2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat
Size 17.3MB
Sample260807-eep9hsxand
SHA256 616518594c52b47ad53414c9e77e7bfa738bb819fd2363085358932016698099
MD5 83c1c36f5125cd3044e4030ef3b7724b
SHA1 6cce4f11bd3f68b76ec21843d5edf802cc8692e2
SHA512 df7f0c17167dcc47921fcb95fbc57f9ae71fe99b51934c85afbd9e1cd84e7bf40014dc17896820cdf62c769227e352ba75013dde8d088b82a030e093772c9b15
SSDEEP 393216:kFHnfRI67blpTg2osZTK7Kbnlyrgb3zWpuHs8nLbSDV9:Gn7blWQZTKeZyrgvSdKLi
TLSH
T1B9073310B742C1B6E59B12F07D7CAF56973DEE204F6198CBA3C4AE2D49311C26A35B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat

.exe 17.3MB

2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat

IMPHASH 8f2c32ea753b7610a88b6e038d65365a
SHA256 616518594c52b47ad53414c9e77e7bfa738bb819fd2363085358932016698099
MD5 83c1c36f5125cd3044e4030ef3b7724b
SHA1 6cce4f11bd3f68b76ec21843d5edf802cc8692e2
SHA512 df7f0c17167dcc47921fcb95fbc57f9ae71fe99b51934c85afbd9e1cd84e7bf40014dc17896820cdf62c769227e352ba75013dde8d088b82a030e093772c9b15
SSDEEP 393216:kFHnfRI67blpTg2osZTK7Kbnlyrgb3zWpuHs8nLbSDV9:Gn7blWQZTKeZyrgvSdKLi
TLSH
T1B9073310B742C1B6E59B12F07D7CAF56973DEE204F6198CBA3C4AE2D49311C26A35B1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Digest

1b:34:69:f6:74:fe:b8:31:35:4e:41:fd:ba:16:15:d5:9b:40:a1:68:d9:e2:01:eb:1b:d3:15:4d:3a:b8:ae:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=BOOLE SARL,O=BOOLE SARL,L=Champs-sur-Marne,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d696e666f40626f6f6c652e6672

Chains

Aug 6, 2026

CN=BOOLE SARL,O=BOOLE SARL,L=Champs-sur-Marne,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d696e666f40626f6f6c652e6672

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=BOOLE SARL,O=BOOLE SARL,L=Champs-sur-Marne,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d696e666f40626f6f6c652e6672

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=BOOLE SARL,O=BOOLE SARL,L=Champs-sur-Marne,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d696e666f40626f6f6c652e6672

Serial Number

7c:37:0a:4a:dd:e1:34:18:a9:41:f3:68

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 17, 2023 - Oct 6, 2026

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

933232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumResourceLanguagesW SizeofResource LockResource LoadResource FindResourceExW lstrcmpiW ExitProcess IsProcessorFeaturePresent SetFileAttributesW GetModuleHandleW GetProcAddress CloseHandle GetExitCodeProcess WaitForSingleObject CreateProcessW LocalFree WideCharToMultiByte FormatMessageW FormatMessageA SetEndOfFile WriteConsoleW HeapQueryInformation HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW HeapReAlloc GetTimeZoneInformation LCIDToLocaleName SetErrorMode GetErrorMode CreateFileW SetFileTime GetLocaleInfoEx GetCPInfo MultiByteToWideChar LCMapStringW GetSystemTimeAsFileTime GetConsoleMode GetFileSizeEx GetLastError InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection OutputDebugStringW SetLastError GetCurrentThreadId lstrlenW GetCurrentProcess GetCurrentThread GetLocaleInfoW GetUserDefaultLangID SetThreadLocale GetACP GetUserDefaultLCID FindResourceW GetModuleFileNameW FreeLibrary FindClose CreateMutexW CreateSemaphoreW ReleaseMutex ReleaseSemaphore GetCurrentDirectoryW SetCurrentDirectoryW LoadLibraryExW ReadFile WriteFile GetSystemWindowsDirectoryW GetVolumeInformationW GetComputerNameExW GetVersionExW IsWow64Process GetProductInfo SetThreadAffinityMask GetProcessAffinityMask Sleep GetLogicalProcessorInformation GetNativeSystemInfo GetPhysicallyInstalledSystemMemory GlobalMemoryStatusEx DecodePointer EncodePointer MapViewOfFile UnmapViewOfFile OpenFileMappingW GetFileAttributesW IsDebuggerPresent VirtualProtect FlushInstructionCache GetWindowsDirectoryW DeleteFileW RemoveDirectoryW SearchPathW FindFirstFileW CreateDirectoryW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle GetTempPathW CreateFile2 AreFileApisANSI DeviceIoControl CopyFile2 MoveFileExW GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetStringTypeW InitOnceBeginInitialize InitOnceComplete WaitForSingleObjectEx GetExitCodeThread WakeAllConditionVariable InitializeCriticalSectionEx LCMapStringEx CompareStringEx InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId RtlUnwind InterlockedPushEntrySList RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree GetCommandLineA GetCommandLineW TerminateProcess GetModuleHandleExW SetStdHandle GetFileType UnhandledExceptionFilter CreateThread ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler GetStdHandle HeapAlloc HeapFree FlushFileBuffers GetConsoleOutputCP SetFilePointerEx ReadConsoleW GetDateFormatW GetTimeFormatW CompareStringW IsValidLocale EnumSystemLocalesW IsValidCodePage GetOEMCP VirtualQuery

