2026-10-22_9ae219fd00068d08fce2c519c0fd1451_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_9ae219fd00068d08fce2c519c0fd1451_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos
Size 2.3MB
Sample261024-dx2jtsfv4v
SHA256 2419d51e902965a252bed5e9341d9585497d2cd9183c94b628941d55e9a224c3
MD5 9ae219fd00068d08fce2c519c0fd1451
SHA1 aa7ba77e2c0f7a43fd45c79a70ebbf15432d83d1
SHA512 711c2eab2106e9df341569e065d68fe34fd62a8cff5a7a89625d765d2ab295b8980df9b9f52ce0afbdd985e78974b9733d931698e3e6bb4f1571a7059f472ff2
SSDEEP 49152:lsUmun8aku99s+oi9JhmVrWXGzWUThi4a/KujKuSk1A44QIWCIphDRB9t:idPu99s+oiBmVrkGz8KujKuSk1A44QIk
TLSH
T189B52A5376609373E6340832682AA2765DA0BC530225BAF3F6DE73DE43705C0FA67B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_9ae219fd00068d08fce2c519c0fd1451_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

.exe 2.3MB

2026-10-22_9ae219fd00068d08fce2c519c0fd1451_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

IMPHASH 01fc6b2e18ef7314fc8cd9bc233f4eee
SHA256 2419d51e902965a252bed5e9341d9585497d2cd9183c94b628941d55e9a224c3
MD5 9ae219fd00068d08fce2c519c0fd1451
SHA1 aa7ba77e2c0f7a43fd45c79a70ebbf15432d83d1
SHA512 711c2eab2106e9df341569e065d68fe34fd62a8cff5a7a89625d765d2ab295b8980df9b9f52ce0afbdd985e78974b9733d931698e3e6bb4f1571a7059f472ff2
SSDEEP 49152:lsUmun8aku99s+oi9JhmVrWXGzWUThi4a/KujKuSk1A44QIWCIphDRB9t:idPu99s+oiBmVrkGz8KujKuSk1A44QIk
TLSH
T189B52A5376609373E6340832682AA2765DA0BC530225BAF3F6DE73DE43705C0FA67B56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

f6:7c:67:a0:67:c5:d2:86:c4:a1:c3:b5:5a:5d:32:37:60:bb:bc:08:30:89:3b:13:1e:31:00:3e:d0:31:bc:8a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440400MA7FWRMCXK,CN=珠海市莫停之科技有限公司,O=珠海市莫停之科技有限公司,L=珠海市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e78fa0e6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 25, 2026

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

7b:44:70:92:7a:f6:c8:9e:3e:2c:2e:2c:d9:40:da:75

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 21, 2025 - Jan 21, 2028

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

428552

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\jekins_work\workspace\sysoptasst_all_vs2022\product\win32\dbginfo\aslive.pdb

kernel32

K32GetModuleFileNameExW InterlockedExchange GlobalLock GlobalUnlock InterlockedIncrement InterlockedDecrement OutputDebugStringW lstrlenW GetCurrentProcessId CreateThread SetErrorMode SetEnvironmentVariableW VirtualAllocEx VirtualFreeEx SetFilePointer CreateFileW CloseHandle GetFileSize WriteFile GetLastError VirtualFree WriteConsoleW FlushFileBuffers GetFullPathNameW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW CreateProcessA GetConsoleCP GetTimeZoneInformation ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FreeResource GetDiskFreeSpaceExW GetDriveTypeW QueryPerformanceFrequency GetACP ExitProcess GetFileAttributesExW GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind LoadLibraryExW VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA PeekNamedPipe GetStdHandle GetFileType FormatMessageA SleepEx LoadLibraryExA FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer InitializeSListHead QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx MoveFileW GetStartupInfoW CreatePipe MoveFileExW CreateMutexW GetCommandLineW SetFileAttributesW Sleep GetLocalTime OpenEventW ReadFile VirtualAlloc EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetExitCodeThread GetFileTime GlobalFree GlobalAlloc LocalFree SetLastError OutputDebugStringA SetEndOfFile GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTickCount GetVersionExW GetSystemDirectoryW GetWindowsDirectoryW GetExitCodeProcess CreateProcessW TerminateProcess Process32NextW Module32NextW Module32FirstW Process32FirstW CreateToolhelp32Snapshot ReadProcessMemory ExpandEnvironmentStringsW OpenProcess GetCurrentProcess QueryDosDeviceW GetLogicalDriveStringsW CopyFileW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW RemoveDirectoryW FindClose SetFilePointerEx FindNextFileW FindFirstFileW DeleteFileW GetModuleFileNameW FreeLibrary LoadLibraryW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleHandleW GetProcAddress DecodePointer RaiseException GetCurrentThreadId InitializeCriticalSectionAndSpinCount WaitForMultipleObjects CreateDirectoryW GetFileAttributesW WideCharToMultiByte MultiByteToWideChar GetCurrentDirectoryW SystemTimeToFileTime ResetEvent SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection

