2026-11-03_7852fcc2263bd366981acbc5a9be3ff7_darkgate_elex_glassworm_maze_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_7852fcc2263bd366981acbc5a9be3ff7_darkgate_elex_glassworm_maze_remcos
Size 1.6MB
Sample261104-tzjpssdh92
SHA256 ea2a3a66640743bd8c27ff1f5c08dbfa0ccc527e60e90d046ebdaacf3c142acd
MD5 7852fcc2263bd366981acbc5a9be3ff7
SHA1 c28a377e0f43aaba289021fa12499e70cdb18aba
SHA512 5014aa4352f89ab2b70e9d9214b6e5bd8411ca08fa071051071bd0133c51b855b7f7655a6bbd6f910befda35f0a4d592205fd839ffc814ce836373f411e22192
SSDEEP 24576:MHkCX1td2L8QQ11GTWaggEGryZoqVnQ/tbw/2Mkjy6Fr7g0oE:20+GTWaggqZoqVQ/lFTjN4
TLSH
T16D75C0117A62D032E53302F089BEBB49406E6E711B7648D7E7D83D2D5D71AC29B31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_7852fcc2263bd366981acbc5a9be3ff7_darkgate_elex_glassworm_maze_remcos

File Explorer

2026-11-03_7852fcc2263bd366981acbc5a9be3ff7_darkgate_elex_glassworm_maze_remcos

.exe 1.6MB

2026-11-03_7852fcc2263bd366981acbc5a9be3ff7_darkgate_elex_glassworm_maze_remcos

IMPHASH 1816de44ca0c013e76f4e7b7101a1338
SHA256 ea2a3a66640743bd8c27ff1f5c08dbfa0ccc527e60e90d046ebdaacf3c142acd
MD5 7852fcc2263bd366981acbc5a9be3ff7
SHA1 c28a377e0f43aaba289021fa12499e70cdb18aba
SHA512 5014aa4352f89ab2b70e9d9214b6e5bd8411ca08fa071051071bd0133c51b855b7f7655a6bbd6f910befda35f0a4d592205fd839ffc814ce836373f411e22192
SSDEEP 24576:MHkCX1td2L8QQ11GTWaggEGryZoqVnQ/tbw/2Mkjy6Fr7g0oE:20+GTWaggqZoqVQ/lFTjN4
TLSH
T16D75C0117A62D032E53302F089BEBB49406E6E711B7648D7E7D83D2D5D71AC29B31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

618992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\build\workspace\miflash_git\out\Release\bin\account_auth.pdb

kernel32

GetWindowsDirectoryW GetUserDefaultLangID GetModuleHandleW CreateThread DeleteFileA InterlockedExchangeAdd InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter GetTempFileNameW GetCurrentProcess CreateDirectoryW CopyFileW GetFileAttributesW CreateFileW GetTempPathW GetCurrentDirectoryW GetLongPathNameW SetLastError RemoveDirectoryW GetFileAttributesExW DeleteFileW InterlockedCompareExchange CreateMutexW SetFilePointer CreateProcessW GetTickCount DeleteCriticalSection GetCurrentProcessId GetCurrentThread Sleep RaiseException IsDebuggerPresent GetCurrentThreadId DuplicateHandle TlsGetValue TlsSetValue TlsAlloc TlsFree GetQueuedCompletionStatus InterlockedExchange PostQueuedCompletionStatus CreateIoCompletionPort SystemTimeToTzSpecificLocalTime SystemTimeToFileTime QueryPerformanceCounter GetSystemTimeAsFileTime FileTimeToSystemTime QueryPerformanceFrequency SetEndOfFile SetFilePointerEx SetFileTime FlushFileBuffers GetNativeSystemInfo GetVersionExW GetProcAddress GetCommandLineW GetModuleHandleExW InterlockedIncrement GetModuleHandleExA FreeResource LockResource ExitProcess LoadResource SizeofResource FindResourceW LoadLibraryW GetACP GetFileSize MulDiv GetFileType DosDateTimeToFileTime GetLocalTime InterlockedDecrement GlobalAlloc GlobalLock GlobalUnlock FreeLibrary OutputDebugStringW GetEnvironmentStringsW FreeEnvironmentStringsW HeapAlloc GetProcessHeap HeapFree LoadLibraryExW CreateToolhelp32Snapshot Process32FirstW Process32NextW TerminateProcess DecodePointer GetDriveTypeW GetSystemDirectoryW lstrcmpiW EncodePointer GetStringTypeW IsProcessorFeaturePresent GetFullPathNameW HeapReAlloc GetConsoleCP GetConsoleMode SetStdHandle AreFileApisANSI RtlUnwind ReadConsoleW GetCPInfo UnhandledExceptionFilter GetStartupInfoW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize IsValidCodePage GetOEMCP GetStdHandle GetTimeZoneInformation WriteConsoleW SetEnvironmentVariableA EnterCriticalSection GetLastError GetOverlappedResult LeaveCriticalSection InitializeCriticalSection WriteFile WaitForSingleObject MultiByteToWideChar WideCharToMultiByte GetModuleFileNameW ReadFile CreateNamedPipeW ConnectNamedPipe CloseHandle CreateEventW ResetEvent SetEvent ReleaseMutex GetModuleFileNameA

