2026-07-17_c628a0c1ff7d3d4e0fe79f896a0359fb_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_c628a0c1ff7d3d4e0fe79f896a0359fb_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat_remcos
Size 666KB
Sample260717-jbyhyaes5l
SHA256 cbb5952aff000a3fd72250517bd644f18552ae4d708510b7e9f0483e5541fddb
MD5 c628a0c1ff7d3d4e0fe79f896a0359fb
SHA1 862fd0fb2c0041801551535949ee17af6801b47b
SHA512 aa7958b6fa1847e2227375a3bae047e4cdd6126b67b3822fa04906f7d1d27a4a3bbbde38e18ca1d5a7816813b6d309bd916846f8c6aacca3ac335bcca8702559
SSDEEP 12288:ArVFiAFasywTUzDu7Nwk/dvbKCnGy3tcpFJWQ/cG:ArszD2wk/ICG2ulcG
TLSH
T194E4390172C28075F6B21B710EB9F464096C7D744B14ADDFE7D43A6A4A30AD29A37E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_c628a0c1ff7d3d4e0fe79f896a0359fb_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-07-17_c628a0c1ff7d3d4e0fe79f896a0359fb_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat_remcos

.exe 666KB

2026-07-17_c628a0c1ff7d3d4e0fe79f896a0359fb_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat_remcos

IMPHASH edcc83706096f24ac866bb05a130712b
SHA256 cbb5952aff000a3fd72250517bd644f18552ae4d708510b7e9f0483e5541fddb
MD5 c628a0c1ff7d3d4e0fe79f896a0359fb
SHA1 862fd0fb2c0041801551535949ee17af6801b47b
SHA512 aa7958b6fa1847e2227375a3bae047e4cdd6126b67b3822fa04906f7d1d27a4a3bbbde38e18ca1d5a7816813b6d309bd916846f8c6aacca3ac335bcca8702559
SSDEEP 12288:ArVFiAFasywTUzDu7Nwk/dvbKCnGy3tcpFJWQ/cG:ArszD2wk/ICG2ulcG
TLSH
T194E4390172C28075F6B21B710EB9F464096C7D744B14ADDFE7D43A6A4A30AD29A37E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

245966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\QQMusicChromeView_proj\qbclient\pdb\Release_53\qmbrowser.pdb

qbcore

cef_stream_writer_create_for_handler cef_stream_reader_create_for_file cef_browser_host_create_browser cef_v8value_create_string cef_v8value_create_object cef_v8value_create_function cef_task_runner_get_for_thread cef_string_list_size cef_string_list_value cef_string_list_append cef_string_map_size cef_string_map_key cef_string_map_value cef_string_map_append cef_string_multimap_size cef_string_multimap_key cef_string_multimap_value cef_string_multimap_append cef_string_multimap_alloc cef_string_multimap_free cef_string_list_copy cef_drag_data_create cef_process_message_create cef_cookie_manager_get_global_manager cef_command_line_get_global cef_command_line_create cef_string_map_free cef_string_map_alloc cef_api_hash cef_get_extensions_for_mime_type cef_clear_cache cef_quit_message_loop cef_run_message_loop cef_shutdown cef_initialize cef_execute_process cef_post_delayed_task cef_post_task cef_currently_on cef_string_list_free cef_string_list_alloc cef_string_userfree_utf16_free cef_log cef_string_ascii_to_utf16 cef_string_wide_to_utf8 cef_string_utf16_cmp cef_string_utf8_clear cef_string_utf16_to_utf8 cef_string_utf8_to_utf16 cef_string_utf16_clear cef_string_utf16_set

opengl32

glVertex2i glDrawArrays glTexImage2D glVertex2f glRotatef glColor4f glDisable glPushMatrix glPixelStorei glTexSubImage2D glOrtho glPushAttrib glClearColor glDeleteTextures glTexParameteri glLoadIdentity glBlendFunc glColor3f glLineWidth glMatrixMode glEnd glEnable glGenTextures glBindTexture glHint glBegin glPopAttrib glTexEnvf glClear glInterleavedArrays glViewport glPopMatrix wglMakeCurrent wglDeleteContext wglCreateContext

gdiplus

GdiplusStartup GdiplusShutdown

kernel32

TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead OutputDebugStringW RtlUnwind LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP GetFileType GetCurrentProcess GetModuleFileNameW GetCurrentThreadId DuplicateHandle GetModuleHandleA OpenProcess CreateEventW CloseHandle GetProcAddress GetCurrentProcessId GetModuleHandleW IsDebuggerPresent SetUnhandledExceptionFilter LocalFree GetModuleFileNameA SizeofResource HeapFree TerminateProcess LoadLibraryExA InitializeCriticalSectionAndSpinCount TlsGetValue MultiByteToWideChar Sleep GetLastError LockResource GlobalFree HeapReAlloc RaiseException LoadLibraryW CreateThread FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap FreeLibrary WideCharToMultiByte GetCommandLineW InterlockedDecrement WaitForSingleObject GetFileAttributesW GetTempPathA SetEvent InterlockedIncrement GetTickCount UnmapViewOfFile CreateFileMappingW MapViewOfFile lstrlenW lstrcpynW lstrcatW GlobalSize GlobalAlloc GlobalLock GlobalUnlock SetEnvironmentVariableW GetPrivateProfileStringW GetFileAttributesA GetWindowsDirectoryW GetPrivateProfileIntW SetLastError WritePrivateProfileStringW SetErrorMode GetTempPathW EnterCriticalSection LeaveCriticalSection IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc EncodePointer SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW HeapSize CreateFileW

user32

GetMessageTime SetFocus SetPropW LoadIconW LoadCursorW SetCapture SetCursor GetPropA TrackMouseEvent ReleaseCapture GetDoubleClickTime GetMessageW MessageBoxW DispatchMessageW TranslateMessage GetClientRect GetParent PtInRect GetAncestor ReleaseDC GetCursorPos BeginPaint EndPaint GetWindowLongW SetPropA SetWindowPos PostMessageA IsWindow SetParent SetWindowLongW RegisterWindowMessageW PostMessageW RegisterClipboardFormatW GetWindowThreadProcessId DefWindowProcW GetKeyState GetWindowRect DestroyWindow GetDC IsWindowVisible CreateWindowExW UnionRect ScreenToClient GetSystemMetrics RegisterClassExW WindowFromPoint SetClassLongW GetCapture ClientToScreen IsChild

gdi32

GetDeviceCaps ChoosePixelFormat SetPixelFormat SwapBuffers

comdlg32

GetOpenFileNameW

advapi32

RegOpenKeyW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

DragFinish DragQueryFileW ShellExecuteW CommandLineToArgvW SHGetFolderPathW

ole32

OleInitialize OleUninitialize DoDragDrop CoTaskMemAlloc ReleaseStgMedium RevokeDragDrop RegisterDragDrop CoTaskMemFree

oleaut32

SysAllocString

shlwapi

PathRemoveFileSpecW PathRemoveFileSpecA PathAppendA PathAppendW PathFileExistsW

ws2_32

WSAStartup socket htons WSACleanup bind closesocket

winhttp

WinHttpGetIEProxyConfigForCurrentUser

Name

.text

Size

341KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

7KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

85KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_c628a0c1ff7d3d4e0fe79f896a0359fb_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat_remcos

qbcore

opengl32

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

winhttp

generic