2026-07-28_74a8cbb888f62cc39a059e3237db31c3_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

General

Target
2026-07-28_74a8cbb888f62cc39a059e3237db31c3_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 3.3MB
Sample260729-bbk9lsdp51
SHA256 0f0e02836e292bf44e412eb2a6c853bfc3f7d60557ac0f8a9169b24b87699e0b
MD5 74a8cbb888f62cc39a059e3237db31c3
SHA1 7fe363fef664ad9ca513879ce907f9c822996601
SHA512 f41044030b534e32b0d6b31e93e3d865718c1a6212511367429126a5cf9eb56af5221c74280cd8aa17273599e0b3a13c972d2fa5b048d9f2c0664aaae14a181c
SSDEEP 98304:+gw9lVKaz/0AF7DYoASQie5zRDNyB5BRNgH:cjkSBDEyB5B7M
TLSH
T181F5CF11BAD7C03BE1BB0571192DDB9E90B9BD705E72886B63E42F6E1E308825531F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_74a8cbb888f62cc39a059e3237db31c3_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-07-28_74a8cbb888f62cc39a059e3237db31c3_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 3.3MB

2026-07-28_74a8cbb888f62cc39a059e3237db31c3_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 7cd74d9871762af4ab14a6e0734b0cd7
SHA256 0f0e02836e292bf44e412eb2a6c853bfc3f7d60557ac0f8a9169b24b87699e0b
MD5 74a8cbb888f62cc39a059e3237db31c3
SHA1 7fe363fef664ad9ca513879ce907f9c822996601
SHA512 f41044030b534e32b0d6b31e93e3d865718c1a6212511367429126a5cf9eb56af5221c74280cd8aa17273599e0b3a13c972d2fa5b048d9f2c0664aaae14a181c
SSDEEP 98304:+gw9lVKaz/0AF7DYoASQie5zRDNyB5BRNgH:cjkSBDEyB5B7M
TLSH
T181F5CF11BAD7C03BE1BB0571192DDB9E90B9BD705E72886B63E42F6E1E308825531F63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

854434

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Branch\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW WriteFile CloseHandle DeleteCriticalSection GetLastError InitializeCriticalSectionAndSpinCount HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap RaiseException GetProcAddress GetModuleHandleW EnterCriticalSection InitializeCriticalSection LeaveCriticalSection SizeofResource LockResource LoadResource FindResourceW FindResourceExW lstrcpynW MulDiv WaitForSingleObject LoadLibraryExW DecodePointer GetCurrentThreadId Sleep GetDiskFreeSpaceExW SetLastError CreateEventW SetEvent GetExitCodeThread GetCurrentProcessId CreateDirectoryW GetSystemDirectoryW FreeLibrary lstrlenW GetVersionExW lstrcmpiW LoadLibraryW GetDriveTypeW CompareStringW InterlockedDecrement InterlockedIncrement GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc lstrcmpW GetFileSize ReadFile GlobalFree GetTempPathW GetSystemTime SystemTimeToFileTime GetTempFileNameW DeleteFileW FindFirstFileW RemoveDirectoryW FindNextFileW GetLogicalDriveStringsW GetFileAttributesW SetFileAttributesW GetFileTime CopyFileW FindClose MultiByteToWideChar WideCharToMultiByte InterlockedExchange GetCurrentProcess GetSystemInfo WaitForMultipleObjects VirtualProtect VirtualQuery LoadLibraryExA GetShortPathNameW SetUnhandledExceptionFilter CreateThread FormatMessageW GetEnvironmentVariableW LocalFree LoadLibraryA GetCurrentThread GetFullPathNameW SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo SetFilePointer FlushFileBuffers GetModuleFileNameA CreateProcessW GetExitCodeProcess GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID FileTimeToSystemTime GetWindowsDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW OutputDebugStringW GetLocalTime TerminateThread CreateNamedPipeW ConnectNamedPipe GetStringTypeW GetLocaleInfoA MoveFileW ResetEvent LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree IsDebuggerPresent GetCPInfo TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter RtlUnwind QueryPerformanceFrequency GetACP ExitProcess GetModuleHandleExW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode IsValidCodePage GetOEMCP SetFilePointerEx FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW ReadConsoleW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_74a8cbb888f62cc39a059e3237db31c3_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

kernel32

generic