General
- Target 2026-07-27_e18c7b24adcb5bbaae8f97707279c6ef_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat_remcos
- Size 15.6MB
- Sample260727-gv2ctswfma
- SHA256 4d2025b2b94074ae15d0a2ee3bfb45ae571abdebe60881baf0461e7213991dde
- MD5 e18c7b24adcb5bbaae8f97707279c6ef
- SHA1 019ace361f52ba43a130a42b4d3d8213ea56ae51
- SHA512 7c9d51c35a3ae28283272164f71b2ba490d0559c577b471537a963b0f24a7edbe2cf916b6efeddf5f6513fe0bc09c486f4484defa6247c957fe9f1c202765c16
- SSDEEP 393216:aAU0cJkj6CGdBOakaZv8lh418V+2Gjgg4UDYutbfoD:aAU0iCCB3Fv8lhy2VgguZe
- TLSH T19EF62221B691E926DA610231D97CC6F9405CBD718B2065CFA3D87E1F39F06C26636F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-27_e18c7b24adcb5bbaae8f97707279c6ef_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_e18c7b24adcb5bbaae8f97707279c6ef_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-27_e18c7b24adcb5bbaae8f97707279c6ef_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat_remcos
- Size 15.6MB
- SHA256 4d2025b2b94074ae15d0a2ee3bfb45ae571abdebe60881baf0461e7213991dde
- MD5 e18c7b24adcb5bbaae8f97707279c6ef
- SHA1 019ace361f52ba43a130a42b4d3d8213ea56ae51
- SHA512 7c9d51c35a3ae28283272164f71b2ba490d0559c577b471537a963b0f24a7edbe2cf916b6efeddf5f6513fe0bc09c486f4484defa6247c957fe9f1c202765c16
- SSDEEP 393216:aAU0cJkj6CGdBOakaZv8lh418V+2Gjgg4UDYutbfoD:aAU0iCCB3Fv8lhy2VgguZe
- TLSH T19EF62221B691E926DA610231D97CC6F9405CBD718B2065CFA3D87E1F39F06C26636F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.