2026-08-09_93ed05a545047790bac857e2232e8f59_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_93ed05a545047790bac857e2232e8f59_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat
Size 1.8MB
Sample260809-ttm52avsas
SHA256 99aa1f6caba3f60edb951c3ceafeab8d985c7911660c51baba1d8f3bfb1caf41
MD5 93ed05a545047790bac857e2232e8f59
SHA1 7cf9acb7b4ad83426faae5699e1cc137363a7388
SHA512 bd3592ce0a7bba885dff3f56b7d2670a1cdb17d25292f59d64a8028783e6b6a355db27fa4f814d66e319182eec76c7fa843327af0ece68ccdddf238adacc4f85
SSDEEP 24576:6wCwEKgTWxPu2qaWIgjsvMNpIk4Jyyktf6cT1n+mjy+ebzEaQ5:66EK/xPupgGsk/Ik4Jy50csm3OA/5
TLSH
T1DE95AED2758578B2F17E32325BBA7BF442BDAF201631D28B63883D1C59791D27A21363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_93ed05a545047790bac857e2232e8f59_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat

File Explorer

2026-08-09_93ed05a545047790bac857e2232e8f59_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat

.exe 1.8MB

2026-08-09_93ed05a545047790bac857e2232e8f59_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat

IMPHASH 12a561dc397620ac13ca6bd09b70b513
SHA256 99aa1f6caba3f60edb951c3ceafeab8d985c7911660c51baba1d8f3bfb1caf41
MD5 93ed05a545047790bac857e2232e8f59
SHA1 7cf9acb7b4ad83426faae5699e1cc137363a7388
SHA512 bd3592ce0a7bba885dff3f56b7d2670a1cdb17d25292f59d64a8028783e6b6a355db27fa4f814d66e319182eec76c7fa843327af0ece68ccdddf238adacc4f85
SSDEEP 24576:6wCwEKgTWxPu2qaWIgjsvMNpIk4Jyyktf6cT1n+mjy+ebzEaQ5:66EK/xPupgGsk/Ik4Jy50csm3OA/5
TLSH
T1DE95AED2758578B2F17E32325BBA7BF442BDAF201631D28B63883D1C59791D27A21363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

89388

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Code Repository\huduntech\Updater\bin\Win32\Release\HuDunTechUpdate.pdb

kernel32

ResetEvent DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionAndSpinCount GetModuleHandleW GetProcAddress GetTempPathW DeleteFileW OpenProcess OutputDebugStringW DeviceIoControl CreateFileA WideCharToMultiByte DuplicateHandle WaitForSingleObjectEx Sleep GetCurrentProcess GetCurrentThread GetCurrentThreadId EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection FormatMessageW QueryPerformanceCounter SetLastError CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead GlobalLock GlobalUnlock lstrlenW MultiByteToWideChar GetModuleFileNameW GetCurrentDirectoryW GetACP ExitProcess FreeResource LockResource LoadResource SizeofResource FindResourceW GetFileSize ReadFile LocalFree MulDiv GetFileType SetFileTime SystemTimeToFileTime DosDateTimeToFileTime CreateDirectoryW GlobalAlloc GetLocalTime InterlockedIncrement InterlockedDecrement lstrcpyW CreateTimerQueue SetEvent SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait EncodePointer GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind GetSystemInfo VirtualQuery GetFileAttributesExW ExitThread GetModuleHandleExW HeapAlloc HeapFree GetStdHandle GetStringTypeW LCMapStringW GetProcessHeap FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize HeapReAlloc GetConsoleMode ReadConsoleW SetFilePointerEx FlushFileBuffers GetConsoleCP WriteConsoleW WriteFile SetFilePointer GlobalFree VerifyVersionInfoW CreateProcessW VerSetConditionMask CloseHandle GetLastError CreateFileW WaitForSingleObject LoadLibraryW GetFileSizeEx

user32

CreateCaret GetCaretBlinkTime SetCaretPos ScreenToClient MapWindowPoints GetSysColor IntersectRect UnionRect IsRectEmpty PtInRect GetParent LoadImageW SetCursor InflateRect OffsetRect LoadCursorW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW EnableWindow SetPropW GetPropW MonitorFromWindow GetMonitorInfoW SetWindowRgn MessageBoxW UpdateLayeredWindow MoveWindow GetWindowRgn CharPrevW DrawTextW FillRect SetRect CreatePopupMenu DestroyMenu GetClientRect AppendMenuW TrackPopupMenu GetCursorPos ShowCaret GetCaretPos ClientToScreen GetWindowTextW GetWindowTextLengthW IsWindowEnabled CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetKeyboardLayout GetKeyNameTextW MapVirtualKeyExW GetFocus GetActiveWindow SetFocus CharNextW IsZoomed IsIconic SetWindowPos CreateWindowExW PostMessageW DispatchMessageW TranslateMessage GetMessageW InvalidateRect GetUpdateRect EndPaint SetForegroundWindow EnumWindows GetForegroundWindow AttachThreadInput ShowWindow IsWindowVisible GetWindow GetWindowThreadProcessId wsprintfW GetKeyState GetWindowLongW SetWindowLongW BeginPaint ReleaseDC GetDC KillTimer SetTimer ReleaseCapture HideCaret GetWindowRect SetWindowTextW DestroyWindow SendMessageW IsWindow SetCapture EnableMenuItem

advapi32

RegSetValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

DragQueryFileW ShellExecuteExW

ole32

OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal ReleaseStgMedium OleDuplicateData DoDragDrop RegisterDragDrop CoCreateInstance CoUninitialize CoCreateGuid CoInitialize

shlwapi

PathFileExistsW

winhttp

WinHttpSendRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpWriteData WinHttpCloseHandle WinHttpGetProxyForUrl WinHttpReadData WinHttpGetIEProxyConfigForCurrentUser WinHttpAddRequestHeaders WinHttpSetOption WinHttpOpenRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpSetTimeouts WinHttpCrackUrl

ws2_32

gethostbyname WSAStartup gethostname

gdi32

SelectObject CloseEnhMetaFile CreateEnhMetaFileW GetEnhMetaFileHeader PlayEnhMetaFile GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn CreateRectRgn CreateCompatibleBitmap CreateDIBSection CombineRgn CreatePenIndirect CreateRectRgnIndirect GetDeviceCaps GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo RoundRect SaveDC RestoreDC PtInRegion GetStockObject SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode SetBitmapBits GetBitmapBits GdiFlush TextOutW MoveToEx DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateDIBitmap CreateCompatibleDC CreateSolidBrush BitBlt GetObjectA SetTextColor SetStretchBltMode StretchBlt

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipImageSelectActiveFrame GdipGetPropertyItem GdipGetPropertyItemSize GdipDrawImageRectI GdipImageGetFrameCount GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipDrawRectangleI GdipFillRectangleI GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList

Name

.text

Size

613KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

469KB

Virtual Size

469KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

604KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_93ed05a545047790bac857e2232e8f59_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat

kernel32

user32

advapi32

shell32

ole32

shlwapi

winhttp

ws2_32

gdi32

oleaut32

imm32

comctl32

gdiplus

generic