2026-06-27_d7ab8abf66df192f46bab6a4931cd4c7_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_d7ab8abf66df192f46bab6a4931cd4c7_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos
Size 3.1MB
Sample260629-cwmtlsbs7s
SHA256 9c3fcedc75844421563828084ed6ffd2cca856223ec3700272959f53695c490d
MD5 d7ab8abf66df192f46bab6a4931cd4c7
SHA1 a93fe5db535be9778e8008bd52a7baf9f0ab83a0
SHA512 dbcd6c7db9e63fc83b103e1885c50b2a1d1dfd1a49f70d51de66dab94784208c312cf3db59023af5b1c36c211b3fc18f30e18dbf76f1a32d01a6c278936a885b
SSDEEP 98304:nLA3/do3HYdDn+7oHHtC+lpWMg0TRlaOiY:nNa+7uDlpWMg0TR0Y
TLSH
T131E5BF21BDE24BB3D5230731691EFA3D70BFA964177681D763842B183D702A35B3A267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-27_d7ab8abf66df192f46bab6a4931cd4c7_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-06-27_d7ab8abf66df192f46bab6a4931cd4c7_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos

.exe 3.1MB

2026-06-27_d7ab8abf66df192f46bab6a4931cd4c7_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos

IMPHASH 68ecc5945a5d10068bb63a35b6f1c71e
SHA256 9c3fcedc75844421563828084ed6ffd2cca856223ec3700272959f53695c490d
MD5 d7ab8abf66df192f46bab6a4931cd4c7
SHA1 a93fe5db535be9778e8008bd52a7baf9f0ab83a0
SHA512 dbcd6c7db9e63fc83b103e1885c50b2a1d1dfd1a49f70d51de66dab94784208c312cf3db59023af5b1c36c211b3fc18f30e18dbf76f1a32d01a6c278936a885b
SSDEEP 98304:nLA3/do3HYdDn+7oHHtC+lpWMg0TRlaOiY:nNa+7uDlpWMg0TR0Y
TLSH
T131E5BF21BDE24BB3D5230731691EFA3D70BFA964177681D763842B183D702A35B3A267
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

be:2b:e7:95:a5:de:e3:c4:ef:06:99:3f:1b:39:77:54:ad:f1:6c:ce:af:14:92:08:11:57:77:6f:38:d6:04:1c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Feb 21, 2024

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 25, 2020 - Feb 22, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1480554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\workplace\AndroidEmulator\7KMarket_Git_Release64\Basic\Client\Output\Binfinal\UiTools\MGDetector.pdb

comctl32

_TrackMouseEvent InitCommonControlsEx

kernel32

SetEvent OpenFileMappingW OpenEventW InitializeCriticalSection LeaveCriticalSection ExpandEnvironmentStringsW EnterCriticalSection SetLastError GlobalReAlloc FreeResource GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetCurrentThreadId TlsSetValue TlsGetValue TlsFree TlsAlloc lstrcpynW UnmapViewOfFile MapViewOfFile GetFileInformationByHandle SystemTimeToFileTime GetLocalTime FileTimeToSystemTime DecodePointer RaiseException FormatMessageW GetACP GetTempPathW CopyFileW CreateDirectoryW CreateMutexW FreeLibrary GetVersionExW GetUserDefaultUILanguage GetLocaleInfoW GetFileSize LoadLibraryExW OutputDebugStringW LoadLibraryW GlobalMemoryStatusEx GetSystemInfo IsProcessorFeaturePresent WaitForSingleObject GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDrives GetCurrentDirectoryW GetFullPathNameW FindClose FindNextFileW FindFirstFileW GetFileAttributesExW MultiByteToWideChar WideCharToMultiByte ReadFile SetFilePointer WriteFile GetTickCount DeviceIoControl CreateFileW CloseHandle GetCurrentProcess FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy Sleep DeleteFileW GetFileAttributesW GetModuleHandleW GetProcAddress GetPrivateProfileSectionW GetPrivateProfileIntW GetPrivateProfileStringW GetCommandLineW GetModuleFileNameW GetCurrentProcessId InitializeCriticalSectionAndSpinCount GetLastError CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore VirtualFree GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx GetStdHandle ExitProcess GetFileType SetStdHandle VirtualQuery VirtualAlloc GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread HeapQueryInformation InterlockedFlushSList InterlockedPushEntrySList RtlUnwind GetCPInfo GetStringTypeW LCMapStringW QueryPerformanceFrequency TryEnterCriticalSection InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SearchPathW GetProfileIntW GetTempFileNameW VerifyVersionInfoW VerSetConditionMask GetWindowsDirectoryW lstrcpyW VirtualProtect GlobalFindAtomW SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx FileTimeToLocalFileTime GlobalDeleteAtom GetCurrentThread lstrcmpiW DeleteCriticalSection ResumeThread SetThreadPriority CreateEventW GlobalSize LocalFree MulDiv OutputDebugStringA GetModuleHandleA GlobalHandle LocalAlloc LocalReAlloc lstrcmpA GlobalGetAtomNameW GlobalAddAtomW FlushFileBuffers GetVolumeInformationW LockFile SetEndOfFile UnlockFile DuplicateHandle LoadLibraryA EncodePointer GetSystemDirectoryW CompareStringW GlobalFlags lstrcmpW

