2026-08-10_bc2efe022bffe3bce2575769c4d22efb_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_bc2efe022bffe3bce2575769c4d22efb_amadey_darkgate_elex_luca-stealer_mespinoza_njrat
Size 1.9MB
Sample260810-cfbreahk3s
SHA256 5824257c18c53bf38512bb7ced0fd35c2624f4c044870374ab717d039b96b9a5
MD5 bc2efe022bffe3bce2575769c4d22efb
SHA1 ef49687c52b6492c42e4ac23ff3e111011d90c2e
SHA512 9fb91edba62b609c6b47c9ee2f5d2b892ba7bd9d1600153aa9b1855094d1e41233c9bfa89894be099f5c5bcc3fb92fe477179167bc7cfc61e889aed544d1663d
SSDEEP 49152:Hj9Oy1cyxDY6E39GbNdBOJFEMntZ+1pTa2cdMFR:HjoyRxDdE39GZyJFEMj4pTa2yQR
TLSH
T1A495C005F95290B5C8122172701CF73E5A2C5E168F218DDBC794BDE86F706E2293A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_bc2efe022bffe3bce2575769c4d22efb_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-08-10_bc2efe022bffe3bce2575769c4d22efb_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

.exe 1.9MB

2026-08-10_bc2efe022bffe3bce2575769c4d22efb_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

IMPHASH d1c208dddfa7fff3a29025b687b315e2
SHA256 5824257c18c53bf38512bb7ced0fd35c2624f4c044870374ab717d039b96b9a5
MD5 bc2efe022bffe3bce2575769c4d22efb
SHA1 ef49687c52b6492c42e4ac23ff3e111011d90c2e
SHA512 9fb91edba62b609c6b47c9ee2f5d2b892ba7bd9d1600153aa9b1855094d1e41233c9bfa89894be099f5c5bcc3fb92fe477179167bc7cfc61e889aed544d1663d
SSDEEP 49152:Hj9Oy1cyxDY6E39GbNdBOJFEMntZ+1pTa2cdMFR:HjoyRxDdE39GZyJFEMj4pTa2yQR
TLSH
T1A495C005F95290B5C8122172701CF73E5A2C5E168F218DDBC794BDE86F706E2293A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

964800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

app_shell_updater.exe.pdb

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

advapi32

ChangeServiceConfig2W ChangeServiceConfigW CloseServiceHandle ControlService CreateProcessAsUserW CreateServiceW DeleteService DuplicateToken GetTokenInformation OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW StartServiceW SystemFunction036

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

user32

AllowSetForegroundWindow CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetQueueStatus GetWindowLongW KillTimer LoadStringW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SetTimer SetWindowLongW TranslateMessage UnregisterClassW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CallbackMayRunLong CloseHandle CloseThreadpool CloseThreadpoolWork CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateProcessW CreateThread CreateThreadpool CreateThreadpoolWork CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetBinaryTypeW GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount64 GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MapViewOfFile MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ReplaceFileW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SubmitThreadpoolWork SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolWorkCallbacks WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CLSIDFromString CoCreateInstance CoInitialize CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoSetProxyBlanket CoTaskMemFree CoUninitialize IIDFromString

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathMatchSpecW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

174B

Characteristics

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

629KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_bc2efe022bffe3bce2575769c4d22efb_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

winhttp

advapi32

dbghelp

shell32

user32

winmm

kernel32

ole32

version

userenv

shlwapi

oleaut32

netapi32

iphlpapi

generic