2026-10-23_116e4a7a4c4ce17f5b5bea096e9fe396_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_116e4a7a4c4ce17f5b5bea096e9fe396_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat
Size 5.8MB
Sample261023-sgxchaew7n
SHA256 d13f3ec599dc3e0d95cec380d89c57687f859daaeebb06dad36c6c37cb8275f7
MD5 116e4a7a4c4ce17f5b5bea096e9fe396
SHA1 03067b39872aceae85a8d392ebc32a84b5fc6af4
SHA512 405384d2ef063e661a6b8a08d2cc435c17cb04b6e3d6398791724e84277a798c08ff955d999f69ef24481140c16570b14953021ba0a26922dd5b7ee72c9c6942
SSDEEP 49152:jdYsNBLjRCY3LJnbOJDbosmMDbvjmpjNQkEEY+USxCfc/S0y9LYtnbE1DfOsTfDx:ja+1IFbPmUbvjmtNjY91h8XqXhdgVby
TLSH
T119566CF176028CA9D1B911F0A42957EA121B7DA807B544E762F33D1999BCFC23633B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_116e4a7a4c4ce17f5b5bea096e9fe396_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat

File Explorer

2026-10-23_116e4a7a4c4ce17f5b5bea096e9fe396_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat

.exe 5.8MB

2026-10-23_116e4a7a4c4ce17f5b5bea096e9fe396_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat

IMPHASH 9296971aafc6075c762bff4ab034fa7f
SHA256 d13f3ec599dc3e0d95cec380d89c57687f859daaeebb06dad36c6c37cb8275f7
MD5 116e4a7a4c4ce17f5b5bea096e9fe396
SHA1 03067b39872aceae85a8d392ebc32a84b5fc6af4
SHA512 405384d2ef063e661a6b8a08d2cc435c17cb04b6e3d6398791724e84277a798c08ff955d999f69ef24481140c16570b14953021ba0a26922dd5b7ee72c9c6942
SSDEEP 49152:jdYsNBLjRCY3LJnbOJDbosmMDbvjmpjNQkEEY+USxCfc/S0y9LYtnbE1DfOsTfDx:ja+1IFbPmUbvjmtNjY91h8XqXhdgVby
TLSH
T119566CF176028CA9D1B911F0A42957EA121B7DA807B544E762F33D1999BCFC23633B1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3629965

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

libcef

cef_uriencode cef_enable_highdpi_support cef_api_hash cef_value_create cef_dictionary_value_create cef_process_message_create cef_request_context_get_global_context cef_request_context_create_context cef_create_context_shared cef_browser_host_create_browser_sync cef_stream_reader_create_for_data cef_string_multimap_alloc cef_string_multimap_free cef_v8value_create_int cef_v8value_create_string cef_v8value_create_function cef_v8context_get_current_context cef_v8context_get_entered_context cef_string_map_alloc cef_string_map_free cef_string_list_size cef_string_list_value cef_string_list_append cef_string_map_size cef_string_map_key cef_string_map_value cef_string_map_append cef_string_multimap_size cef_string_multimap_key cef_string_multimap_value cef_string_multimap_append cef_string_utf16_set cef_do_message_loop_work cef_shutdown cef_initialize cef_execute_process cef_register_scheme_handler_factory cef_string_list_free cef_string_list_alloc cef_string_userfree_utf16_free cef_log cef_string_utf16_clear cef_string_utf8_clear cef_string_utf16_to_utf8 cef_string_utf8_to_utf16 cef_string_utf16_cmp

user32

ReleaseCapture SetTimer IsWindowEnabled HiliteMenuItem CreatePopupMenu DestroyMenu CheckMenuItem AppendMenuW TrackPopupMenu DrawIcon UpdateWindow GetForegroundWindow BeginPaint EndPaint InvalidateRect GetWindowTextW SetCapture GetCapture LoadStringA GetWindowTextLengthW GetClientRect GetWindowRect MessageBoxW SetCursor GetCursorPos RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW PostMessageW DefWindowProcW RegisterClassExW CreateWindowExW ClientToScreen ScreenToClient FillRect ShowWindow SetWindowLongW GetAsyncKeyState CallNextHookEx LoadCursorW LoadIconW LoadImageW IsDialogMessageW GetAncestor TrackMouseEvent RegisterClassW IsWindow DestroyWindow SetWindowPos DrawTextW RedrawWindow SetWindowTextW MapWindowPoints DrawFocusRect FrameRect InflateRect UnionRect IsRectEmpty PtInRect GetParent SetParent OpenClipboard CloseClipboard SetClipboardData EmptyClipboard CheckMenuRadioItem GetKeyboardLayoutList GetKeyboardState ToUnicode VkKeyScanExW MapVirtualKeyW MoveWindow GetWindowPlacement SetForegroundWindow AdjustWindowRectEx GetWindow MessageBoxA GetUserObjectInformationW GetProcessWindowStation AttachThreadInput FlashWindow EnableWindow GetKeyState GetFocus SetFocus IsWindowVisible SetWindowsHookExW GetWindowLongW GetSystemMetrics GetDoubleClickTime GetDlgItem GetClipboardData GetWindowThreadProcessId GetClassNameW EnumChildWindows IntersectRect SwitchToThisWindow SetActiveWindow

