2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos
Size 2.3MB
Sample261017-e5bttahv7k
SHA256 f4aa1ca8e200a80abb071eb9583c9306b1b655862130c72cee65f18e2d81f92a
MD5 e4327b63dc9e700200e7b12aa388cf90
SHA1 b4eacad9a983a303bf7ca9123e9b9dc4bd8f5e6c
SHA512 555c6dba262c8c4cdb9c01cd06323fa5c191580a305cbe11c43b251531b675d9e53f32c234840fbe9da13eadb6556eb2fff25925bc55d840e1b08c3c6ff0b572
SSDEEP 49152:oxIPU/Edd1KelJ4F9fJ4klKXnjh/91Uc5fv5050xJITAEm:oxtFfJ4ke1Tv50axJI3
TLSH
T1F1B50121B641C075D7A201F50A7DE7B9093EEA2247395ADBF3E41E989D301D06B3A39F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos

File Explorer

2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos

.exe 2.3MB

2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos

IMPHASH 8bc0b6b36f30284b1442fec96e5ddacf
SHA256 f4aa1ca8e200a80abb071eb9583c9306b1b655862130c72cee65f18e2d81f92a
MD5 e4327b63dc9e700200e7b12aa388cf90
SHA1 b4eacad9a983a303bf7ca9123e9b9dc4bd8f5e6c
SHA512 555c6dba262c8c4cdb9c01cd06323fa5c191580a305cbe11c43b251531b675d9e53f32c234840fbe9da13eadb6556eb2fff25925bc55d840e1b08c3c6ff0b572
SSDEEP 49152:oxIPU/Edd1KelJ4F9fJ4klKXnjh/91Uc5fv5050xJITAEm:oxtFfJ4ke1Tv50axJI3
TLSH
T1F1B50121B641C075D7A201F50A7DE7B9093EEA2247395ADBF3E41E989D301D06B3A39F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

531169

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AdobeIPCBroker.pdb

ws2_32

getservbyname htonl inet_ntoa gethostbyname WSAGetLastError getsockname bind listen WSAStartup socket ioctlsocket connect __WSAFDIsSet getsockopt recv send select closesocket WSASetLastError ntohs getservbyport gethostbyaddr htons inet_addr

kernel32

GetACP FreeLibrary CreateProcessW MultiByteToWideChar GetStdHandle GetProcAddress LoadLibraryA CloseHandle GetOEMCP GetLastError InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject ReleaseSemaphore CreateSemaphoreW FindFirstFileW InitializeCriticalSectionEx RaiseException FindClose DecodePointer FindNextFileW GetModuleFileNameA GetModuleHandleA GetVersionExA CreateMutexA ReleaseMutex InterlockedCompareExchange GetCurrentThreadId TlsFree Sleep TlsAlloc InterlockedIncrement TlsSetValue TlsGetValue GetSystemDirectoryA GetCPInfo FileTimeToLocalFileTime GetFileInformationByHandle CreateMutexW GetCurrentProcess lstrlenA GetFullPathNameA SetEnvironmentVariableA WriteConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidCodePage GetModuleHandleW IsValidLocale GetLocaleInfoW CompareStringW OutputDebugStringW GetStringTypeW SwitchToThread FreeEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW GetCurrentProcessId GetTickCount GetCurrentThread ReadFile WriteFile ConnectNamedPipe GetOverlappedResult GetEnvironmentStringsW SetStdHandle SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateFileW FlushFileBuffers GetFileAttributesExW GetFileSizeEx GetFullPathNameW LockFileEx SetEndOfFile SetFilePointerEx UnlockFile GetTempPathW DuplicateHandle PeekNamedPipe CreateNamedPipeW SetEvent ResetEvent CreateEventW InitializeCriticalSectionAndSpinCount SetThreadPriority GetThreadPriority VirtualAlloc VirtualFree GetModuleFileNameW GetModuleHandleExW LoadLibraryExW WaitForMultipleObjects GetNamedPipeInfo LocalAlloc LocalReAlloc LocalFree FormatMessageW LCMapStringW RtlCaptureStackBackTrace SetFilePointer GetSystemTimeAsFileTime TerminateProcess GetCommandLineA EncodePointer HeapFree CreateThread ExitThread GetTimeZoneInformation ExitProcess AreFileApisANSI WideCharToMultiByte HeapReAlloc HeapAlloc FindFirstFileExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime RtlUnwind IsProcessorFeaturePresent SetLastError GetProcessHeap GetFileType GetStartupInfoW QueryPerformanceCounter IsDebuggerPresent HeapSize GetConsoleCP GetConsoleMode UnhandledExceptionFilter SetUnhandledExceptionFilter ReadConsoleW

user32

CreateWindowExW SetWindowLongW KillTimer SetTimer GetWindowLongW RegisterClassW DefWindowProcW TranslateMessage DispatchMessageW PeekMessageW PostMessageW PostQuitMessage DestroyWindow MsgWaitForMultipleObjectsEx

ole32

CoSetProxyBlanket CoUninitialize CoInitializeSecurity CoInitializeEx OleRun CoCreateInstance

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

advapi32

GetUserNameW

shell32

ShellExecuteExW SHCreateDirectoryExW CommandLineToArgvW

Name

.text

Size

688KB

Virtual Size

688KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos

ws2_32

kernel32

user32

ole32

oleaut32

advapi32

shell32

generic