2026-07-30_ebe35bed6dbec910b9cb0e38c5b5b4f5_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_ebe35bed6dbec910b9cb0e38c5b5b4f5_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos
Size 3.1MB
Sample260730-va3l2swtbx
SHA256 7b2156af332bea0634cfce5f7045f9f1b7831de356301d3537247e1f48da4318
MD5 ebe35bed6dbec910b9cb0e38c5b5b4f5
SHA1 fdf8aa2a303a6c776c6771d443b14c95e7389c81
SHA512 ad5eae5dd5b2fc124632df9b5698bb0209526e4aa0c0e43fc2170d9b006e38a539e4da24a05bdf53be3a09269dae66776024ac8bf76ba335727ef47173157abc
SSDEEP 98304:tLA3/do3HYdDn+7oH0tC+lpWMg0TRlaOiS:tNa+7xDlpWMg0TR0S
TLSH
T11AE5BF21BDE24BB3D5230731691EFA3D70BFA964177681D763842B183D702A35B3A267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-30_ebe35bed6dbec910b9cb0e38c5b5b4f5_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-07-30_ebe35bed6dbec910b9cb0e38c5b5b4f5_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos

.exe 3.1MB

2026-07-30_ebe35bed6dbec910b9cb0e38c5b5b4f5_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos

IMPHASH 68ecc5945a5d10068bb63a35b6f1c71e
SHA256 7b2156af332bea0634cfce5f7045f9f1b7831de356301d3537247e1f48da4318
MD5 ebe35bed6dbec910b9cb0e38c5b5b4f5
SHA1 fdf8aa2a303a6c776c6771d443b14c95e7389c81
SHA512 ad5eae5dd5b2fc124632df9b5698bb0209526e4aa0c0e43fc2170d9b006e38a539e4da24a05bdf53be3a09269dae66776024ac8bf76ba335727ef47173157abc
SSDEEP 98304:tLA3/do3HYdDn+7oH0tC+lpWMg0TRlaOiS:tNa+7xDlpWMg0TR0S
TLSH
T11AE5BF21BDE24BB3D5230731691EFA3D70BFA964177681D763842B183D702A35B3A267
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

17:03:54:f9:0b:93:67:cc:bf:e1:4d:53:db:1b:6d:64:34:84:41:25:a4:ab:b6:33:23:a1:c1:ee:7f:46:bc:40

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Feb 21, 2024

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 25, 2020 - Feb 22, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1480554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\workplace\AndroidEmulator\7KMarket_Git_Release64\Basic\Client\Output\Binfinal\UiTools\MGDetector.pdb

comctl32

_TrackMouseEvent InitCommonControlsEx

kernel32

SetEvent OpenFileMappingW OpenEventW InitializeCriticalSection LeaveCriticalSection ExpandEnvironmentStringsW EnterCriticalSection SetLastError GlobalReAlloc FreeResource GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetCurrentThreadId TlsSetValue TlsGetValue TlsFree TlsAlloc lstrcpynW UnmapViewOfFile MapViewOfFile GetFileInformationByHandle SystemTimeToFileTime GetLocalTime FileTimeToSystemTime DecodePointer RaiseException FormatMessageW GetACP GetTempPathW CopyFileW CreateDirectoryW CreateMutexW FreeLibrary GetVersionExW GetUserDefaultUILanguage GetLocaleInfoW GetFileSize LoadLibraryExW OutputDebugStringW LoadLibraryW GlobalMemoryStatusEx GetSystemInfo IsProcessorFeaturePresent WaitForSingleObject GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDrives GetCurrentDirectoryW GetFullPathNameW FindClose FindNextFileW FindFirstFileW GetFileAttributesExW MultiByteToWideChar WideCharToMultiByte ReadFile SetFilePointer WriteFile GetTickCount DeviceIoControl CreateFileW CloseHandle GetCurrentProcess FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy Sleep DeleteFileW GetFileAttributesW GetModuleHandleW GetProcAddress GetPrivateProfileSectionW GetPrivateProfileIntW GetPrivateProfileStringW GetCommandLineW GetModuleFileNameW GetCurrentProcessId InitializeCriticalSectionAndSpinCount GetLastError CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore VirtualFree GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx GetStdHandle ExitProcess GetFileType SetStdHandle VirtualQuery VirtualAlloc GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread HeapQueryInformation InterlockedFlushSList InterlockedPushEntrySList RtlUnwind GetCPInfo GetStringTypeW LCMapStringW QueryPerformanceFrequency TryEnterCriticalSection InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SearchPathW GetProfileIntW GetTempFileNameW VerifyVersionInfoW VerSetConditionMask GetWindowsDirectoryW lstrcpyW VirtualProtect GlobalFindAtomW SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx FileTimeToLocalFileTime GlobalDeleteAtom GetCurrentThread lstrcmpiW DeleteCriticalSection ResumeThread SetThreadPriority CreateEventW GlobalSize LocalFree MulDiv OutputDebugStringA GetModuleHandleA GlobalHandle LocalAlloc LocalReAlloc lstrcmpA GlobalGetAtomNameW GlobalAddAtomW FlushFileBuffers GetVolumeInformationW LockFile SetEndOfFile UnlockFile DuplicateHandle LoadLibraryA EncodePointer GetSystemDirectoryW CompareStringW GlobalFlags lstrcmpW