user32

SetCaretPos GetCaretPos ClientToScreen GetSysColor SetWindowTextW GetWindowTextW GetWindowTextLengthW MoveWindow CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetLastActivePopup GetDesktopWindow GetMessageW DestroyWindow SetTimer UnregisterClassW KillTimer WaitMessage InvalidateRect TranslateMessage RegisterClassExW CallMsgFilterW PeekMessageW MsgWaitForMultipleObjectsEx CreateWindowExW DefWindowProcW DispatchMessageW MessageBoxW ShowCaret HideCaret GetCaretBlinkTime CreateCaret GetUpdateRect EndPaint BeginPaint ReleaseDC GetDC ReleaseCapture SetCapture GetKeyState GetFocus GetActiveWindow CharNextW IsWindowVisible ScreenToClient SetWindowRgn IsZoomed GetMonitorInfoW SetRect MonitorFromWindow LoadImageW LoadCursorW GetWindow GetParent SetWindowLongW GetWindowLongW GetWindowRect GetClientRect GetPropW FillRect DrawTextW CharPrevW OffsetRect LoadIconW PostMessageW TrackPopupMenu SetForegroundWindow AppendMenuW GetCursorPos ShowWindow CreatePopupMenu DestroyMenu PostQuitMessage SetCursor wvsprintfW PtInRect IsRectEmpty UnionRect IntersectRect MapWindowPoints SetPropW GetSystemMetrics EnableWindow SetFocus IsIconic SetWindowPos IsWindow GetClassInfoExW RegisterClassW CallWindowProcW GetQueueStatus SendMessageW

shell32

SHFileOperationW ShellExecuteW Shell_NotifyIconW SHGetFolderPathW

dbghelp

MiniDumpWriteDump

gdiplus

GdipGetImageWidth GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipGraphicsClear GdipDrawImage GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipDrawImageRectI GdipGetImageHeight GdipDeleteFontFamily GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipDrawString GdipCreateStringFormat GdipImageGetFrameDimensionsCount GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat

comctl32

_TrackMouseEvent ord17

vmprotectsdk32

VMProtectBegin VMProtectEnd

winmm

timeBeginPeriod timeEndPeriod timeGetTime

imm32

ImmSetCompositionWindow ImmSetCompositionFontW ImmReleaseContext ImmGetContext

iphlpapi

GetAdaptersInfo

gdi32

CreateRectRgnIndirect DeleteObject CreatePenIndirect CombineRgn GetObjectA SetWindowOrgEx GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC Rectangle GetStockObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreatePatternBrush CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt CreateCompatibleBitmap BitBlt CreateRoundRectRgn GetDeviceCaps GdiFlush ExtTextOutW TextOutW MoveToEx CreateDIBSection SetTextColor SetStretchBltMode

advapi32

RegOpenKeyExW RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegDeleteValueW RegEnumKeyExW RegDeleteKeyW IsTextUnicode RegSetValueExW

ole32

OleUninitialize CoUninitialize CoInitializeEx CoInitialize CoCreateInstance CLSIDFromString CLSIDFromProgID OleLockRunning CreateStreamOnHGlobal CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc OleInitialize

oleaut32

VarUI4FromStr VariantClear VariantInit SysAllocString SysFreeString

libcurl

curl_easy_escape curl_free curl_slist_append curl_easy_init curl_easy_setopt curl_easy_perform curl_easy_getinfo curl_easy_cleanup curl_slist_free_all curl_global_init

libeay32

ord3314 ord266 ord2656 ord323 ord501 ord961 ord2894 ord294 ord276 ord256 ord2660 ord2784 ord965 ord964 ord2572 ord2747 ord332 ord3312 ord3067 ord333 ord3315 ord3313 ord264 ord2927 ord260 ord502 ord504 ord503

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

789KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

612KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=225, version=20806,

count=1, id=199, version=41118,

count=42, id=223, productName=VS2013 build 21005, version=21005,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=87, id=225, productName=VS2013 build 21005, version=21005,

count=254, id=224, productName=VS2013 build 21005, version=21005,

count=6, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=34, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=519, id=1, productName=Unmarked objects,

count=138, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,