General
- Target 2026-08-25_87427540594a015565821a12833e74ab_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
- Size 20.2MB
- Sample260826-xcp5vaeh64
- SHA256 359e6a1d9656a491976746f4d2e427b286abc81d0d24f3c4a44d3f961d59db6c
- MD5 87427540594a015565821a12833e74ab
- SHA1 55b3356882ad75fe07afc3cc1746e727bd4f728c
- SHA512 f4771c4c550fe4c562f7056dc443f9317b4b06afd26fb62aedbedfdfed5e8e1ad29820fe21e89ec92c94d164a06db9f5f9f5882edb63f70a439d9e4f3c02210f
- SSDEEP 393216:QZhPgisOqLIilO1ESfg+2ss3TUkOEgiu8ASGA9Agi+YwAejJ:QBsOUDZSf6zjUkOEgiuYGbV+YwA0J
- TLSH T11D272331F281A82BEAB205361A3DD69A502CBC751B71D0CFE3D4595E29F19C25732F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-25_87427540594a015565821a12833e74ab_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_87427540594a015565821a12833e74ab_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-25_87427540594a015565821a12833e74ab_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
- Size 20.2MB
- SHA256 359e6a1d9656a491976746f4d2e427b286abc81d0d24f3c4a44d3f961d59db6c
- MD5 87427540594a015565821a12833e74ab
- SHA1 55b3356882ad75fe07afc3cc1746e727bd4f728c
- SHA512 f4771c4c550fe4c562f7056dc443f9317b4b06afd26fb62aedbedfdfed5e8e1ad29820fe21e89ec92c94d164a06db9f5f9f5882edb63f70a439d9e4f3c02210f
- SSDEEP 393216:QZhPgisOqLIilO1ESfg+2ss3TUkOEgiu8ASGA9Agi+YwAejJ:QBsOUDZSf6zjUkOEgiuYGbV+YwA0J
- TLSH T11D272331F281A82BEAB205361A3DD69A502CBC751B71D0CFE3D4595E29F19C25732F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.