2026-08-22_d79793d28478b02884e552c1d6242d1a_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_d79793d28478b02884e552c1d6242d1a_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader
Size 762KB
Sample260822-3clejs1aka
SHA256 09d5c705ebdd33ba7d1cd1d62886386de9c582a518c93b82b7c1e14fa86d1c44
MD5 d79793d28478b02884e552c1d6242d1a
SHA1 a879922ae05951f0f6d4ced1bcfa1481c600f6fe
SHA512 d691bf9967e73a383190ee373d8320d8314b710dfa6229b8159607afc5261bd35543131a4362bd64714f53dd094acaba9bbfae7d49ae7af9372ee40d7c259b96
SSDEEP 12288:P/BzzC+FLFMZ+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tzaZNNyBo4kx929bL3Hnx
TLSH
T135F4DF1276D48125F2B73E3059B882704E3BBCA19E38D68E5399517A0FF2E909D34B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_d79793d28478b02884e552c1d6242d1a_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-08-22_d79793d28478b02884e552c1d6242d1a_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 762KB

2026-08-22_d79793d28478b02884e552c1d6242d1a_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 3b10c306e5333ad6e88a72f32eef1f28
SHA256 09d5c705ebdd33ba7d1cd1d62886386de9c582a518c93b82b7c1e14fa86d1c44
MD5 d79793d28478b02884e552c1d6242d1a
SHA1 a879922ae05951f0f6d4ced1bcfa1481c600f6fe
SHA512 d691bf9967e73a383190ee373d8320d8314b710dfa6229b8159607afc5261bd35543131a4362bd64714f53dd094acaba9bbfae7d49ae7af9372ee40d7c259b96
SSDEEP 12288:P/BzzC+FLFMZ+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tzaZNNyBo4kx929bL3Hnx
TLSH
T135F4DF1276D48125F2B73E3059B882704E3BBCA19E38D68E5399517A0FF2E909D34B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\code32\Mains\ptdevcon\ptdevcon\Win32\MtStaticRt\ptdevcon32.pdb

advapi32

SystemFunction036

kernel32

lstrlenW GetFileAttributesW GetLastError LoadLibraryW GetProcAddress FreeLibrary GetCurrentProcess FormatMessageW CloseHandle LocalFree FileTimeToSystemTime GetDateFormatW CreateMutexW Sleep DecodePointer SetEndOfFile WriteConsoleW HeapSize SetFilePointerEx GetConsoleCP FlushFileBuffers GetFullPathNameW GetProcessHeap SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW GetConsoleMode ReadFile SetStdHandle GetCurrentDirectoryW GetStringTypeW LCMapStringW CompareStringW HeapAlloc HeapFree GetACP GetCommandLineW MultiByteToWideChar WideCharToMultiByte SystemTimeToTzSpecificLocalTime GetTimeZoneInformation CreateFileW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer GetModuleFileNameW RaiseException SetLastError RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW GetFileType PeekNamedPipe DeleteFileW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA

setupapi

CM_Get_Next_Res_Des_Ex SetupDiGetDeviceInstallParamsW SetupDiDestroyDeviceInfoList SetupDiCreateDeviceInfoW SetupDiSetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiGetDeviceInfoListDetailW SetupDiGetDriverInstallParamsW CM_Free_Log_Conf_Handle SetupDiSetDeviceInstallParamsW CM_Free_Res_Des_Handle SetupDiBuildDriverInfoList CM_Get_Res_Des_Data_Size_Ex SetupDiGetDriverInfoDetailW CM_Get_First_Log_Conf_Ex SetupDiEnumDriverInfoW SetupDiDestroyDriverInfoList CM_Get_Res_Des_Data_Ex CM_Get_DevNode_Status_Ex SetupDiCallClassInstaller SetupDiOpenDeviceInfoW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoListExW SetupDiGetClassDevsExW SetupDiClassGuidsFromNameExW SetupDiCreateDeviceInfoList SetupDiGetINFClassW CM_Get_Device_ID_ExW

shell32

SHGetSpecialFolderPathW

user32

LoadStringW CharNextW CharPrevW MessageBoxW

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_d79793d28478b02884e552c1d6242d1a_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader

advapi32

kernel32

setupapi

shell32

user32

generic