user32

SendMessageW PostQuitMessage MessageBoxW GetDesktopWindow GetWindowLongW CallWindowProcW LoadImageW SetRect UpdateWindow ShowWindow GetMenuStringW GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu GetSysColor GetSysColorBrush IsWindowEnabled GetLastActivePopup GetWindowTextLengthW DestroyIcon GetDlgCtrlID GetFocus SetWindowTextW RealChildWindowFromPoint ValidateRect SetScrollPos GetScrollPos MoveWindow CheckDlgButton IsDialogMessageW IsIconic SetForegroundWindow CheckMenuItem EnableMenuItem GetMenuCheckMarkDimensions SetMenuItemInfoW LoadBitmapW GetMessagePos GetMessageTime RegisterClassW IsMenu IsChild GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos GetMenu SetMenu TrackPopupMenu SetActiveWindow GetForegroundWindow ScrollWindow SetScrollRange GetScrollRange ShowScrollBar SetPropW GetPropW RemovePropW AdjustWindowRectEx GetClassLongW GetTopWindow LoadIconW SetScrollInfo GetScrollInfo WinHelpW DispatchMessageW GrayStringW TabbedTextOutW GetWindowDC CopyImage ShowOwnedPopups DeleteMenu CreateDialogIndirectParamW EndDialog GetNextDlgTabItem DestroyMenu GetMenuItemInfoW SendDlgItemMessageA SetRectEmpty GetAsyncKeyState MapDialogRect TrackMouseEvent CreatePopupMenu GetMenuDefaultItem GetNextDlgGroupItem GetIconInfo MessageBeep EnableScrollBar InvertRect NotifyWinEvent MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongW SetParent OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge DrawFrameControl BringWindowToTop SetCursorPos CopyIcon FrameRect DrawIcon MonitorFromPoint LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam GetComboBoxInfo PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect CreateMenu GetWindowRgn DestroyCursor TranslateMessage GetMessageW EnumDisplaySettingsW MonitorFromWindow DrawTextExW GetMonitorInfoW CreateWindowExA RegisterClassExA DefWindowProcW IsWindow CallNextHookEx GetClassInfoW DestroyWindow ReleaseDC GetDC wsprintfW SetMenuItemBitmaps GetWindowThreadProcessId CharUpperW FindWindowA DrawTextW FillRect MapWindowPoints GetWindow PeekMessageW InflateRect DrawFocusRect GetParent SetWindowPos PostMessageW EnableWindow SystemParametersInfoW IsZoomed SetWindowRgn GetActiveWindow RedrawWindow GetWindowTextW GetSystemMenu GetMenuState DrawIconEx GetSystemMetrics GetClassInfoExW GetClassNameW GetCursorPos ScreenToClient WindowFromPoint ClientToScreen SetFocus SendMessageTimeoutW SetCursor HideCaret EndPaint GetWindowRect IsWindowVisible FindWindowExW UpdateLayeredWindow BeginPaint IsRectEmpty InvalidateRect UnionRect RegisterWindowMessageW EqualRect CopyRect GetClientRect KillTimer SetTimer GetKeyState GetCapture ReleaseCapture SetCapture IntersectRect OffsetRect PtInRect RegisterClassExW LoadCursorW GetDlgItem SetWindowLongW UnhookWindowsHookEx CreateWindowExW SetWindowsHookExW

