2026-10-22_eb624d261e1fcea7b5b1b4c55c32f6e5_darkgate_elex_gcleaner_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_eb624d261e1fcea7b5b1b4c55c32f6e5_darkgate_elex_gcleaner_glassworm_stop
Size 12.2MB
Sample261023-epbh4swvb1
SHA256 91b0c93d19e923c78590185fc1264bbf05ebac0608ccf7619b0ca9bfa9afe142
MD5 eb624d261e1fcea7b5b1b4c55c32f6e5
SHA1 81d3477f61e1198e9bbfc11d63727e75899435b3
SHA512 434dac168c1a8621c00a3ca46957e3e822de4e341046a6996877fd5440aa7af195eb82e12dcea9e8e142982324ad366d180bf22798695f6bb92d5ef9f66e7121
SSDEEP 393216:rik0Ks44piF788ePifIDSPFBsf0sgo0co:vPrsioFo
TLSH
T125D6CF61FA42C437C0632A34DE5B82E9982A7F356F3454977AEC3D8C6F75281B52039B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_eb624d261e1fcea7b5b1b4c55c32f6e5_darkgate_elex_gcleaner_glassworm_stop

File Explorer

2026-10-22_eb624d261e1fcea7b5b1b4c55c32f6e5_darkgate_elex_gcleaner_glassworm_stop

.exe 12.2MB

2026-10-22_eb624d261e1fcea7b5b1b4c55c32f6e5_darkgate_elex_gcleaner_glassworm_stop

IMPHASH 351772932ea224058e3889a85c9a9345
SHA256 91b0c93d19e923c78590185fc1264bbf05ebac0608ccf7619b0ca9bfa9afe142
MD5 eb624d261e1fcea7b5b1b4c55c32f6e5
SHA1 81d3477f61e1198e9bbfc11d63727e75899435b3
SHA512 434dac168c1a8621c00a3ca46957e3e822de4e341046a6996877fd5440aa7af195eb82e12dcea9e8e142982324ad366d180bf22798695f6bb92d5ef9f66e7121
SSDEEP 393216:rik0Ks44piF788ePifIDSPFBsf0sgo0co:vPrsioFo
TLSH
T125D6CF61FA42C437C0632A34DE5B82E9982A7F356F3454977AEC3D8C6F75281B52039B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6536763

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle GetEnvironmentStringsW CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CreateFileW CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle DeleteCriticalSection CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CreateFileA CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle VirtualProtect CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle GlobalUnlock GlobalLock GlobalAlloc GetTickCount WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GetModuleHandleA GlobalFree GlobalGetAtomNameA GlobalDeleteAtom GlobalGetAtomNameW FreeConsole GetEnvironmentVariableA VirtualProtect VirtualAlloc GetProcAddress GetLastError LoadLibraryA SetLastError SetThreadPriority GetCurrentThread SetEnvironmentVariableA ReleaseMutex WaitForSingleObject CreateMutexA OpenMutexA SetErrorMode GetCurrentThreadId FindClose FindFirstFileW VirtualQueryEx GetExitCodeProcess ReadProcessMemory VirtualProtectEx ContinueDebugEvent ResumeThread OutputDebugStringA OutputDebugStringW SetThreadContext GetThreadContext WaitForDebugEvent WriteProcessMemory UnmapViewOfFile SuspendThread DebugActiveProcess MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA SetEvent CreateEventA MultiByteToWideChar CloseHandle CreateProcessA GetStartupInfoA GetCommandLineA GetSystemTimeAsFileTime ExitProcess LocalFree CompareStringW CompareStringA FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FormatMessageA GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoW GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW Sleep EnterCriticalSection LeaveCriticalSection GetVersionExA InitializeCriticalSection GetCurrentProcessId GetModuleFileNameW GetShortPathNameW GetModuleFileNameA CreateFileA GetShortPathNameA FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InterlockedIncrement InterlockedDecrement InterlockedExchange DeleteCriticalSection RtlUnwind RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree HeapAlloc GetProcessHeap GetCPInfo LCMapStringA LCMapStringW TlsGetValue TlsAlloc TlsSetValue TlsFree HeapSize WriteFile GetStdHandle GetACP GetOEMCP IsValidCodePage HeapDestroy HeapCreate VirtualFree HeapReAlloc GetTimeZoneInformation CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionAndSpinCount CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle

gdi32

SelectObject BitBlt DeleteObject CreatePalette CreateDCA SelectPalette RealizePalette CreateDIBitmap DeleteDC CreateCompatibleDC

user32

LoadStringW IsWindow PostMessageA GetDesktopWindow MoveWindow SetPropA EnumThreadWindows GetPropA GetMessageA BeginPaint KillTimer GetAsyncKeyState GetSystemMetrics SetTimer SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow LoadStringA EndPaint FindWindowA WaitForInputIdle DestroyWindow MessageBoxA InSendMessage UnpackDDElParam FreeDDElParam DefWindowProcW DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA CreateWindowExA GetWindowThreadProcessId SendMessageW SendMessageA PeekMessageA TranslateMessage DispatchMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

280KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

292KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text1

Size

384KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc1

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_eb624d261e1fcea7b5b1b4c55c32f6e5_darkgate_elex_gcleaner_glassworm_stop

kernel32

gdi32

user32

generic