user32

PostMessageW SetWindowLongW GetWindowLongW DialogBoxParamW CreateDialogParamW BeginDeferWindowPos DeferWindowPos EndDeferWindowPos SetDlgItemTextW GetParent OffsetRect EndDialog SetWindowTextW GetDlgItem SendMessageW ShowWindow SetCursor LoadCursorW EnableWindow GetAncestor GetActiveWindow EnumChildWindows DestroyIcon RemoveMenu CharNextW CharUpperBuffW MonitorFromRect EnumThreadWindows GetLastActivePopup GetClassNameW GetWindowTextLengthW EnumDisplayMonitors PtInRect GetMonitorInfoW MonitorFromPoint GetWindowTextW MessageBoxW DispatchMessageW TranslateMessage GetClientRect GetWindowRect IsDialogMessageW PostQuitMessage PeekMessageW LoadImageW CheckDlgButton IsDlgButtonChecked CheckRadioButton SetFocus AppendMenuW ModifyMenuW GetSystemMenu SetWindowPos CreateWindowExW GetSystemMetrics IntersectRect MapWindowPoints

advapi32

RegRestoreKeyW RegSaveKeyW RegCreateKeyExW RegOpenKeyExW RegDeleteTreeW RegSetValueExW RegQueryValueExW RegDeleteValueW RegCloseKey GetUserNameW RegOpenKeyW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFolderPathW SHChangeNotify SHGetKnownFolderPath

ole32

CoInitialize CoUninitialize CoTaskMemFree CoCreateInstance CoSetProxyBlanket CoInitializeEx CoInitializeSecurity

shlwapi

StrIsIntlEqualW PathRemoveBackslashW PathRemoveFileSpecW PathRelativePathToW PathCanonicalizeW PathAppendW PathIsDirectoryW PathRemoveBlanksW PathSearchAndQualifyW PathCommonPrefixW PathGetCharTypeW PathIsRelativeW PathFindNextComponentW PathFindFileNameW

comctl32

InitCommonControlsEx ImageList_Create ord345 ImageList_ReplaceIcon

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

dxgi

CreateDXGIFactory1

secur32

GetUserNameExW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

oleaut32

SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayGetDim SafeArrayUnlock SysAllocString VariantChangeType VariantClear VariantCopy VariantInit SysFreeString SysStringLen

bcrypt

BCryptGetProperty BCryptHashData BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCreateHash BCryptImportKeyPair BCryptVerifySignature

ws2_32

WSACleanup WSAStartup

wintrust

WinVerifyTrust

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

326KB

Virtual Size

325KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

51KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15.7MB

Virtual Size

15.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat

kernel32

user32

advapi32

shell32

ole32

shlwapi

comctl32

version

dxgi

secur32

api-ms-win-core-synch-l1-2-0

oleaut32

bcrypt

ws2_32

wintrust

generic