gdi32

GetWindowExtEx IntersectClipRect PtVisible RectVisible RestoreDC GetViewportExtEx GetPixel GetObjectType Escape CreatePatternBrush SetTextColor CreateSolidBrush GetObjectA CombineRgn ExtCreateRegion StretchBlt GetObjectW Rectangle LineTo MoveToEx ExtTextOutW SetBkColor CreateRectRgn ExcludeClipRect BitBlt CreateCompatibleBitmap GetClipBox RoundRect CreatePen GetTextExtentPoint32W SetBkMode GetStockObject DeleteDC SelectObject CreateDIBSection CreateCompatibleDC CreateHatchBrush CreateFontIndirectW GetDeviceCaps SetPixelFormat ChoosePixelFormat SaveDC SelectClipRgn ExtSelectClipRgn SelectPalette SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign TextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP GetTextMetricsW EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette GetBkColor CreateBitmap CreateDCW CopyMetaFileW DeleteObject GetTextFaceW GetViewportOrgEx GetWindowOrgEx SetPixelV SetPaletteEntries ExtFloodFill PtInRegion GetBoundsRect FrameRgn FillRgn OffsetRgn GetRgnBox LPtoDP CreateRoundRectRgn Polyline Polygon CreatePolygonRgn GetTextColor Ellipse CreateEllipticRgn SetDIBColorTable SetPixel GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap

advapi32

RegEnumKeyExW RegSetValueExW RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHCreateDirectoryExW SHGetFolderPathW SHGetPathFromIDListW DragFinish SHGetFileInfoW CommandLineToArgvW SHGetSpecialFolderLocation SHGetDesktopFolder SHBrowseForFolderW SHAppBarMessage ShellExecuteW DragQueryFileW

ole32

OleDestroyMenuDescriptor OleTranslateAccelerator OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CoInitializeEx CoInitialize CoUninitialize CoCreateInstance CoDisconnectObject ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc IsAccelerator CreateStreamOnHGlobal

msimg32

TransparentBlt AlphaBlend

shlwapi

PathRemoveFileSpecW StrFormatByteSizeW PathCombineW PathAppendW PathFindFileNameW PathIsUNCW PathFileExistsW PathStripToRootW PathFindExtensionW StrFormatKBSizeW

uxtheme

GetCurrentThemeName GetThemePartSize GetThemeSysColor DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor IsThemeBackgroundPartiallyTransparent GetWindowTheme IsAppThemed

opengl32

wglDeleteContext wglGetProcAddress glGetString wglMakeCurrent wglCreateContext

netapi32

NetApiBufferFree NetWkstaGetInfo

gdiplus

GdipGetImageHeight GdipDisposeImage GdipCreateFromHDC GdipGetImageWidth GdipAlloc GdipFree GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageRectI GdipDrawImageRectRectI GdipCloneImage GdipGetImagePixelFormat GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipSetInterpolationMode GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipGetImagePaletteSize GdipGetImagePalette GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipMeasureString GdipDrawString GdipSetTextRenderingHint GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipCreateSolidFill GdipDeleteBrush GdipBitmapUnlockBits GdiplusStartup GdipBitmapLockBits GdipCloneBitmapAreaI GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdiplusShutdown

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

oleaut32

VarBstrFromDate VariantChangeType VariantCopy VariantClear SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysAllocStringLen LoadTypeLi SysFreeString VariantInit

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

412KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

692KB

Virtual Size

691KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_ebe35bed6dbec910b9cb0e38c5b5b4f5_darkgate_elex_floxif_hijackloader_luca-stealer_medusalocker_mespinoza_njrat_remcos

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

msimg32

shlwapi

uxtheme

opengl32

netapi32

gdiplus

oleacc

imm32

winmm

winspool.drv

oleaut32

generic