user32

SendMessageW PostQuitMessage MessageBoxW GetDesktopWindow GetWindowLongW CallWindowProcW LoadImageW SetRect UpdateWindow ShowWindow GetMenuStringW GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu GetSysColor GetSysColorBrush IsWindowEnabled GetLastActivePopup GetWindowTextLengthW DestroyIcon GetDlgCtrlID GetFocus SetWindowTextW RealChildWindowFromPoint ValidateRect SetScrollPos GetScrollPos MoveWindow CheckDlgButton IsDialogMessageW IsIconic SetForegroundWindow CheckMenuItem EnableMenuItem GetMenuCheckMarkDimensions SetMenuItemInfoW LoadBitmapW GetMessagePos GetMessageTime RegisterClassW IsMenu IsChild GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos GetMenu SetMenu TrackPopupMenu SetActiveWindow GetForegroundWindow ScrollWindow SetScrollRange GetScrollRange ShowScrollBar SetPropW GetPropW RemovePropW AdjustWindowRectEx GetClassLongW GetTopWindow LoadIconW SetScrollInfo GetScrollInfo WinHelpW DispatchMessageW GrayStringW TabbedTextOutW GetWindowDC CopyImage ShowOwnedPopups DeleteMenu CreateDialogIndirectParamW EndDialog GetNextDlgTabItem DestroyMenu GetMenuItemInfoW SendDlgItemMessageA SetRectEmpty GetAsyncKeyState MapDialogRect TrackMouseEvent CreatePopupMenu GetMenuDefaultItem GetNextDlgGroupItem GetIconInfo MessageBeep EnableScrollBar InvertRect NotifyWinEvent MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongW SetParent OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge DrawFrameControl BringWindowToTop SetCursorPos CopyIcon FrameRect DrawIcon MonitorFromPoint LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam GetComboBoxInfo PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect CreateMenu GetWindowRgn DestroyCursor TranslateMessage GetMessageW EnumDisplaySettingsW MonitorFromWindow DrawTextExW GetMonitorInfoW CreateWindowExA RegisterClassExA DefWindowProcW IsWindow CallNextHookEx GetClassInfoW DestroyWindow ReleaseDC GetDC wsprintfW SetMenuItemBitmaps GetWindowThreadProcessId CharUpperW FindWindowA DrawTextW FillRect MapWindowPoints GetWindow PeekMessageW InflateRect DrawFocusRect GetParent SetWindowPos PostMessageW EnableWindow SystemParametersInfoW IsZoomed SetWindowRgn GetActiveWindow RedrawWindow GetWindowTextW GetSystemMenu GetMenuState DrawIconEx GetSystemMetrics GetClassInfoExW GetClassNameW GetCursorPos ScreenToClient WindowFromPoint ClientToScreen SetFocus SendMessageTimeoutW SetCursor HideCaret EndPaint GetWindowRect IsWindowVisible FindWindowExW UpdateLayeredWindow BeginPaint IsRectEmpty InvalidateRect UnionRect RegisterWindowMessageW EqualRect CopyRect GetClientRect KillTimer SetTimer GetKeyState GetCapture ReleaseCapture SetCapture IntersectRect OffsetRect PtInRect RegisterClassExW LoadCursorW GetDlgItem SetWindowLongW UnhookWindowsHookEx CreateWindowExW SetWindowsHookExW

