2026-08-01_640d282dd21a756d714be57bbb571bab_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_640d282dd21a756d714be57bbb571bab_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos
Size 3.1MB
Sample260802-axla3a1blc
SHA256 6100ed9f986fa53a6669c2dd2babb19ff0bedaafeeaf07a2065ad6653d63638a
MD5 640d282dd21a756d714be57bbb571bab
SHA1 6d829931e29991a7d55b62b2996734441b2d1b6f
SHA512 f684c0f60a8412b3bd98a2c31eec7b5f12ee4557d87061fe9ee277ee18d3e577419c0fdc1586d2aad3408279746a5b06c555e3df0e5a379c608e0bd685c805b9
SSDEEP 49152:aSM/w7vklmq4hCRnElrM4eEjMeyPed9k5ujg22TUf2mn2vNP0RFj2:aOAld4hCsClerd9UQgq2vNP
TLSH
T1A5E59D1CB6458C32E56E027059A99A3B443DAD311B364DCBF3FC7E2E1B705D22A36A53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_640d282dd21a756d714be57bbb571bab_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-08-01_640d282dd21a756d714be57bbb571bab_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

.exe 3.1MB

2026-08-01_640d282dd21a756d714be57bbb571bab_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

IMPHASH ed6ac4a4fd960800ea11f3f03f172828
SHA256 6100ed9f986fa53a6669c2dd2babb19ff0bedaafeeaf07a2065ad6653d63638a
MD5 640d282dd21a756d714be57bbb571bab
SHA1 6d829931e29991a7d55b62b2996734441b2d1b6f
SHA512 f684c0f60a8412b3bd98a2c31eec7b5f12ee4557d87061fe9ee277ee18d3e577419c0fdc1586d2aad3408279746a5b06c555e3df0e5a379c608e0bd685c805b9
SSDEEP 49152:aSM/w7vklmq4hCRnElrM4eEjMeyPed9k5ujg22TUf2mn2vNP0RFj2:aOAld4hCsClerd9UQgq2vNP
TLSH
T1A5E59D1CB6458C32E56E027059A99A3B443DAD311B364DCBF3FC7E2E1B705D22A36A53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1315989

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateToolhelp32Snapshot Process32FirstW OpenProcess Process32NextW GetExitCodeProcess CreateProcessW GlobalFree CopyFileW GetSystemInfo FileTimeToSystemTime SystemTimeToTzSpecificLocalTime MulDiv LCMapStringW lstrcpyW FormatMessageA LoadLibraryA GetTempPathA GetFileAttributesA UnlockFile LockFileEx LockFile SetFilePointer AreFileApisANSI InterlockedIncrement WriteFile GetStdHandle LocalFree LocalAlloc WaitForSingleObject TerminateThread DeleteFileA SetEndOfFile SetFilePointerEx CreateFileA GetPrivateProfileStringA MapViewOfFile CreateFileMappingW OpenFileMappingW UnmapViewOfFile GlobalAlloc SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FlushFileBuffers GetCurrentDirectoryW GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale lstrcmpiW GetACP FindFirstFileExW GetFullPathNameA GetFullPathNameW ExitThread PeekNamedPipe WriteConsoleW GetModuleHandleExW GetFileType GetConsoleCP ReadConsoleW GetConsoleMode RtlUnwind CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualProtect LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait CreateMutexW ReleaseMutex VirtualFree VirtualAlloc GetFileAttributesExW lstrlenW GetDriveTypeW ExitProcess ReadProcessMemory FindResourceExW RaiseException HeapSize HeapReAlloc HeapDestroy OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx ResetEvent SetEvent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW CompareStringW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GlobalUnlock GlobalLock Sleep GetVersionExW MoveFileExW RemoveDirectoryW GetTempPathW GetWindowsDirectoryW GetLocalTime GetCurrentProcessId GetCurrentProcess GetCurrentThread FindClose FindNextFileW FindFirstFileW SizeofResource LockResource LoadResource FindResourceW SetFileTime LocalFileTimeToFileTime SetFileAttributesW DosDateTimeToFileTime TlsGetValue TlsSetValue FreeLibrary GetCurrentThreadId DeleteFileW GetTickCount GetFileAttributesW MultiByteToWideChar WideCharToMultiByte ReadFile GetFileSize CreateFileW CloseHandle CreateThread GetPrivateProfileIntW WritePrivateProfileStringW LoadLibraryW CreateDirectoryW GetLastError QueryPerformanceCounter GetModuleFileNameW GetPrivateProfileStringW QueryPerformanceFrequency SetUnhandledExceptionFilter SetErrorMode HeapFree GetModuleHandleW GetProcAddress GetProcessHeap DecodePointer EncodePointer GetSystemTimeAsFileTime TlsFree TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount SetLastError TryEnterCriticalSection HeapAlloc GetSystemTime

