2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 1.6MB
Sample260604-pdhs6ae14k
SHA256 5ae8af70cd0a3361b1b283fca571c21f466306ae29d700c90d5b3c0fa5327ead
MD5 d646a0d7ee48db20e5b491aaec50ed9a
SHA1 71467bbf7865b5e36f9468bc80625219dc73c1a1
SHA512 6e15dc6d96c34653833dcb8ac8ba65b57112b82f2b2370d98a4ef77dba2950a4d5efd8d7571f6066dc3e224294b116f71fc3155adea89f709e4691ca601ab041
SSDEEP 12288:szR5tL/cZdR0HWnGT9QmtGBGwuH5D753MQzjpLRC++fiyST:szR5tLImWGTIGwup58mLY++fiL
TLSH
T13D85C43077E54075F2B22A7299B895548A2AFD994B38C1DFB18C1D1E3B7A981CD70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 1.6MB

2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH e6a4b6e9dcaf8c25d480939075056aae
SHA256 5ae8af70cd0a3361b1b283fca571c21f466306ae29d700c90d5b3c0fa5327ead
MD5 d646a0d7ee48db20e5b491aaec50ed9a
SHA1 71467bbf7865b5e36f9468bc80625219dc73c1a1
SHA512 6e15dc6d96c34653833dcb8ac8ba65b57112b82f2b2370d98a4ef77dba2950a4d5efd8d7571f6066dc3e224294b116f71fc3155adea89f709e4691ca601ab041
SSDEEP 12288:szR5tL/cZdR0HWnGT9QmtGBGwuH5D753MQzjpLRC++fiyST:szR5tLImWGTIGwup58mLY++fiL
TLSH
T13D85C43077E54075F2B22A7299B895548A2AFD994B38C1DFB18C1D1E3B7A981CD70B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

366622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\b0d71a1a28f6c898\Release\Win32\Installer.pdb

gdiplus

GdipDrawImageI GdipCreateBitmapFromStream GdipDrawImageRectI GdiplusShutdown GdiplusStartup GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFile GdipGetImageWidth GdipDisposeImage GdipFillPath GdipFillRectangle GdipDrawLine GdipSetPathGradientCenterPointI GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipAddPathEllipse GdipDeleteFont GdipCreateFontFromDC GdipMeasureString GdipDrawString GdipFillRectangleI GdipDrawPath GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipAddPathArcI GdipAddPathLineI GdipClosePathFigure GdipDeletePath GdipCreatePath GdipDeletePen GdipCreatePen1 GdipCreateLineBrushFromRectI GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipAlloc GdipFree GdipSetPenColor GdipSetLineColors GdipSetSolidFillColor GdipGetImageHeight GdipCloneImage

winhttp

WinHttpSetOption WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpWriteData WinHttpSendRequest WinHttpAddRequestHeaders WinHttpGetProxyForUrl

kernel32

HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetProcAddress GetModuleHandleW GetModuleHandleExW GetLastError FreeResource CopyFileW GetTickCount DeleteFileW GetFileAttributesExW CloseHandle CreateFileW ReadFile FlushFileBuffers GetFileSize GetTempPathW GetTempFileNameW MoveFileW FindFirstFileW FindNextFileW FindClose CreateThread Sleep GetModuleFileNameW CreateDirectoryW GlobalLock WriteFile GlobalUnlock SetEvent WaitForSingleObject TerminateThread InitializeCriticalSectionEx DeleteCriticalSection CreateEventW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection GetVersionExW GetCurrentProcess ExpandEnvironmentStringsW LCMapStringW GetVersion SetLastError SetFilePointer OpenProcess TerminateProcess LoadLibraryW MultiByteToWideChar WaitForMultipleObjects GlobalFree GetSystemTime GetCurrentThreadId GetExitCodeProcess GetFileSizeEx GlobalAlloc UnmapViewOfFile MapViewOfFile CreateFileMappingW MoveFileExW GetNativeSystemInfo HeapSize GetLocalTime RaiseException DecodePointer GetFirmwareEnvironmentVariableW DuplicateHandle GetFileInformationByHandle FileTimeToSystemTime SystemTimeToFileTime GetFileType FileTimeToDosDateTime LocalFree VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA HeapDestroy FindResourceExW FindResourceW LocalAlloc IsWow64Process WriteConsoleW GetSystemInfo GetLocaleInfoW GetCPInfo SetCriticalSectionSpinCount VerSetConditionMask VerifyVersionInfoW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwind LoadLibraryExW ExitProcess GetStdHandle GetACP GetTimeZoneInformation GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle GetConsoleCP GetSystemDirectoryW GetConsoleMode LoadResource LockResource SizeofResource GetVolumePathNameW GetVolumeNameForVolumeMountPointW DeviceIoControl IsDebuggerPresent OutputDebugStringW GetStringTypeW EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetUserDefaultUILanguage CompareStringW SetFilePointerEx GetFileAttributesW

