2026-07-31_28fbbad1422dbfeba17a2b040d2601b6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_28fbbad1422dbfeba17a2b040d2601b6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat
Size 1.9MB
Sample260731-dwt4csshkg
SHA256 c9a422f0809778442da43131f177a189e732d263cb9cc814bc2d9a71172a35e7
MD5 28fbbad1422dbfeba17a2b040d2601b6
SHA1 9612126b6ab0a8ed733c3d7901ec921cf6cec10e
SHA512 ca6e8ae49f1fd502e37afd16a98c4fc69ba23cbe243002180614da4eee1ef766850b2e3216b62ec5b26c73dae2576518434669ecccb70d301f8afbbf58c6b892
SSDEEP 49152:bj9Oy1cyxDY6E39GbNdBOJFEMn/e+wkfSwAeRnkg0Q:bjoyRxDdE39GZyJFEMGNfeRn/0Q
TLSH
T18E95D005F95290B5C8122172705DB73E5A2C4E068F218DDBC3D4BDE86F716E22A366FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_28fbbad1422dbfeba17a2b040d2601b6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-07-31_28fbbad1422dbfeba17a2b040d2601b6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

.exe 1.9MB

2026-07-31_28fbbad1422dbfeba17a2b040d2601b6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

IMPHASH d1c208dddfa7fff3a29025b687b315e2
SHA256 c9a422f0809778442da43131f177a189e732d263cb9cc814bc2d9a71172a35e7
MD5 28fbbad1422dbfeba17a2b040d2601b6
SHA1 9612126b6ab0a8ed733c3d7901ec921cf6cec10e
SHA512 ca6e8ae49f1fd502e37afd16a98c4fc69ba23cbe243002180614da4eee1ef766850b2e3216b62ec5b26c73dae2576518434669ecccb70d301f8afbbf58c6b892
SSDEEP 49152:bj9Oy1cyxDY6E39GbNdBOJFEMn/e+wkfSwAeRnkg0Q:bjoyRxDdE39GZyJFEMGNfeRn/0Q
TLSH
T18E95D005F95290B5C8122172705DB73E5A2C4E068F218DDBC3D4BDE86F716E22A366FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

964800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

app_shell_updater.exe.pdb

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

advapi32

ChangeServiceConfig2W ChangeServiceConfigW CloseServiceHandle ControlService CreateProcessAsUserW CreateServiceW DeleteService DuplicateToken GetTokenInformation OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW StartServiceW SystemFunction036

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

user32

AllowSetForegroundWindow CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetQueueStatus GetWindowLongW KillTimer LoadStringW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SetTimer SetWindowLongW TranslateMessage UnregisterClassW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CallbackMayRunLong CloseHandle CloseThreadpool CloseThreadpoolWork CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateProcessW CreateThread CreateThreadpool CreateThreadpoolWork CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetBinaryTypeW GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount64 GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MapViewOfFile MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ReplaceFileW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SubmitThreadpoolWork SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolWorkCallbacks WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CLSIDFromString CoCreateInstance CoInitialize CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoSetProxyBlanket CoTaskMemFree CoUninitialize IIDFromString

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathMatchSpecW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

174B

Characteristics

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

629KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_28fbbad1422dbfeba17a2b040d2601b6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

winhttp

advapi32

dbghelp

shell32

user32

winmm

kernel32

ole32

version

userenv

shlwapi

oleaut32

netapi32

iphlpapi

generic