user32

ShowWindow CreateDialogParamW GetWindowRect SetWindowPos EndDialog DestroyWindow GetDlgItem PtInRect SetCursor LoadCursorW DialogBoxParamW PostMessageW WindowFromPoint ClientToScreen FindWindowW IsIconic BringWindowToTop keybd_event InvalidateRect SendMessageW GetFocus SetFocus MoveWindow LoadStringW IsWindow GetDlgItemTextW CallWindowProcW MessageBoxW SetDlgItemInt SetDlgItemTextW GetKeyState GetAsyncKeyState ReleaseCapture ToUnicodeEx GetForegroundWindow MessageBeep SendMessageTimeoutW GetWindowTextW IsWindowVisible OffsetRect SystemParametersInfoW SetCapture SetRect DefWindowProcW BeginPaint EndPaint GetDC UpdateLayeredWindow ReleaseDC ScreenToClient SetRectEmpty UnionRect FillRect GetClientRect GetCursorPos CreateMenu CreatePopupMenu DeleteMenu DestroyMenu SetMenuInfo EnableMenuItem KillTimer SetWindowTextW SetWindowLongW GetDlgItemInt GetWindowLongW SetTimer GetWindowInfo RegisterWindowMessageW EnumDisplayMonitors GetMonitorInfoW MonitorFromPoint CharLowerW FindWindowExW GetSystemMetrics GetDesktopWindow GetClipboardData IsClipboardFormatAvailable SetClipboardData CloseClipboard EmptyClipboard OpenClipboard DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW PostQuitMessage GetKeyboardLayout GetKeyboardLayoutList LoadKeyboardLayoutW GetCaretPos AttachThreadInput GetGUIThreadInfo GetKeyboardState ToAscii GetParent CreateWindowExW RegisterClassExW LoadIconW GetCapture GetWindowThreadProcessId DrawTextW CharNextW CallNextHookEx GetClassNameW UnhookWindowsHookEx SetWindowsHookExW TrackPopupMenu SetForegroundWindow RemoveMenu ModifyMenuW InsertMenuW

gdi32

CreateICW GetPixel DeleteDC BitBlt CreateCompatibleBitmap DeleteObject SelectObject CreateCompatibleDC CreateDIBSection GetStockObject SetTextColor SetBkMode CreateBitmap GetObjectW GetDIBits CreateDCW EnumFontsW CreateSolidBrush CreateFontW GetTextExtentPoint32W ExcludeClipRect GetTextExtentPointW TextOutW MoveToEx LineTo GetDeviceCaps CreatePen

advapi32

SetSecurityInfo LookupAccountSidW GetTokenInformation RegCreateKeyExW SetNamedSecurityInfoW GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx OpenProcessToken RegEnumKeyExW RegQueryInfoKeyW ImpersonateLoggedOnUser RevertToSelf RegCloseKey RegQueryValueExW RegOpenKeyExW GetSecurityDescriptorControl SetSecurityDescriptorDacl AddAccessAllowedAce AddAce EqualSid GetAce InitializeAcl GetLengthSid GetAclInformation GetSecurityDescriptorDacl LookupAccountNameW InitializeSecurityDescriptor

shell32

Shell_NotifyIconW ShellExecuteW SHAppBarMessage SHGetSpecialFolderPathW SHGetFolderPathW

ole32

CoInitialize CreateStreamOnHGlobal CoUninitialize CoCreateInstance

psapi

GetModuleFileNameExW

shlwapi

PathFileExistsW PathFileExistsA

gdiplus

GdiplusStartup GdipDrawImageRectI GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateStringFormat GdipGetFontSize GdipGetFamily GdipCloneFont GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipMeasureString GdipSetStringFormatFlags GdipFillRectangleI GdipGetGenericFontFamilySansSerif GdipGetImageRawFormat GdipCloneBitmapAreaI GdipCreateBitmapFromStream GdipCloneImage GdipDisposeImage GdipBitmapSetPixel GdipBitmapGetPixel GdipSetPenDashStyle GdipDrawLineI GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipFillPath GdipDrawPath GdipSetImageAttributesColorKeys GdipAddPathArcI GdipDeletePath GdipCreatePath GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDeleteFont GdipDrawString GdipSetImageAttributesColorMatrix GdipCreateImageAttributes GdipGetImageHeight GdipGetImageWidth GdipDrawImageRectRectI GdipDrawLine GdipDeletePen GdipCreatePen1 GdipDeleteGraphics GdipCreateFromHDC GdipCreateSolidFill GdipCloneBrush GdipAlloc GdipDeleteBrush GdipDisposeImageAttributes GdipImageSelectActiveFrame GdipGetPropertyItem GdipGetPropertyItemSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipDeletePrivateFontCollection GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipPrivateAddFontFile GdipFree GdipNewPrivateFontCollection GdipNewInstalledFontCollection GdipGetFontCollectionFamilyCount GdipCloneStringFormat GdipAddPathLineI

imm32

ImmGetIMEFileNameW

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

375KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

627KB

Virtual Size

626KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=261, version=23013,

count=42, id=241, version=40116,

count=202, id=243, version=40116,

count=39, id=242, version=40116,

count=48, id=109, productName=VS2005 build 50727, version=50727,

count=7, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=4, id=199, version=41118,

count=28, id=259, version=24123,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=94, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=126, id=261, version=24123,

count=41, id=260, version=24123,

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=558, id=1, productName=Unmarked objects,

count=239, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,