user32

CreateDialogParamW GetWindowLongW GetWindowDC SetDlgItemTextW SetTimer BeginPaint GetPropW SetPropW PostMessageW SendDlgItemMessageW DrawFocusRect GetDialogBaseUnits GetSysColor ExitWindowsEx EndPaint GetWindowRect KillTimer SetWindowTextW SetFocus LoadImageW GetSystemMetrics GetCursorPos GetDesktopWindow DestroyWindow RegisterWindowMessageW EnableWindow GetWindowThreadProcessId GetForegroundWindow AttachThreadInput BringWindowToTop InvalidateRect TrackMouseEvent GetClientRect IsWindowEnabled GetParent ScreenToClient IsWindow DefWindowProcW ReleaseDC GetKeyState DialogBoxParamW GetWindow SetCursor GetDC MessageBoxW SetWindowLongW CallWindowProcW HideCaret SendMessageW ShowWindow SetWindowPos GetDlgItem EndDialog LoadCursorW

gdi32

GetStockObject GetObjectW CreatePatternBrush EnumFontFamiliesExW DeleteObject ExtTextOutW GetTextMetricsW SetBkMode SetTextColor DeleteDC BitBlt SelectObject CreateCompatibleBitmap GetDeviceCaps CreateCompatibleDC CreateFontIndirectW SetBrushOrgEx SetBkColor StretchBlt

advapi32

CryptGetKeyParam CryptAcquireContextW CryptCreateHash CryptHashData CryptVerifySignatureW CryptDestroyHash CryptDestroyKey CryptReleaseContext RegCreateKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExW RegSetValueExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW RegLoadKeyW RegDeleteValueW ControlService QueryServiceStatus RegDeleteKeyW OpenSCManagerW OpenServiceW CloseServiceHandle CryptGetHashParam InitializeSecurityDescriptor SetSecurityDescriptorDacl GetUserNameW AllocateAndInitializeSid LookupAccountSidW FreeSid SystemFunction036 CryptEncrypt CryptExportKey CryptGenKey SetFileSecurityW SetEntriesInAclW RegDeleteKeyExW RegDeleteTreeW RegOpenKeyW CryptImportKey

shell32

Shell_NotifyIconW ShellExecuteExW ShellExecuteW SHGetFolderPathW

ole32

CoSetProxyBlanket CoTaskMemFree CoInitialize CoCreateInstance CoInitializeSecurity CoUninitialize CoInitializeEx GetHGlobalFromStream CreateStreamOnHGlobal CoCreateGuid StringFromCLSID

oleaut32

SysAllocStringByteLen SysFreeString SysAllocString VariantInit SysStringByteLen OleCreatePictureIndirect SysAllocStringLen SysStringLen VariantChangeType VariantClear

shlwapi

StrToIntExW PathFileExistsW PathFindFileNameW PathRemoveExtensionW PathFindExtensionW PathAddBackslashW PathRemoveFileSpecW PathAppendW PathStripPathW SHCopyKeyW

psapi

GetModuleFileNameExW EnumProcesses

uxtheme

SetWindowTheme

crypt32

CryptStringToBinaryW CryptDecodeObjectEx

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoExW GetFileVersionInfoSizeExW

Name

.text

Size

520KB

Virtual Size

519KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

912KB

Virtual Size

911KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_d646a0d7ee48db20e5b491aaec50ed9a_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

gdiplus

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

uxtheme

crypt32

version

generic