2026-06-30_794450b52d66862b22607bce0ae73e08_darkgate_elex_luca-stealer_njrat_remcos_rhadamanthys_stop

General

Target
2026-06-30_794450b52d66862b22607bce0ae73e08_darkgate_elex_luca-stealer_njrat_remcos_rhadamanthys_stop
Size 3.5MB
Sample260701-evtxmsd18m
SHA256 28bf44dafb218c0258157661ae6d908af455a2021562deb79639ac64a269cb67
MD5 794450b52d66862b22607bce0ae73e08
SHA1 78c17f4d791512e866e27940e48e2fdcaef392e9
SHA512 1fad4333ce09e5e891080eb82a4358b17a8ea5feb8fe146323e7647af60474f3dd6a781f94d340ef7e0c29817a73ba5d5deeab99e8939ade754d8f1e199560b6
SSDEEP 49152:q92iMrOO53RTqtiCbtL2tL4qnstLet3LylfDQBMO+YrovpU/9jcY/+:qHMrOO534V2V4qnstLEcOgh7
TLSH
T1E6064A216AF14435D426F2302575A65CC0767E24CE728A0FB395FEAEBAB96713931333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_794450b52d66862b22607bce0ae73e08_darkgate_elex_luca-stealer_njrat_remcos_rhadamanthys_stop

File Explorer

2026-06-30_794450b52d66862b22607bce0ae73e08_darkgate_elex_luca-stealer_njrat_remcos_rhadamanthys_stop

.exe 3.5MB

2026-06-30_794450b52d66862b22607bce0ae73e08_darkgate_elex_luca-stealer_njrat_remcos_rhadamanthys_stop

IMPHASH c8aa01ee81dfa614588a44bb990de12a
SHA256 28bf44dafb218c0258157661ae6d908af455a2021562deb79639ac64a269cb67
MD5 794450b52d66862b22607bce0ae73e08
SHA1 78c17f4d791512e866e27940e48e2fdcaef392e9
SHA512 1fad4333ce09e5e891080eb82a4358b17a8ea5feb8fe146323e7647af60474f3dd6a781f94d340ef7e0c29817a73ba5d5deeab99e8939ade754d8f1e199560b6
SSDEEP 49152:q92iMrOO53RTqtiCbtL2tL4qnstLet3LylfDQBMO+YrovpU/9jcY/+:qHMrOO534V2V4qnstLEcOgh7
TLSH
T1E6064A216AF14435D426F2302575A65CC0767E24CE728A0FB395FEAEBAB96713931333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

71548

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

P:\Target\x86\ship\delivery\x-none\ose.pdb

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW SetThreadToken RegEnumValueW RegQueryValueExW RegSetValueExW RegNotifyChangeKeyValue SetServiceStatus StartServiceCtrlDispatcherW DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AllocateAndInitializeSid CheckTokenMembership FreeSid LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptReleaseContext SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

GetLastError SetEvent GetModuleFileNameW GetDriveTypeW GetLogicalDrives lstrcmpW lstrlenW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep ExitProcess GetCommandLineW SetErrorMode ResetEvent CloseHandle WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateProcessW GetSystemInfo GetTickCount MoveFileExW CreateFileA CreateFileW ReadFile SetFilePointer FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW DosDateTimeToFileTime MultiByteToWideChar WideCharToMultiByte ReleaseSemaphore WaitForSingleObject ReleaseMutex CreateSemaphoreW CreateThread SetFilePointerEx VirtualAlloc VirtualFree GlobalAlloc GlobalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareStringW SetEndOfFile SetFileTime WriteFile GetSystemTime SystemTimeToFileTime LocalFree FindClose GetTempPathA CreateDirectoryW GetFileAttributesW GetTempPathW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetFileAttributesExW GetFileTime CopyFileW CreateHardLinkW FormatMessageA GetComputerNameW GetCurrentThread HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LoadLibraryExA VirtualQuery VirtualProtect WriteConsoleW DecodePointer FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle LCMapStringW WaitForMultipleObjects GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwind RaiseException SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA GetModuleHandleExW GetACP GetStringTypeW GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW

rpcrt4

RpcServerRegisterIfEx RpcImpersonateClient RpcRevertToSelf NdrServerCall2 RpcServerUnregisterIf RpcServerUseProtseqEpW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_794450b52d66862b22607bce0ae73e08_darkgate_elex_luca-stealer_njrat_remcos_rhadamanthys_stop

advapi32

kernel32

rpcrt4

wintrust

generic