2026-07-10_06acd187860ffa5ec25464f0e6ed04c5_darkgate_elex_luca-stealer_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_06acd187860ffa5ec25464f0e6ed04c5_darkgate_elex_luca-stealer_njrat_remcos
Size 15.4MB
Sample260710-21plfaes2l
SHA256 73287da60f1063818aebeb28fbd91d6d1834f97e738adb29ffa0a57f79bfff45
MD5 06acd187860ffa5ec25464f0e6ed04c5
SHA1 d362f97baf3ef4b691a86bb579bcdc6a21962a8c
SHA512 ec5cb3465f7c01ae27730b97b76bdbbbd77ca769a2055eaae746e9d696ad5dc56700e2c8ed40472d7d530c11a505ba6b60de0081022bec27de0a0cd1d9a0ce28
SSDEEP 393216:snrLU34S6QyohR84gbZDiNtefNhsCJPD0N4si:8rL3S6U7gbZDt8CJgN4L
TLSH
T1ECF62321BA41C032E6B642B1967EAB6F057CAE30072590D7E3D87D6D6D706C1BB32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-10_06acd187860ffa5ec25464f0e6ed04c5_darkgate_elex_luca-stealer_njrat_remcos

.exe 15.4MB

2026-07-10_06acd187860ffa5ec25464f0e6ed04c5_darkgate_elex_luca-stealer_njrat_remcos

IMPHASH ef61f35b5186aa5c51962b341b7f78a1
SHA256 73287da60f1063818aebeb28fbd91d6d1834f97e738adb29ffa0a57f79bfff45
MD5 06acd187860ffa5ec25464f0e6ed04c5
SHA1 d362f97baf3ef4b691a86bb579bcdc6a21962a8c
SHA512 ec5cb3465f7c01ae27730b97b76bdbbbd77ca769a2055eaae746e9d696ad5dc56700e2c8ed40472d7d530c11a505ba6b60de0081022bec27de0a0cd1d9a0ce28
SSDEEP 393216:snrLU34S6QyohR84gbZDiNtefNhsCJPD0N4si:8rL3S6U7gbZDt8CJgN4L
TLSH
T1ECF62321BA41C032E6B642B1967EAB6F057CAE30072590D7E3D87D6D6D706C1BB32B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

81:aa:bd:95:14:c4:72:54:4c:94:7b:33:52:05:a3:40:85:01:4d:e7:37:82:07:4a:db:ff:9a:2b:da:03:45:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=上海合寿弘正会务服务中心,O=上海合寿弘正会务服务中心,L=上海市,ST=上海市,C=CN

Chains

Jun 22, 2021

CN=上海合寿弘正会务服务中心,O=上海合寿弘正会务服务中心,L=上海市,ST=上海市,C=CN

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=上海合寿弘正会务服务中心,O=上海合寿弘正会务服务中心,L=上海市,ST=上海市,C=CN

Serial Number

e6:ee:df:18:81:8d:b9:f2:64:bb:d7

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 28, 2020 - Aug 29, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

651458

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSACleanup getaddrinfo sendto socket setsockopt ntohs htons getsockopt accept listen ioctlsocket recvfrom gethostname htonl ntohl freeaddrinfo WSAIoctl WSAStartup getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet WSAGetLastError

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

GetSystemDirectoryW GetWindowsDirectoryW lstrcmpiW ResetEvent SetEvent WaitForMultipleObjects LoadLibraryW CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus TlsFree TlsGetValue TlsAlloc TlsSetValue GetModuleHandleExW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetNativeSystemInfo GetVersionExW CreateThread RaiseException IsDebuggerPresent Process32FirstW Process32NextW CreateToolhelp32Snapshot GetProcessId GetCurrentThreadId GetSystemInfo GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime GetModuleHandleW GetThreadPriority QueryPerformanceFrequency GetCurrentThread FileTimeToSystemTime SetThreadPriority FindClose FindNextFileW FindFirstFileExW FindFirstFileW FlushFileBuffers SetFilePointerEx SetEndOfFile GetFileSizeEx CreateEventW GetModuleHandleA ExpandEnvironmentStringsW ResumeThread CreatePipe AssignProcessToJobObject GetStdHandle GetExitCodeProcess OpenProcess DuplicateHandle WaitForSingleObject QueryPerformanceCounter GetDiskFreeSpaceExW FormatMessageA GetCurrentProcessId GetModuleFileNameW OutputDebugStringA LocalFree GetCommandLineW WideCharToMultiByte MultiByteToWideChar CopyFileW MoveFileExW SetCurrentDirectoryW GetCurrentDirectoryW DeleteFileW GetFileAttributesExW SetFileAttributesW GetFileAttributesW CreateFileW GetTempPathW RemoveDirectoryW LoadLibraryExA SizeofResource HeapFree HeapSize GetSystemDirectoryA LockResource HeapReAlloc FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy VerSetConditionMask GetProcessHeap VerifyVersionInfoW GetSystemWow64DirectoryW LoadLibraryA IsBadReadPtr GetLocalTime GetModuleFileNameA GetComputerNameExA SetFilePointer lstrcpynA EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead InitializeCriticalSection SleepEx WaitForSingleObjectEx ExpandEnvironmentStringsA GetFileType PeekNamedPipe HeapCreate FlushInstructionCache MulDiv GetFullPathNameW FreeResource GetVersionExA GlobalAlloc GlobalLock GlobalUnlock DosDateTimeToFileTime lstrcpyA lstrcpyW lstrlenA CreateMutexW WriteConsoleW SetThreadAffinityMask DeviceIoControl CreateFileA GetComputerNameW OutputDebugStringW SetStdHandle GetConsoleCP GetConsoleMode ExitThread FreeLibraryAndExitThread GetACP GetDriveTypeW GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetEnvironmentVariableW WriteFile GetCurrentProcess GetVolumeInformationW ReadFile CreateDirectoryW ExitProcess CloseHandle Sleep CreateMutexA TerminateProcess GetTickCount LoadLibraryExW GetProcAddress FreeLibrary InitializeCriticalSectionAndSpinCount SetLastError GetLastError RtlUnwind

