2026-11-01_fabd25e81abf12e57409da423933c89c_bkransomware_darkgate_elex_glassworm_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_fabd25e81abf12e57409da423933c89c_bkransomware_darkgate_elex_glassworm_maze
Size 3.9MB
Sample261102-cldsyset6y
SHA256 3583d4a6c8583c6553b67de71af619bd0461b9d24d9c0e7f7fd73b81d91aea73
MD5 fabd25e81abf12e57409da423933c89c
SHA1 30cf5f10396aa864572d58ab037c3ae3a8dd8d43
SHA512 030696bdcd61067135d4e017c52d87109924318dd336dc7626f9a4dcc0b02d635fee9fb59b3e2a60686b71e382732089851055015245c4c47c198b127f01d4ab
SSDEEP 98304:Ss7Xzp5ah1iwKIS2KxDJGMRB8vqMwMJGLeIlteCGSLmGJTZLm:Ss7Xzp5ah1iwKIS2KxDJGMRB8vqkieIf
TLSH
T1CF16CF21F701C032D95315F1A6ADA72EA679BA31575594C3F3C01F2E3AB09E23A35B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_fabd25e81abf12e57409da423933c89c_bkransomware_darkgate_elex_glassworm_maze

File Explorer

2026-11-01_fabd25e81abf12e57409da423933c89c_bkransomware_darkgate_elex_glassworm_maze

.exe 3.9MB

2026-11-01_fabd25e81abf12e57409da423933c89c_bkransomware_darkgate_elex_glassworm_maze

IMPHASH 376acd8ed62802be9a803222852324be
SHA256 3583d4a6c8583c6553b67de71af619bd0461b9d24d9c0e7f7fd73b81d91aea73
MD5 fabd25e81abf12e57409da423933c89c
SHA1 30cf5f10396aa864572d58ab037c3ae3a8dd8d43
SHA512 030696bdcd61067135d4e017c52d87109924318dd336dc7626f9a4dcc0b02d635fee9fb59b3e2a60686b71e382732089851055015245c4c47c198b127f01d4ab
SSDEEP 98304:Ss7Xzp5ah1iwKIS2KxDJGMRB8vqMwMJGLeIlteCGSLmGJTZLm:Ss7Xzp5ah1iwKIS2KxDJGMRB8vqkieIf
TLSH
T1CF16CF21F701C032D95315F1A6ADA72EA679BA31575594C3F3C01F2E3AB09E23A35B87
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

996891

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins_ci\workspace\Pack_Web_WebPlugins\WebLocalService\target\vs2013_win32\release\WebPluginService.pdb

ws2_32

freeaddrinfo ntohl inet_ntoa accept listen getsockopt send closesocket WSASetLastError __WSAFDIsSet socket bind getaddrinfo WSACleanup sendto setsockopt shutdown WSAGetLastError recvfrom WSAStartup connect ioctlsocket getsockname htons inet_addr getpeername htonl recv WSASend WSARecv WSAIoctl ntohs select

rpcrt4

UuidCreate

winmm

timeKillEvent timeEndPeriod

gdiplus

GdipFree GdipDeleteBrush GdiplusShutdown GdipCloneBrush GdipFillPolygonI GdipCreateSolidFill GdipAlloc GdipCreateFromHDC GdipSetSolidFillColor GdiplusStartup GdipDeletePen GdipDrawLineI GdipCreatePen1 GdipLoadImageFromStream GdipSaveImageToStream GdipGetImageHeight GdipFillPolygon GdipCombineRegionRectI GdipFillRegion GdipDrawImageRectI GdipLoadImageFromFile GdipDrawPolygon GdipDrawLines GdipSetPenColor GdipGetImageEncodersSize GdipDisposeImage GdipDeleteRegion GdipGetImageEncoders GdipCreateRegion GdipFillPieI GdipCloneImage GdipGetImageWidth GdipDeleteGraphics

