2026-07-15_b39ea6f84475b450f4ec5f2c37048bb0_darkgate_elex_luca-stealer_medusalocker_mespinoza_metamorfo_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_b39ea6f84475b450f4ec5f2c37048bb0_darkgate_elex_luca-stealer_medusalocker_mespinoza_metamorfo_njrat_remcos
Size 794KB
Sample260715-e1z1vaet8w
SHA256 ba0b3028cd0a0fa6465c8e48b6d62f7172b67c6ab479fa5ab166c233ed73948f
MD5 b39ea6f84475b450f4ec5f2c37048bb0
SHA1 e98aec5e1308a4a683186e91dde5ef0b9bfd1f82
SHA512 aa2ca210d2c91b0a1e6a0fd532e7ef04ea58523202b3fa21172002e7d12c1728199139ce8eb0c158d1782fc668b43c279bc1e40409f7deaa6b48f62f76706cda
SSDEEP 24576:yIbNZtO8CwIzoKW1novSMmgZM/4h51rIDvp3t0:RNZewIzoKW1novSMmX4hjrCp90
TLSH
T151057B213586C13BD17302719D3CA7AA146EB9701B3496CBA7D80B2E5EB85D25F33B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_b39ea6f84475b450f4ec5f2c37048bb0_darkgate_elex_luca-stealer_medusalocker_mespinoza_metamorfo_njrat_remcos

File Explorer

2026-07-15_b39ea6f84475b450f4ec5f2c37048bb0_darkgate_elex_luca-stealer_medusalocker_mespinoza_metamorfo_njrat_remcos

.exe 794KB

2026-07-15_b39ea6f84475b450f4ec5f2c37048bb0_darkgate_elex_luca-stealer_medusalocker_mespinoza_metamorfo_njrat_remcos

IMPHASH b5b6968940ee904223930476e8a090e2
SHA256 ba0b3028cd0a0fa6465c8e48b6d62f7172b67c6ab479fa5ab166c233ed73948f
MD5 b39ea6f84475b450f4ec5f2c37048bb0
SHA1 e98aec5e1308a4a683186e91dde5ef0b9bfd1f82
SHA512 aa2ca210d2c91b0a1e6a0fd532e7ef04ea58523202b3fa21172002e7d12c1728199139ce8eb0c158d1782fc668b43c279bc1e40409f7deaa6b48f62f76706cda
SSDEEP 24576:yIbNZtO8CwIzoKW1novSMmgZM/4h51rIDvp3t0:RNZewIzoKW1novSMmX4hjrCp90
TLSH
T151057B213586C13BD17302719D3CA7AA146EB9701B3496CBA7D80B2E5EB85D25F33B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

300004

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\jnks\workspace\Pepto_TRUNK_Legacy_Build\Windows\Release\PdsmqConnector.pdb

kernel32

WaitForSingleObject ReleaseMutex CloseHandle FormatMessageW LocalFree InterlockedDecrement DeleteFileW GetModuleFileNameW LoadLibraryW GetProcAddress FreeLibrary VerSetConditionMask VerifyVersionInfoW IsWow64Process GetCurrentProcess GetLocaleInfoW GetSystemPowerStatus FindNextFileW CreateMutexW FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleW LocalAlloc GetTickCount GetLastError CreateThread GetExitCodeThread GetCommandLineW SetEndOfFile HeapSize WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA GetOEMCP IsValidCodePage OutputDebugStringA OutputDebugStringW GetTempPathW DebugBreak IsDebuggerPresent GetCurrentThreadId FindClose GetSystemTimeAsFileTime FindFirstFileExW GetProcessHeap CreateFileW SetFilePointerEx ReadFile GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetFileType GetACP GetCommandLineA WriteFile GetStdHandle GetModuleHandleExW ExitProcess HeapFree HeapReAlloc HeapAlloc SetConsoleMode ReadConsoleInputA GetConsoleMode RtlUnwind RaiseException CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualProtect VirtualFree WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer CompareStringW LCMapStringW QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc

user32

GetSystemMetrics

winspool.drv

GetPrinterW GetJobW EnumPortsW EnumJobsW ClosePrinter OpenPrinterW

advapi32

RegQueryValueExW RegOpenKeyExW FreeSid SetNamedSecurityInfoW SetEntriesInAclW AllocateAndInitializeSid RegCloseKey

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW CommandLineToArgvW SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket StringFromGUID2 CoTaskMemFree

oleaut32

GetErrorInfo SysAllocString SysFreeString VariantInit VariantCopy VariantClear SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement

shlwapi

PathRemoveExtensionW PathFileExistsW PathIsDirectoryW PathRemoveFileSpecW PathCombineW

urlmon

ObtainUserAgentString

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

rpcrt4

UuidCreate

wininet

HttpQueryInfoW InternetConnectW InternetOpenA InternetCloseHandle HttpSendRequestW HttpOpenRequestW InternetReadFile

Name

.text

Size

569KB

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

149KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_b39ea6f84475b450f4ec5f2c37048bb0_darkgate_elex_luca-stealer_medusalocker_mespinoza_metamorfo_njrat_remcos

kernel32

user32

winspool.drv

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

version

rpcrt4

wininet

generic