamedPipe GetOverlappedResult OpenProcess QueryFullProcessImageNameW GetNamedPipeServerProcessId GetLocalTime GetCurrentThread GetTickCount GetEnvironmentStringsW SetStdHandle SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateFileW FlushFileBuffers GetFileAttributesExW GetFileSizeEx GetFullPathNameW LockFileEx SetEndOfFile SetFilePointerEx UnlockFile GetTempPathW DuplicateHandle PeekNamedPipe CreateNamedPipeW SetEvent ResetEvent CreateEventW GetCurrentProcess SetThreadPriority HeapReAlloc VirtualAlloc VirtualFree GetModuleHandleExW LoadLibraryExW WaitForMultipleObjects GetNamedPipeInfo LocalAlloc LocalReAlloc LocalFree FormatMessageW LCMapStringW SetFilePointer RtlCaptureStackBackTrace TerminateProcess GlobalAlloc GlobalFree GetSystemTimeAsFileTime WaitForSingleObjectEx GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead QueryPerformanceCounter IsDebuggerPresent GetStartupInfoW WideCharToMultiByte EncodePointer SetLastError InitializeCriticalSectionAndSpinCount CompareStringW GetLocaleInfoW GetStringTypeW GetCPInfo OutputDebugStringW RtlUnwind InterlockedPushEntrySList GetDriveTypeW GetFileType SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread GetTimeZoneInformation ExitProcess GetCommandLineA GetACP GetConsoleMode ReadConsoleW GetConsoleCP GetFullPathNameA HeapAlloc FindFirstFileExA

user32

SetWindowLongW RegisterClassW CreateWindowExW SetTimer KillTimer TranslateMessage DispatchMessageW PostMessageW PostQuitMessage DestroyWindow MsgWaitForMultipleObjectsEx GetWindowLongW GetShellWindow EnumWindows GetWindowThreadProcessId DefWindowProcW PeekMessageW

advapi32

GetUserNameW RegCloseKey CreateProcessWithTokenW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid DuplicateTokenEx AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW RegQueryValueExW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx OleRun CoUninitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

shell32

ShellExecuteExW SHCreateDirectoryExW CommandLineToArgvW

Name

.text

Size

748KB

Virtual Size

747KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

596B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

612KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

shell32

generic