2026-07-10_96aa1c7e9595785639da4ff45d7990fe_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_96aa1c7e9595785639da4ff45d7990fe_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat
Size 39.4MB
Sample260710-dal6mact4n
SHA256 df122af9bd85bcf754e4ad41bc8064c5af67364dc061fbb16e3ae441fd036fdb
MD5 96aa1c7e9595785639da4ff45d7990fe
SHA1 102e78de86d2d86510f672012308ccfe25e6f20f
SHA512 954d90b4727a12739d992f53091f86aacbf76efd52c5805555a3a9994ec9b6325d5aa2426e4168b9e0c0723f6861535b7bb63b97b21ec4fbbeb17a687dbfc4c3
SSDEEP 786432:Hq2BMYJxFfuucIVMPPNAs67tR89JCcHdiTR3RdEMr7BP:Hq2BM0Z0ys+mtH61R6MrN
TLSH
T1DB972302F1922031D9BF6DB1FC7CA66A1B29BD195BF184DBB2D41C485EB02C17635F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_96aa1c7e9595785639da4ff45d7990fe_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat

File Explorer

2026-07-10_96aa1c7e9595785639da4ff45d7990fe_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat

.exe 39.4MB

2026-07-10_96aa1c7e9595785639da4ff45d7990fe_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat

IMPHASH f573dbf252ab7086f10ab82ebab00627
SHA256 df122af9bd85bcf754e4ad41bc8064c5af67364dc061fbb16e3ae441fd036fdb
MD5 96aa1c7e9595785639da4ff45d7990fe
SHA1 102e78de86d2d86510f672012308ccfe25e6f20f
SHA512 954d90b4727a12739d992f53091f86aacbf76efd52c5805555a3a9994ec9b6325d5aa2426e4168b9e0c0723f6861535b7bb63b97b21ec4fbbeb17a687dbfc4c3
SSDEEP 786432:Hq2BMYJxFfuucIVMPPNAs67tR89JCcHdiTR3RdEMr7BP:Hq2BM0Z0ys+mtH61R6MrN
TLSH
T1DB972302F1922031D9BF6DB1FC7CA66A1B29BD195BF184DBB2D41C485EB02C17635F8A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

installer.exe.pdb

user32

MessageBoxW

comctl32

InitCommonControlsEx

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateEventW CreateFileW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FindResourceW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LockResource MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlUnwind SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

266KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

235B

Characteristics

Name

.rsrc

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_96aa1c7e9595785639da4ff45d7990fe_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat

user32

comctl32

kernel32

generic