slf

HIKSLF_WebProcess

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetCPInfo UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue CreateSemaphoreW GetModuleHandleW GetStartupInfoW TerminateProcess CreateEventW InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind LoadLibraryExW ExitThread CreateThread GetCommandLineA AreFileApisANSI CreateFileA WriteFile CreateFileW GetLastError GetLocalTime CloseHandle GetModuleHandleA GetCurrentProcess CreateDirectoryW GetCurrentThread WideCharToMultiByte GetFileAttributesA GetEnvironmentVariableA MultiByteToWideChar CreateDirectoryA OutputDebugStringA GetDiskFreeSpaceExA HeapReAlloc HeapAlloc HeapFree GetProcessHeap InitializeCriticalSectionEx RaiseException HeapSize DecodePointer DeleteCriticalSection SetFileAttributesA EnumSystemLocalesW lstrcpynA lstrcatA FindFirstFileA FindClose FreeLibrary GetProcAddress LoadLibraryExA GetSystemTime MulDiv DeleteFileA CreateProcessA GetSystemDirectoryA GetModuleFileNameA CreateMutexA InitializeCriticalSection Sleep MoveFileA LoadLibraryA GetSystemInfo SetFilePointer ReadFile FlushFileBuffers GetFileType FindNextFileA GetFileInformationByHandle LocalFree TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime FileTimeToSystemTime GetTimeZoneInformation DuplicateHandle FileTimeToLocalFileTime SetWaitableTimer WaitForSingleObject SetEvent ResetEvent WaitForMultipleObjects GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort TlsGetValue TlsSetValue SetThreadPriority GetCurrentThreadId TlsAlloc TlsFree CreateSemaphoreA ReleaseSemaphore IsDebuggerPresent IsProcessorFeaturePresent ExitProcess GetModuleHandleExW IsValidCodePage GetStringTypeW GetACP GetOEMCP GetStdHandle GetModuleFileNameW GetFileAttributesExW SetFilePointerEx GetConsoleCP GetConsoleMode ReadConsoleW DeleteFileW GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW MoveFileExW OutputDebugStringW GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualAlloc VirtualFree VirtualProtect InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx SetStdHandle WriteConsoleW LoadLibraryW SetEndOfFile EncodePointer SetEnvironmentVariableA lstrlenA QueryPerformanceFrequency

user32

TranslateMessage LoadStringA PostQuitMessage RegisterClassExA GetMessageA GetWindowRgn SendMessageTimeoutA EndPaint ClientToScreen SetCursor SetTimer GetWindowRect SetCapture KillTimer BeginPaint GetDC InvalidateRect ReleaseDC SetClassLongA IsWindow PostMessageA ReleaseCapture TranslateAcceleratorA GetParent SetWindowRgn DrawTextA FrameRect GetForegroundWindow DestroyWindow SetWindowPlacement LoadIconA SetParent GetClientRect SetFocus GetMonitorInfoA GetWindowPlacement SetWindowLongA GetWindowLongA CreateWindowExA MonitorFromWindow DefWindowProcA SetWindowPos ShowWindow UpdateWindow EndDialog LoadAcceleratorsA DispatchMessageA DialogBoxParamA RegisterDeviceNotificationA SendMessageA GetClassNameA LoadCursorA RegisterClassA EnumWindows GetWindowTextA GetWindow MoveWindow FillRect DrawTextW BringWindowToTop

gdi32

CreateCompatibleBitmap CreateCompatibleDC StretchBlt GetDeviceCaps DeleteDC Ellipse Rectangle SetBkColor CreateRectRgn CreateRoundRectRgn CombineRgn CreateFontW Polyline SetStretchBltMode PolyBezier MoveToEx LineTo SetTextColor CreateFontA SetBkMode SelectObject CreatePen GetStockObject BitBlt CreateSolidBrush DeleteObject

comdlg32

GetSaveFileNameA GetOpenFileNameA

advapi32

IsTextUnicode FreeSid AllocateAndInitializeSid RegOpenKeyExA RegQueryValueExA EqualSid GetTokenInformation OpenThreadToken OpenProcessToken GetSecurityInfo

shell32

ShellExecuteExA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA SHBrowseForFolderA ord680

