2026-04-16_2fa9b712d5bff0897c38ddd60df0982c_darkgate_elex_glassworm_hawkeye_luca-stealer_mespinoza_njrat_remcos

General

Target
2026-04-16_2fa9b712d5bff0897c38ddd60df0982c_darkgate_elex_glassworm_hawkeye_luca-stealer_mespinoza_njrat_remcos
Size 1.9MB
Sample260416-rbrdmacw2w
SHA256 98ce81c2bc7dccb3f8e7f6392cba3719026fe253c87ff9760990669584f43044
MD5 2fa9b712d5bff0897c38ddd60df0982c
SHA1 37892a9080b445202243efc859d6b727e92d870f
SHA512 865797fbe4c88c6dd6574f48cc304610cb65f9e01f20bdb36179fb680a56f65d998769af0c6205b3577ae1a5aa7e0564263431f44f9157b2d082e7e8b7156d3a
SSDEEP 49152:ImUi6AjW/MUSdGRf3/gwnNTBMydB3II35DMnCIjtAy4:BjxAZv+WCP55e
TLSH
T1AC952A116AA082B9D9720630DE64E63D156DBD60CA13ED4B629C2ECDBBF0DC15A37733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_2fa9b712d5bff0897c38ddd60df0982c_darkgate_elex_glassworm_hawkeye_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-04-16_2fa9b712d5bff0897c38ddd60df0982c_darkgate_elex_glassworm_hawkeye_luca-stealer_mespinoza_njrat_remcos

.exe 1.9MB

2026-04-16_2fa9b712d5bff0897c38ddd60df0982c_darkgate_elex_glassworm_hawkeye_luca-stealer_mespinoza_njrat_remcos

SHA256 98ce81c2bc7dccb3f8e7f6392cba3719026fe253c87ff9760990669584f43044
MD5 2fa9b712d5bff0897c38ddd60df0982c
SHA1 37892a9080b445202243efc859d6b727e92d870f
SHA512 865797fbe4c88c6dd6574f48cc304610cb65f9e01f20bdb36179fb680a56f65d998769af0c6205b3577ae1a5aa7e0564263431f44f9157b2d082e7e8b7156d3a
SSDEEP 49152:ImUi6AjW/MUSdGRf3/gwnNTBMydB3II35DMnCIjtAy4:BjxAZv+WCP55e
TLSH
T1AC952A116AA082B9D9720630DE64E63D156DBD60CA13ED4B629C2ECDBBF0DC15A37733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

312099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\protocolhandler.pdb

Name

.text

Size

317KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

90KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_2fa9b712d5bff0897c38ddd60df0982c_darkgate_elex_glassworm_hawkeye_luca-stealer_mespinoza_njrat_remcos

generic