gdi32

GetWindowExtEx IntersectClipRect PtVisible RectVisible RestoreDC GetViewportExtEx GetPixel GetObjectType Escape CreatePatternBrush SetTextColor CreateSolidBrush GetObjectA CombineRgn ExtCreateRegion StretchBlt GetObjectW Rectangle LineTo MoveToEx ExtTextOutW SetBkColor CreateRectRgn ExcludeClipRect BitBlt CreateCompatibleBitmap GetClipBox RoundRect CreatePen GetTextExtentPoint32W SetBkMode GetStockObject DeleteDC SelectObject CreateDIBSection CreateCompatibleDC CreateHatchBrush CreateFontIndirectW GetDeviceCaps SetPixelFormat ChoosePixelFormat SaveDC SelectClipRgn ExtSelectClipRgn SelectPalette SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign TextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP GetTextMetricsW EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette GetBkColor CreateBitmap CreateDCW CopyMetaFileW DeleteObject GetTextFaceW GetViewportOrgEx GetWindowOrgEx SetPixelV SetPaletteEntries ExtFloodFill PtInRegion GetBoundsRect FrameRgn FillRgn OffsetRgn GetRgnBox LPtoDP CreateRoundRectRgn Polyline Polygon CreatePolygonRgn GetTextColor Ellipse CreateEllipticRgn SetDIBColorTable SetPixel GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap

advapi32

RegEnumKeyExW RegSetValueExW RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHCreateDirectoryExW SHGetFolderPathW SHGetPathFromIDListW DragFinish SHGetFileInfoW CommandLineToArgvW SHGetSpecialFolderLocation SHGetDesktopFolder SHBrowseForFolderW SHAppBarMessage ShellExecuteW DragQueryFileW

ole32

OleDestroyMenuDescriptor OleTranslateAccelerator OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CoInitializeEx CoInitialize CoUninitialize CoCreateInstance CoDisconnectObject ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc IsAccelerator CreateStreamOnHGlobal

msimg32

TransparentBlt AlphaBlend

shlwapi

PathRemoveFileSpecW StrFormatByteSizeW PathCombineW PathAppendW PathFindFileNameW PathIsUNCW PathFileExistsW PathStripToRootW PathFindExtensionW StrFormatKBSizeW

uxtheme

GetCurrentThemeName GetThemePartSize GetThemeSysColor DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor IsThemeBackgroundPartiallyTransparent GetWindowTheme IsAppThemed

opengl32

wglDeleteContext wglGetProcAddress glGetString wglMakeCurrent wglCreateContext

netapi32

NetApiBufferFree NetWkstaGetInfo

gdiplus

GdipGetImageHeight GdipDisposeImage GdipCreateFromHDC GdipGetImageWidth GdipAlloc GdipFree GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageRectI GdipDrawImageRectRectI GdipCloneImage GdipGetImagePixelFormat GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipSetInterpolationMode GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipGetImagePaletteSize GdipGetImagePalette GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipMeasureString GdipDrawString GdipSetTextRenderingHint GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipCreateSolidFill GdipDeleteBrush GdipBitmapUnlockBits GdiplusStartup GdipBitmapLockBits GdipCloneBitmapAreaI GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdiplusShutdown

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

oleaut32

VarBstrFromDate VariantChangeType VariantCopy VariantClear SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysAllocStringLen LoadTypeLi SysFreeString VariantInit

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

412KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

692KB

Virtual Size

691KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_d7ab8abf66df192f46bab6a4931cd4c7_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

msimg32

shlwapi

uxtheme

opengl32

netapi32

gdiplus

oleacc

imm32

winmm

winspool.drv

oleaut32

generic