2026-11-11_66e3c61322c1b6d9fc979be178306dfa_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_66e3c61322c1b6d9fc979be178306dfa_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos
Size 12.0MB
Sample261113-mxtzesav4y
SHA256 e079a4ea8d347e4eacd872c99b2f1dabf6d0f1993671415fc643b7105d6ff4cd
MD5 66e3c61322c1b6d9fc979be178306dfa
SHA1 d0231ace2d94af929743a893725ed667aa0f9ba9
SHA512 4a008087e6a6077ffbf22bb53ffdcd346e0d4d7fa4a08d08597197c9533dc93648046199171838189e5c52312e116a4a5eafcfa500e4156566004403a28e80a2
SSDEEP 98304:znmQKRICbaWUV+m1oW5lVFwAuHTVk1hZxhsN:245EH5Ghw
TLSH
T134D69C1D7BE51032C56721799B9F6101F736C00BA219C9AA799CC7DC1FA4A2142BBFF8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_66e3c61322c1b6d9fc979be178306dfa_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-11-11_66e3c61322c1b6d9fc979be178306dfa_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

.exe 12.0MB

2026-11-11_66e3c61322c1b6d9fc979be178306dfa_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

IMPHASH 5e4faedd19d9c4d417c12105cd0f40ef
SHA256 e079a4ea8d347e4eacd872c99b2f1dabf6d0f1993671415fc643b7105d6ff4cd
MD5 66e3c61322c1b6d9fc979be178306dfa
SHA1 d0231ace2d94af929743a893725ed667aa0f9ba9
SHA512 4a008087e6a6077ffbf22bb53ffdcd346e0d4d7fa4a08d08597197c9533dc93648046199171838189e5c52312e116a4a5eafcfa500e4156566004403a28e80a2
SSDEEP 98304:znmQKRICbaWUV+m1oW5lVFwAuHTVk1hZxhsN:245EH5Ghw
TLSH
T134D69C1D7BE51032C56721799B9F6101F736C00BA219C9AA799CC7DC1FA4A2142BBFF8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

RdrCEF.pdb

kernel32

GetNativeSystemInfo CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent CreateEventW TerminateJobObject SetInformationJobObject TerminateProcess GetUserDefaultLangID GetUserDefaultLCID QueryPerformanceFrequency GetSystemTimeAsFileTime QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive VirtualFree VirtualAlloc UnmapViewOfFile CreateFileMappingW MapViewOfFile GetModuleHandleExW UnregisterWaitEx RegisterWaitForSingleObject WriteProcessMemory AssignProcessToJobObject GetFileType SetHandleInformation ProcessIdToSessionId GetProcessHandleCount SignalObjectAndWait ReadFile SetEndOfFile SetFilePointerEx FlushFileBuffers VirtualQuery TlsSetValue TlsAlloc TlsGetValue TlsFree SizeofResource LockResource LoadResource FindResourceW GetFileAttributesW GetVersionExW QueryDosDeviceW VirtualProtectEx QueryFullProcessImageNameW VirtualFreeEx CreateJobObjectW CreateNamedPipeW CreateRemoteThread CreateProcessW CreateDirectoryW RtlCaptureStackBackTrace SetUnhandledExceptionFilter ReadProcessMemory DebugBreak lstrlenW SearchPathW FindFirstFileExW FindNextFileW FindClose LoadLibraryW WideCharToMultiByte ReleaseSRWLockShared AcquireSRWLockShared QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation CreateTimerQueue FreeLibraryAndExitThread ExitThread GetExitCodeThread TryEnterCriticalSection AreFileApisANSI DeviceIoControl CreateEventA CancelIoEx DisconnectNamedPipe LocalFree CreateThread RaiseException GetThreadPriority GetCurrentThread Sleep DuplicateHandle GetCurrentThreadId WaitForSingleObject SetThreadPriority IsDebuggerPresent GetThreadId GetModuleHandleA VirtualQueryEx VirtualAllocEx GetTickCount FormatMessageA GetCurrentProcessId GetCurrentDirectoryW GetLocalTime CreateFileW GetModuleFileNameW OutputDebugStringA WriteFile SetLastError HeapAlloc HeapReAlloc HeapSize HeapFree HeapDestroy HeapCreate GetSystemInfo VerifyVersionInfoW SetDllDirectoryW GetProcAddress GetModuleHandleW GetCurrentProcess CreateMutexW ReleaseMutex HeapSetInformation GetProcessHeap GetLastError CloseHandle GetCommandLineW ConnectNamedPipe CancelSynchronousIo GetLongPathNameW VerSetConditionMask ReadConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage VirtualProtect FreeLibrary LoadLibraryExA InitializeSRWLock LocalAlloc TerminateThread SwitchToThread CreateFileMappingA MapViewOfFileEx OpenFileMappingA MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList GetConsoleCP GetConsoleMode ExitProcess SetStdHandle GetStdHandle WriteConsoleW GetACP GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation OutputDebugStringW

user32

CloseWindowStation CloseDesktop GetSystemMetrics GetThreadDesktop GetUserObjectInformationW GetProcessWindowStation SetProcessWindowStation CreateWindowStationW CreateDesktopW

advapi32

GetUserNameW GetSidSubAuthorityCount GetSidSubAuthority GetSecurityInfo SetEntriesInAclW ConvertSidToStringSidW SetThreadToken CreateProcessAsUserW LookupPrivilegeValueW GetTokenInformation EqualSid DuplicateTokenEx DuplicateToken CreateRestrictedToken CreateWellKnownSid CopySid RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegDisablePredefinedCache RevertToSelf SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetSecurityInfo SetTokenInformation SetKernelObjectSecurity GetSecurityDescriptorSacl GetLengthSid GetKernelObjectSecurity GetAce OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegOpenKeyExA RegCloseKey RegOpenKeyA

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath

ole32

CoTaskMemFree

psapi

GetMappedFileNameW

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

383KB

Virtual Size

383KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10.3MB

Virtual Size

10.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_66e3c61322c1b6d9fc979be178306dfa_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

advapi32

shell32

ole32

psapi

generic