shell32

ShellExecuteW SHCreateDirectoryExW SHFileOperationW CommandLineToArgvW

comdlg32

GetOpenFileNameW FindTextW

gdi32

CreateDIBSection Rectangle GetClipBox GetBkMode GetBkColor MoveToEx SetDCPenColor LineTo CreateSolidBrush CreatePen SetBkMode SetViewportOrgEx SetTextColor StretchDIBits SetBkColor SelectObject SaveDC RestoreDC IntersectClipRect GetStockObject ExcludeClipRect DeleteObject DeleteDC CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt SetDCBrushColor RoundRect

ws2_32

setsockopt socket WSAIoctl ntohs getaddrinfo freeaddrinfo recvfrom sendto htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet WSAGetLastError WSACleanup WSAStartup accept listen ioctlsocket gethostname shutdown inet_ntop

advapi32

RegisterEventSourceA ReportEventA DeregisterEventSource

wldap32

ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord143 ord301

dnsapi

DnsQuery_UTF8 DnsFree

sqlite3

sqlite3_prepare_v2 sqlite3_bind_int sqlite3_bind_text sqlite3_column_count sqlite3_column_name sqlite3_step sqlite3_limit sqlite3_column_int sqlite3_column_text sqlite3_column_type sqlite3_finalize sqlite3_reset sqlite3_open sqlite3_exec sqlite3_column_double sqlite3_close

msimg32

AlphaBlend

gdiplus

GdipFillEllipse GdipDrawEllipse GdipDrawRectangle GdipDrawArc GdipDrawLines GdipDrawLine GdipScaleWorldTransform GdipTranslateWorldTransform GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdiplusShutdown GdiplusStartup GdipDrawPolygon

comctl32

ord412 ord410 ord413 InitCommonControlsEx

kernel32

VirtualFree GetVersionExW UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SwitchToThread SignalObjectAndWait CreateTimerQueue LoadLibraryW RegisterWaitForSingleObject UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter GetStringTypeExA GetUserDefaultLCID LCMapStringA GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo GetSystemTimeAsFileTime DecodePointer EncodePointer GetStringTypeW GetExitCodeThread GetCurrentThread DuplicateHandle WideCharToMultiByte RaiseException TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection QueryPerformanceFrequency FlushConsoleInputBuffer GlobalMemoryStatus GetTickCount QueryPerformanceCounter VirtualProtect RtlUnwind ExitProcess GetModuleHandleExW SetEndOfFile SetConsoleCtrlHandler ExitThread SetFilePointerEx GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation GetConsoleCP HeapAlloc HeapFree HeapReAlloc GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle GetCurrentDirectoryW SetConsoleMode ReadConsoleInputW PeekNamedPipe WaitForSingleObjectEx VerifyVersionInfoA SleepEx VerSetConditionMask InitializeCriticalSectionEx GetModuleHandleA GetFileType GetStdHandle DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection FormatMessageA LoadLibraryA GetProcAddress FreeLibrary GetCurrentProcess SetUnhandledExceptionFilter GetCurrentThreadId WaitForMultipleObjects Sleep CreateEventW ResetEvent SetEvent CancelIo GetOverlappedResult SetNamedPipeHandleState SetLastError UnlockFileEx SetFilePointer ReadFile LockFileEx GetFileSize GetFileAttributesExW VirtualQuery VirtualAlloc GetModuleFileNameW OpenFileMappingA CreateFileMappingA MapViewOfFile GetLocalTime WriteFile GetFileSizeEx GetProcessHeap FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW CreateFileW QueryInformationJobObject SetInformationJobObject TerminateJobObject CreateJobObjectW GetTickCount64 CreateProcessW ResumeThread GetExitCodeProcess TerminateProcess MoveFileExW GetLastError GetFullPathNameW GlobalLock GlobalUnlock GlobalAlloc GetFileAttributesW FindNextFileW FindFirstFileW FindClose CreateDirectoryW GetModuleHandleW MultiByteToWideChar OpenMutexA LocalFree UnmapViewOfFile OpenProcess GetCurrentProcessId CreateMutexA WaitForSingleObject ReleaseMutex SetErrorMode CloseHandle DeleteFileW GetCommandLineW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize WriteConsoleW AssignProcessToJobObject

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

803KB

Virtual Size

803KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

154KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

687KB

Virtual Size

686KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

182KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=38, id=259, version=30795,

count=211, id=261, version=30795,

count=47, id=260, version=30795,

count=7, id=199, version=41118,

count=36, id=259, version=24123,

count=125, id=261, version=24123,

count=69, id=260, version=24123,

count=22, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=2, id=257, version=34120,

count=44, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=6, id=239, version=40116,

count=20, id=259, productName=VS2015 UPD1 build 23506, version=23506,

count=562, id=260, productName=VS2015 UPD1 build 23506, version=23506,

count=18, id=257, version=30795,

count=2, productName=Unmarked objects (old),

count=3, id=257, productName=VS2015 UPD1 build 23506, version=23506,

count=564, id=1, productName=Unmarked objects,

count=290, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,