ole32

CreateStreamOnHGlobal

??0CBaseProtocol@NetSDK@@QAE@ABV01@@Z ??0CCoreSignal@NetSDK@@QAE@ABV01@@Z ??0CCtrlCoreBase@NetSDK@@QAE@ABV01@@Z ??0CCycleBuffer@NetSDK@@QAE@ABV01@@Z ??0CDependLibLoader@NetSDK@@QAE@ABV01@@Z ??0CLinkAsyncIO@NetSDK@@QAE@ABV01@@Z ??0CLinkBase@NetSDK@@QAE@ABV01@@Z ??0CLinkTCP@NetSDK@@QAE@ABV01@@Z ??0CLinkTCPSocks5@NetSDK@@QAE@ABV01@@Z ??0CLongLinkPrivate@NetSDK@@QAE@ABV01@@Z ??0CLongLinkPrivateBase@NetSDK@@QAE@ABV01@@Z ??0CMemberBase@NetSDK@@QAE@ABV01@@Z ??0CMemberMgrBase@NetSDK@@QAE@ABV01@@Z ??0CMultiThreadControl@NetSDK@@QAE@ABV01@@Z ??0CObjectBase@NetSDK@@QAE@ABV01@@Z ??0CObjectBasePrivate@NetSDK@@QAE@ABV01@@Z ??0CRWLock@NetSDK@@QAE@ABV01@@Z ??0CRWLockGuard@NetSDK@@QAE@ABV01@@Z ??0CSSLTransInterface@NetSDK@@QAE@ABV01@@Z ??0CSSLTransInterface@NetSDK@@QAE@XZ ??1CSSLTransInterface@NetSDK@@UAE@XZ ??4CBaseProtocol@NetSDK@@QAEAAV01@ABV01@@Z ??4CCoreSignal@NetSDK@@QAEAAV01@ABV01@@Z ??4CCtrlCoreBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CCycleBuffer@NetSDK@@QAEAAV01@ABV01@@Z ??4CDependLibLoader@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkAsyncIO@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkTCP@NetSDK@@QAEAAV01@ABV01@@Z ??4CLinkTCPSocks5@NetSDK@@QAEAAV01@ABV01@@Z ??4CLongLinkPrivate@NetSDK@@QAEAAV01@ABV01@@Z ??4CLongLinkPrivateBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CMemberBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CMemberMgrBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CMultiThreadControl@NetSDK@@QAEAAV01@ABV01@@Z ??4CObjectBase@NetSDK@@QAEAAV01@ABV01@@Z ??4CObjectBasePrivate@NetSDK@@QAEAAV01@ABV01@@Z ??4CRWLock@NetSDK@@QAEAAV01@ABV01@@Z ??4CSSLTransInterface@NetSDK@@QAEAAV01@ABV01@@Z ??4CXmlBase@NetSDK@@QAEAAV01@ABV01@@Z ??_7CBaseProtocol@NetSDK@@6B@ ??_7CCoreSignal@NetSDK@@6B@ ??_7CCtrlCoreBase@NetSDK@@6B@ ??_7CCycleBuffer@NetSDK@@6B@ ??_7CDependLibLoader@NetSDK@@6B@ ??_7CLinkAsyncIO@NetSDK@@6B@ ??_7CLinkBase@NetSDK@@6B@ ??_7CLinkTCP@NetSDK@@6B@ ??_7CLinkTCPSocks5@NetSDK@@6B@ ??_7CLongLinkPrivate@NetSDK@@6B@ ??_7CLongLinkPrivateBase@NetSDK@@6B@ ??_7CMemberBase@NetSDK@@6B@ ??_7CMemberMgrBase@NetSDK@@6B@ ??_7CMultiThreadControl@NetSDK@@6B@ ??_7CObjectBase@NetSDK@@6B@ ??_7CObjectBasePrivate@NetSDK@@6B@ ??_7CRWLock@NetSDK@@6B@ ??_7CRWLockGuard@NetSDK@@6B@ ??_7CSSLTransInterface@NetSDK@@6B@ ?Recv@CLinkBase@NetSDK@@UAEHABIPADH@Z ?SetAsyn@CBaseProtocol@NetSDK@@QAEXH@Z

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_fabd25e81abf12e57409da423933c89c_bkransomware_darkgate_elex_glassworm_maze

ws2_32

rpcrt4

winmm

gdiplus

slf

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic