2026-08-07_f1e789aa7541221a46eaf75d214c28ee_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_f1e789aa7541221a46eaf75d214c28ee_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos
Size 2.9MB
Sample260807-qz76lseq3w
SHA256 572d507f2e3d256940f6dce33ea94677ee93a81820a02d4ef33d75d5aea57619
MD5 f1e789aa7541221a46eaf75d214c28ee
SHA1 05417d965b5fda47da016c5a41e1cce7145ce38e
SHA512 0a2f4991bd6be762ebcac6b9bb1f2570f34f36cb1f619f29476232d584375fdba7d8834309ce08975b2076ac88daabcb3532a4125d9909b43ba1a1a81940b481
SSDEEP 49152:CPm3C1XZC3dIzcx2etTki0EP3JB9sYdXHuSmsgyFXdAHDkj28ce/4:8qCqizcx2ep06W9sHFuDkaT
TLSH
T198E5D1B3F512C0B2E46349749CADAB654479EEB8432416D7E3D83F2D09315F2263A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_f1e789aa7541221a46eaf75d214c28ee_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-08-07_f1e789aa7541221a46eaf75d214c28ee_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

.exe 2.9MB

2026-08-07_f1e789aa7541221a46eaf75d214c28ee_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

IMPHASH e1a31a6a9fc27fd6027fcca01fd05fdf
SHA256 572d507f2e3d256940f6dce33ea94677ee93a81820a02d4ef33d75d5aea57619
MD5 f1e789aa7541221a46eaf75d214c28ee
SHA1 05417d965b5fda47da016c5a41e1cce7145ce38e
SHA512 0a2f4991bd6be762ebcac6b9bb1f2570f34f36cb1f619f29476232d584375fdba7d8834309ce08975b2076ac88daabcb3532a4125d9909b43ba1a1a81940b481
SSDEEP 49152:CPm3C1XZC3dIzcx2etTki0EP3JB9sYdXHuSmsgyFXdAHDkj28ce/4:8qCqizcx2ep06W9sHFuDkaT
TLSH
T198E5D1B3F512C0B2E46349749CADAB654479EEB8432416D7E3D83F2D09315F2263A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

984845

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins_workspace\installer\src\Release\Installer.pdb

kernel32

SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW FlushFileBuffers GetTimeZoneInformation GetOEMCP IsValidCodePage GetFileAttributesExW MoveFileExW SetStdHandle GetFullPathNameW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx GetModuleHandleExW ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SwitchToThread SignalObjectAndWait CreateTimerQueue InitializeSListHead GetStartupInfoW IsDebuggerPresent LoadLibraryW TerminateProcess UnhandledExceptionFilter ResetEvent SetEvent FindNextFileW FindClose CopyFileW SetUnhandledExceptionFilter GetTickCount GetEnvironmentVariableW WritePrivateProfileStringW GetCommandLineW GetACP MultiByteToWideChar SizeofResource GetCurrentDirectoryW FreeResource LockResource LoadResource GetVersionExW GlobalUnlock GlobalLock GlobalAlloc InitializeCriticalSectionAndSpinCount InterlockedDecrement InterlockedIncrement CreateFileA GetThreadLocale lstrcmpiW WideCharToMultiByte CreateDirectoryW DosDateTimeToFileTime SystemTimeToFileTime SetFileTime SetFilePointer WriteFile GetFileType GetCurrentProcess MulDiv ExitProcess GetLastError CreateFileW FindResourceW CloseHandle GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW CreateEventW GetStringTypeW TryEnterCriticalSection GetCurrentThread WaitForSingleObjectEx QueryPerformanceCounter SetHandleInformation CreatePipe GetDiskFreeSpaceExW ReleaseMutex CreateMutexW GetExitCodeProcess CreateProcessW WTSGetActiveConsoleSessionId OutputDebugStringW ResumeThread GetTempPathW GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc DecodePointer LocalFree ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe SetDllDirectoryW GetProcAddress GetModuleHandleW ReadFile GetSystemDirectoryW DeleteFileA Sleep GetCurrentProcessId GetStdHandle WaitForSingleObject VerifyVersionInfoA GetSystemDirectoryA VerSetConditionMask SleepEx FormatMessageA LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError InterlockedFlushSList InterlockedPushEntrySList RaiseException RtlUnwind EncodePointer GetSystemTimeAsFileTime GetPrivateProfileStringA GetPrivateProfileIntA GetCurrentThreadId GetLocalTime DeleteFileW GetPrivateProfileIntW GetFileSize FreeLibrary DeleteCriticalSection WritePrivateProfileStringA GetNativeSystemInfo LoadLibraryA GetLocaleInfoA GetModuleHandleA InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleFileNameA GetShortPathNameA WriteConsoleW SetEndOfFile DuplicateHandle GetPrivateProfileStringW IsProcessorFeaturePresent GetModuleFileNameW

user32

SendMessageW CreateWindowExW DestroyWindow SetWindowPos IsWindowVisible IsIconic DispatchMessageW TranslateMessage GetMessageW PtInRect IsWindow CharNextW LoadCursorW OffsetRect UnionRect SetFocus GetActiveWindow SetCursor GetWindowRgn GetFocus GetKeyState SetCapture ReleaseCapture SetTimer KillTimer ReleaseDC BeginPaint EndPaint GetUpdateRect GetClientRect wvsprintfW GetDC SetForegroundWindow GetWindowRect GetCursorPos ScreenToClient MapWindowPoints IntersectRect IsRectEmpty GetParent GetWindow CharPrevW MoveWindow PostQuitMessage CallWindowProcW RegisterClassW ShowWindow RegisterClassExW DefWindowProcW SetRect FillRect DrawTextW SetWindowLongW GetWindowLongW InvalidateRect PostMessageW InvalidateRgn CreateAcceleratorTableW GetWindowTextLengthW GetWindowTextW SetWindowTextW GetClassInfoExW EnableWindow GetSystemMetrics SetPropW GetPropW LoadImageW MonitorFromWindow GetMonitorInfoW IsZoomed SetWindowRgn MessageBoxW CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor GetGUIThreadInfo

gdi32

RestoreDC CreatePatternBrush GetDeviceCaps PtInRegion CreateRectRgn GdiFlush ExtTextOutW TextOutW MoveToEx CreateDIBSection SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRoundRectRgn CreateRectRgnIndirect CreatePenIndirect CombineRgn SetWindowOrgEx GetObjectW GetTextMetricsW SelectObject SaveDC Rectangle GetStockObject DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt GetObjectA

shell32

CommandLineToArgvW SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetSpecialFolderPathW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW

ole32

CLSIDFromString CoFreeUnusedLibraries CreateStreamOnHGlobal OleLockRunning CLSIDFromProgID CoInitialize CoCreateInstance CoUninitialize CoCreateGuid

oleaut32

SysAllocString VariantClear VariantInit SysFreeString

ws2_32

WSAStartup ioctlsocket WSAGetLastError __WSAFDIsSet select WSASetLastError recv send bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAIoctl getaddrinfo freeaddrinfo accept listen recvfrom sendto gethostname htonl ntohl WSACleanup

advapi32

CheckTokenMembership CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptGenRandom CryptReleaseContext CryptAcquireContextA AllocateAndInitializeSid FreeSid RegCreateKeyExW RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW

crypt32

CertFreeCertificateContext

wldap32

ord27 ord32 ord33 ord35 ord26 ord30 ord200 ord301 ord41 ord22 ord50 ord60 ord211 ord46 ord79 ord143

gdiplus

GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipSetCompositingQuality GdipSetSmoothingMode GdipDisposeImage GdiplusShutdown GdipAlloc GdipCloneImage GdipGetImageHeight GdipGetImageWidth GdipCreateFromHDC GdipDeleteGraphics GdiplusStartup GdipFree GdipGetPropertyItemSize GdipDrawImageRectI GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipGetPropertyItem GdipGetImageGraphicsContext GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStream GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipGetFamily GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDeleteFontFamily GdipDrawImage GdipGraphicsClear GdipSetInterpolationMode

shlwapi

StrCmpW PathFileExistsW PathRemoveFileSpecW PathStripPathW PathRelativePathToW

urlmon

URLDownloadToFileW

winmm

timeGetTime

comctl32

ord17 _TrackMouseEvent

imm32

ImmGetContext ImmSetCompositionFontW ImmSetCompositionWindow ImmReleaseContext

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

netapi32

NetApiBufferFree NetUserGetInfo

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

276KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=21, id=241, version=40116,

count=187, id=243, version=40116,

count=31, id=242, version=40116,

count=2, id=261, version=23013,

count=7, id=199, version=41118,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=257, version=26213,

count=8, id=260, productName=VS2015 UPD1 build 23506, version=23506,

count=92, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=122, id=261, version=24123,

count=38, id=260, version=24123,

count=28, id=259, version=24123,

count=3, id=261, version=24234,

count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=497, id=1, productName=Unmarked objects,

count=16, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=36, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=49, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,