2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia
Size 1.8MB
Sample261022-26xt1ayt5m
SHA256 e16292d87f47b6dec07fb2535140bc68973c3cf1a78a68395b11628178f612dc
MD5 67d9afb6b239830e5638636fe3843a97
SHA1 65dc780182adff64e9843d89f56fdfe067b3d390
SHA512 a861956061fb17a436d62de3b3ff3c577ac9aac2e85aff8c8b81dc15c658068a141563404389a3247c827fcee3b806c5360cbc8243b872547e66e31b1fe98ff2
SSDEEP 49152:tivdgblGeOJxj5fYoPi5SW6H8DS52tdDpbRZy:thGb85SSDntdDpbRZy
TLSH
T1B185BF70BBEA813AE7E2207259B9D35E062DBD614F3180CFB69C094D9D709C26E39717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia

File Explorer

2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia

.exe 1.8MB

2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia

IMPHASH 86003c972530424ba3b36b02f93ed7bb
SHA256 e16292d87f47b6dec07fb2535140bc68973c3cf1a78a68395b11628178f612dc
MD5 67d9afb6b239830e5638636fe3843a97
SHA1 65dc780182adff64e9843d89f56fdfe067b3d390
SHA512 a861956061fb17a436d62de3b3ff3c577ac9aac2e85aff8c8b81dc15c658068a141563404389a3247c827fcee3b806c5360cbc8243b872547e66e31b1fe98ff2
SSDEEP 49152:tivdgblGeOJxj5fYoPi5SW6H8DS52tdDpbRZy:thGb85SSDntdDpbRZy
TLSH
T1B185BF70BBEA813AE7E2207259B9D35E062DBD614F3180CFB69C094D9D709C26E39717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

353676

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BUILD\work\01\cde5c69121bcb0b1\bin\DefragglerCmd\Release\df.pdb

kernel32

GetCurrentThreadId WideCharToMultiByte GetLocalTime GetStdHandle WriteConsoleW SetConsoleTextAttribute DeleteCriticalSection GlobalMemoryStatusEx GetVersionExW GetSystemInfo GetComputerNameExW GetCommandLineW GetHandleInformation WaitForMultipleObjects ResetEvent LoadLibraryW CreateFileW GetTempPathW InitializeCriticalSectionAndSpinCount LocalFree FindClose SetEvent lstrlenW FindNextFileW CreateProcessW GetExitCodeProcess GetCurrentDirectoryW MultiByteToWideChar GetCurrentProcessId SetUnhandledExceptionFilter FormatMessageW LeaveCriticalSection EnterCriticalSection WritePrivateProfileStringW GetPrivateProfileStringW WritePrivateProfileStructW GetPrivateProfileStructW SetEnvironmentVariableA GetTimeZoneInformation WriteFile FlushFileBuffers WaitForSingleObject FindResourceExW FindResourceW LoadResource LockResource SizeofResource FreeLibrary GetLastError CreateEventW SetLastError GetCurrentThread CompareStringW GetDateFormatA GetTimeFormatA GetModuleFileNameW GetFullPathNameW GetModuleHandleW GetProcAddress GetCurrentProcess TerminateProcess FindFirstFileW CloseHandle LoadLibraryA SetStdHandle GetConsoleMode GetConsoleCP HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoW GetFileType SetHandleCount IsValidLocale EnumSystemLocalesA OpenEventW GetLocaleInfoW GetNumberFormatW InitializeCriticalSection GetTickCount DeviceIoControl GetFileInformationByHandle GetFileAttributesW VirtualAlloc VirtualFree GetDriveTypeW GetVolumePathNamesForVolumeNameW GetVolumePathNameW SetErrorMode FindFirstVolumeW FindNextVolumeW FindVolumeClose GetLogicalDrives GetDiskFreeSpaceExW GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexW GetDiskFreeSpaceW SetThreadPriority Sleep DeleteFileW InterlockedIncrement GetFileAttributesExW GetEnvironmentVariableW GetThreadContext ReadProcessMemory GetEnvironmentVariableA GetModuleFileNameA GetCurrentDirectoryA OutputDebugStringA GetVersionExA SuspendThread ResumeThread OpenProcess OpenMutexW SystemTimeToFileTime ReadFile SetFilePointer GetFileSize GetFileSizeEx SetFilePointerEx CreatePipe DuplicateHandle GetOverlappedResult GetSystemTime HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW GetModuleHandleA AreFileApisANSI FormatMessageA ExitThread CreateThread HeapSetInformation GetSystemTimeAsFileTime RtlUnwind GetCPInfo LCMapStringW UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetUserDefaultLCID GetLocaleInfoA

user32

DestroyIcon GetSystemMetrics

advapi32

InitializeSecurityDescriptor LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameA RegSetValueExW RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegQueryInfoKeyW OpenProcessToken InitiateSystemShutdownW RegEnumKeyExW RegDeleteKeyW RegOpenKeyExW RegCloseKey GetUserNameW SetSecurityDescriptorDacl

shell32

CommandLineToArgvW SHGetFileInfoW ord680

ole32

CoCreateInstance CoInitializeEx CoUninitialize

shlwapi

PathRemoveFileSpecW PathCombineW PathMatchSpecW PathIsDirectoryW PathIsRootW PathRemoveExtensionW PathStripPathW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeA GetFileVersionInfoA

psapi

EnumProcessModules GetProcessImageFileNameW GetModuleFileNameExW EnumProcesses

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia

kernel32

user32

advapi32

shell32

ole32

shlwapi

version

psapi

generic