2026-07-20_b5ad09fe95cf00b1069519ab7577441b_amadey_darkgate_elex_expiro_hijackloader_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_b5ad09fe95cf00b1069519ab7577441b_amadey_darkgate_elex_expiro_hijackloader_luca-stealer_mespinoza_njrat
Size 1.8MB
Sample260720-vmwdhaay2v
SHA256 e020003b4ab287ca28c4b3bc58ecdc312227f9858074ec992778ae63938949d7
MD5 b5ad09fe95cf00b1069519ab7577441b
SHA1 7f1a4a327473aef23f195f8ee056bafbb4d5d539
SHA512 f90fc4ce34f00c2f3600a88f41c4789c9a477793555ac417a1442c36d2d8c839e5a2e3d75385e1b534f1c347da5a070c7193746e0f13852f0e6a8f6c641d24aa
SSDEEP 24576:ljnT6k9lPBtwC7KEg6hMLFMGyY9xSosZ9T74yU6csqjnhMgeiCl7G0nehbGZpbD:l/lPBqC7KKYFBcZJ7LuDmg27RnWGj
TLSH
T15C95E010B591E036D4032132526DF33DAA39AA064F308ED7D3C99DACAFB51D15E366AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_b5ad09fe95cf00b1069519ab7577441b_amadey_darkgate_elex_expiro_hijackloader_luca-stealer_mespinoza_njrat

File Explorer

2026-07-20_b5ad09fe95cf00b1069519ab7577441b_amadey_darkgate_elex_expiro_hijackloader_luca-stealer_mespinoza_njrat

.exe 1.8MB

2026-07-20_b5ad09fe95cf00b1069519ab7577441b_amadey_darkgate_elex_expiro_hijackloader_luca-stealer_mespinoza_njrat

IMPHASH ebf7996c66246e1df14a95f0364d80d8
SHA256 e020003b4ab287ca28c4b3bc58ecdc312227f9858074ec992778ae63938949d7
MD5 b5ad09fe95cf00b1069519ab7577441b
SHA1 7f1a4a327473aef23f195f8ee056bafbb4d5d539
SHA512 f90fc4ce34f00c2f3600a88f41c4789c9a477793555ac417a1442c36d2d8c839e5a2e3d75385e1b534f1c347da5a070c7193746e0f13852f0e6a8f6c641d24aa
SSDEEP 24576:ljnT6k9lPBtwC7KEg6hMLFMGyY9xSosZ9T74yU6csqjnhMgeiCl7G0nehbGZpbD:l/lPBqC7KKYFBcZJ7LuDmg27RnWGj
TLSH
T15C95E010B591E036D4032132526DF33DAA39AA064F308ED7D3C99DACAFB51D15E366AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

494896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

courgette.exe.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateEventW CreateFileMappingW CreateFileW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessTimes GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MapViewOfFile MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureStackBackTrace RtlUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

CommandLineToArgvW

shlwapi

PathMatchSpecW

winmm

timeGetTime

advapi32

EventRegister EventUnregister EventWriteTransfer RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

Name

.text

Size

625KB

Virtual Size

625KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

249B

Characteristics

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_b5ad09fe95cf00b1069519ab7577441b_amadey_darkgate_elex_expiro_hijackloader_luca-stealer_mespinoza_njrat

kernel32

shell32

shlwapi

winmm

advapi32

dbghelp

generic