user32

DestroyMenu PostThreadMessageW MonitorFromPoint IsDialogMessageW IsChild GetNextDlgTabItem SetWindowRgn TranslateMessage PeekMessageW DispatchMessageW UnregisterClassW GetMessageW EnumWindows GetWindowThreadProcessId GetLastInputInfo PostMessageW ExitWindowsEx GetForegroundWindow AttachThreadInput BringWindowToTop SetForegroundWindow GetDesktopWindow FindWindowW FindWindowExW SendMessageW GetWindowRect InvalidateRect DrawTextW GetDC ReleaseDC CreateWindowExW DefWindowProcW LoadCursorW RegisterClassExW LoadBitmapW LoadImageW CopyRect IsWindow UpdateLayeredWindow InflateRect SetRectEmpty SetCursor PtInRect SetRect GetDlgCtrlID ShowWindow EqualRect SetWindowPos GetSystemMetrics RegisterWindowMessageW IsWindowVisible GetDlgItem OffsetRect DestroyIcon GetParent SetWindowLongW GetWindowLongW CallWindowProcW DestroyWindow IsIconic IsRectEmpty MoveWindow GetClientRect BeginPaint EndPaint ClientToScreen SetCapture ReleaseCapture LoadIconW IsWindowEnabled SetTimer KillTimer EnableWindow SetWindowTextW IntersectRect GetSystemMenu DeleteMenu PostQuitMessage MapWindowPoints GetMonitorInfoW MonitorFromWindow GetWindow GetCursorPos GetActiveWindow SystemParametersInfoW SetActiveWindow GetClassInfoExW DrawIconEx AppendMenuW TrackPopupMenuEx CreatePopupMenu ScreenToClient SetFocus GetFocus

gdi32

RectInRegion GetCurrentObject GetTextColor SetStretchBltMode GetViewportOrgEx GetClipRgn ExtSelectClipRgn RoundRect TextOutW GetTextExtentPoint32W SaveDC RestoreDC SetViewportOrgEx SelectClipRgn LineTo MoveToEx SetBkMode GetStretchBltMode OffsetRgn CreatePen SetTextColor CreateBitmap CreateCompatibleBitmap CreateDIBSection CombineRgn CreateRectRgn StretchBlt BitBlt ExtTextOutW SetBkColor CreateCompatibleDC CreateFontIndirectW GetStockObject GetObjectW DeleteObject GetDeviceCaps SelectObject DeleteDC CreateRoundRectRgn Rectangle CreateRectRgnIndirect

advapi32

CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA CloseEventLog ReadEventLogW OpenEventLogW StartServiceW RegEnumKeyExW RegQueryValueExA RegOpenKeyExA SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor CryptEncrypt CloseServiceHandle OpenServiceW OpenSCManagerW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyW

shell32

ShellExecuteW Shell_NotifyIconW SHGetFolderPathW SHGetSpecialFolderPathW SHCreateDirectoryExW

ole32

CreateStreamOnHGlobal

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime

shlwapi

PathRemoveFileSpecW StrToIntA PathAddBackslashW PathFileExistsW PathIsDirectoryW PathFindFileNameW StrToIntW

comctl32

_TrackMouseEvent DrawShadowText

msimg32

AlphaBlend

ws2_32

ioctlsocket sendto recvfrom listen accept freeaddrinfo getaddrinfo WSAIoctl setsockopt ntohs htons getsockopt getsockname gethostbyname getpeername connect bind send recv WSASetLastError select __WSAFDIsSet WSAGetLastError WSACleanup closesocket socket inet_addr inet_ntoa gethostname WSAStartup

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

gdiplus

GdipDeleteGraphics GdipSetCompositingQuality GdipSetTextRenderingHint GdipSetInterpolationMode GdipSetSmoothingMode GdiplusShutdown GdiplusStartup GdipCloneBitmapArea GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipAddPathPieI GdipAddPathRectangle GdipAddPathArcI GdipAddPathLineI GdipClosePathFigure GdipStartPathFigure GdipDeletePath GdipCreatePath GdipSetStringFormatTrimming GdipGetImageGraphicsContext GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipSetPenDashStyle GdipSetPenMode GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipCreateLineBrushFromRectWithAngleI GdipCreateLineBrushI GdipDisposeImage GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipAlloc GdipDeleteFontFamily GdipFree GdipCreateFromHDC GdipSetStringFormatLineAlign GdipAddPathStringI GdipImageRotateFlip GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipLoadImageFromStream GdipLoadImageFromFile GdipGetFontSize GdipGetFamily GdipDeleteFont GdipCreateFont GdipCreateFontFromLogfontW GdipPrivateAddFontFile GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipCloneFontFamily GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipSetClipHrgn GdipSetClipPath GdipDrawImagePointsRectI GdipDrawImageRectRectI GdipSetPixelOffsetMode GdipDrawImageRectI GdipDrawImageI GdipMeasureString GdipDrawString GdipFillPath GdipFillRectangleI GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawRectangleI GdipDrawLinesI GdipDrawLine GdipRotateWorldTransform GdipScaleWorldTransform GdipTranslateWorldTransform GdipAddPathRectangleI GdipResetWorldTransform GdipDrawImageRectRect

iphlpapi

IcmpSendEcho IcmpCloseHandle GetNetworkParams IcmpCreateFile

wldap32

ord79 ord30 ord35 ord301 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord200 ord46 ord143

Name

.text

Size

856KB

Virtual Size

856KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

231KB

Virtual Size

231KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_9ae219fd00068d08fce2c519c0fd1451_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

ws2_32

version

gdiplus

iphlpapi

wldap32

generic