2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat
Size 5.4MB
Sample260718-e7ba3abx21
SHA256 6cea63e510c510bfee8255ee3b09ccc4d4ab7b8215105c42847e63660b57d1e4
MD5 2415bc858bdff0c5837c10d2bea00861
SHA1 8d0b5a18236c96a690cb42f5dc947a7c6895239e
SHA512 7dbb9ff0eaaded86023dd3929ffc188d78c97582f11c10c04d5044dac86be31b54dff67920a43930127e19f4b4621154ed49d7d1c113c0504d67b424c0ba868f
SSDEEP 98304:g7BjLAAZv3zEgtVk2xwgglEHgI/K6Je43CZOvXMGWNfaF:g7dAAugtVvwgglNiKCmOvMGWQF
TLSH
T1D346E04F77D9C1EDFAB666719A34465C1F16BCAA9AF5858F0340B10C18F09C04E3BBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat

.exe 5.4MB

2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat

IMPHASH d9a4817194d257cbab785612b66aa924
SHA256 6cea63e510c510bfee8255ee3b09ccc4d4ab7b8215105c42847e63660b57d1e4
MD5 2415bc858bdff0c5837c10d2bea00861
SHA1 8d0b5a18236c96a690cb42f5dc947a7c6895239e
SHA512 7dbb9ff0eaaded86023dd3929ffc188d78c97582f11c10c04d5044dac86be31b54dff67920a43930127e19f4b4621154ed49d7d1c113c0504d67b424c0ba868f
SSDEEP 98304:g7BjLAAZv3zEgtVk2xwgglEHgI/K6Je43CZOvXMGWNfaF:g7dAAugtVvwgglNiKCmOvMGWQF
TLSH
T1D346E04F77D9C1EDFAB666719A34465C1F16BCAA9AF5858F0340B10C18F09C04E3BBA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

81:ce:58:5b:8b:f4:7e:dc:1b:69:6e:3e:af:f6:47:d7:d0:ed:9b:7c:15:de:9c:ea:ee:ee:1f:e0:e0:aa:8f:40

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=National Instruments Corporation,O=National Instruments Corporation,L=Austin,ST=Texas,C=US

Chains

Nov 8, 2019

CN=National Instruments Corporation,O=National Instruments Corporation,L=Austin,ST=Texas,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

21:a4:9a:45:a7:b2:d6:fe:1e:87:47:13:2c:b6:b6:c4:d4:a4:a6:7d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=National Instruments Corporation,O=National Instruments Corporation,L=Austin,ST=Texas,C=US

Chains

Nov 8, 2019

CN=National Instruments Corporation,O=National Instruments Corporation,L=Austin,ST=Texas,C=US

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=National Instruments Corporation,O=National Instruments Corporation,L=Austin,ST=Texas,C=US

Serial Number

56:52:19:1a:be:ac:67:4c:e7:c8:35:5a:d3:d9:c8:0c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 23, 2019 - Jan 23, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=National Instruments Corporation,O=National Instruments Corporation,L=Austin,ST=Texas,C=US

Serial Number

20:34:f2:a4:44:38:1d:89:e8:0e:55:b1:78:0a:3a:5f

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 24, 2019 - Jan 24, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

Major OS version

Entry point

262717

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\agent_work\17\s\nipkgui\objects\preinstall\win32U\i386\msvc-14.0\release\preinstall.pdb

ole32

CoTaskMemFree

kernel32

GetFileInformationByHandle PeekNamedPipe GetFileAttributesA CreateFileA GetThreadUILanguage LoadLibraryW GetModuleHandleW FreeLibrary SizeofResource FindFirstFileExW GetCommandLineW FindNextFileW GetCurrentProcess GetStdHandle WriteFile FindClose WaitForSingleObject CreateFileW FormatMessageW GetLastError AttachConsole GetCurrentThread LockResource CloseHandle FreeConsole LoadResource FindResourceW WriteConsoleW GetProcAddress LocalFree VerSetConditionMask VerifyVersionInfoW GetExitCodeProcess OutputDebugStringW MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId GetModuleFileNameW GetModuleHandleExW GetSystemTimeAsFileTime RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId EncodePointer DecodePointer QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead TerminateProcess GetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindFirstFileW GetFileAttributesW GetFullPathNameW RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointerEx SetFileTime DeviceIoControl GetWindowsDirectoryW CreateDirectoryExW CopyFileW MoveFileExW AreFileApisANSI FormatMessageA SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlUnwind ExitThread ResumeThread ReadFile GetFileType GetConsoleMode ReadConsoleW HeapAlloc HeapFree HeapReAlloc ExitProcess GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP SetStdHandle IsValidCodePage GetACP GetOEMCP FlushFileBuffers GetTimeZoneInformation GetProcessHeap GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize SetFilePointer LoadLibraryA

Name

.text

Size

637KB

Virtual Size

637KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

481KB

Virtual Size

481KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_2415bc858bdff0c5837c10d2bea00861_darkgate_elex_luca-stealer_mespinoza_njrat

PE Signature issue

ole32

kernel32

generic