user32

CreatePopupMenu DestroyMenu GetMenuItemCount AppendMenuW TrackPopupMenu GetMenuInfo SetMenuInfo GetMenuItemInfoW SetForegroundWindow SetMenuContextHelpId FillRect InvertRect DrawIconEx OemToCharBuffW CreateIconIndirect CharUpperA WindowFromPoint TrackMouseEvent PtInRect EqualRect IsRectEmpty UnionRect IntersectRect InflateRect CopyRect SetRect SetCursor GetKeyState GetFocus SetFocus IsWindowEnabled DestroyCursor GetMonitorInfoW MonitorFromWindow LoadCursorW GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect GetDlgItem CallWindowProcW MessageBoxA GetWindowThreadProcessId IsMenu CharLowerBuffW SystemParametersInfoW SetWindowLongW SystemParametersInfoA DrawTextW IsWindowVisible GetSystemMetrics ShowWindow SetWindowPos DestroyWindow GetMessageW LoadImageW CreateIconFromResource LoadBitmapW GetSysColor ClientToScreen EnableMenuItem GetIconInfo CharNextW PostMessageW GetWindowLongW wsprintfW SendMessageW MessageBoxW GetActiveWindow PostQuitMessage SetLayeredWindowAttributes KillTimer TranslateMessage GetQueueStatus CallMsgFilterW MsgWaitForMultipleObjectsEx PeekMessageW OffsetRect DestroyIcon GetClassNameW ScreenToClient SetCaretPos HideCaret GetCaretBlinkTime CreateCaret GetCursorPos SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow ReleaseCapture SetCapture GetCapture IsZoomed SetTimer DispatchMessageW RegisterClassExW WaitMessage UnregisterClassW IsIconic IsWindow CreateWindowExW DefWindowProcW

advapi32

QueryServiceConfigW EnumServicesStatusW ConvertSidToStringSidA LookupAccountNameW RegOpenCurrentUser SetSecurityDescriptorDacl InitializeSecurityDescriptor CryptEncrypt CryptImportKey CreateProcessAsUserW RegQueryInfoKeyW SystemFunction036 CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW ChangeServiceConfig2W DeleteService ControlService StartServiceW ChangeServiceConfigW QueryServiceConfig2W OpenServiceW GetAclInformation GetAce EqualSid SetNamedSecurityInfoW CopySid GetNamedSecurityInfoW IsValidSid AddAce InitializeAcl GetLengthSid OpenThreadToken GetUserNameA GetUserNameW AllocateAndInitializeSid OpenProcessToken FreeSid CheckTokenMembership GetTokenInformation

ole32

CoTaskMemAlloc StringFromGUID2 PropVariantClear CoInitializeSecurity CoSetProxyBlanket CoCreateGuid CreateStreamOnHGlobal CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

shlwapi

ord176 PathFileExistsW StrCmpIW PathRemoveFileSpecW PathAppendW StrIsIntlEqualW StrToIntExW

userenv

UnloadUserProfile CreateEnvironmentBlock DestroyEnvironmentBlock

winmm

timeBeginPeriod timeGetTime timeEndPeriod

imm32

ImmAssociateContext ImmReleaseContext ImmGetContext

msimg32

GradientFill AlphaBlend

gdiplus

GdipGetImageEncoders GdipBitmapUnlockBits GdipDrawImageRectI GdipGraphicsClear GdipDeleteGraphics GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCreateBitmapFromStream GdipGetImageEncodersSize

iphlpapi

GetAdaptersInfo

gdi32

RoundRect RestoreDC RectInRegion PtInRegion Pie OffsetRgn IntersectClipRect GetTextExtentPoint32W GetTextColor GetRgnBox GetClipRgn ExcludeClipRect Ellipse BitBlt CreateRectRgnIndirect CreateRectRgn CreatePatternBrush CreatePen CreateEllipticRgnIndirect CombineRgn Arc SaveDC GetCurrentObject SetViewportOrgEx CreateCompatibleBitmap StretchBlt GetObjectW SetBkMode Rectangle GetStockObject GetClipBox CreateSolidBrush CreateFontIndirectW SelectObject DeleteDC CreateCompatibleDC CreateBitmap EnumFontsW SetGraphicsMode GetDeviceCaps CreateRoundRectRgn DeleteObject ExtSelectClipRgn SetRectRgn SetROP2 SetTextColor GetWorldTransform SetWorldTransform CreateDIBSection ExtCreatePen Polyline CreateDIBitmap CreateDCW StretchDIBits GetViewportOrgEx

oleaut32

SysFreeString SysAllocString VariantClear

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChain

wininet

InternetConnectW HttpSendRequestA InternetOpenA InternetCheckConnectionW InternetCrackUrlW HttpOpenRequestW InternetCloseHandle InternetReadFile HttpQueryInfoW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.ress

Size

11.6MB

Virtual Size

11.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_06acd187860ffa5ec25464f0e6ed04c5_darkgate_elex_luca-stealer_njrat_remcos

ws2_32

version

kernel32

user32

advapi32

ole32

shlwapi

userenv

winmm

imm32

msimg32

gdiplus

iphlpapi

gdi32

oleaut32

crypt32

wininet

generic