Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 02:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_f045acc1dc9c5a77ff0245b03f0b36d2_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_f045acc1dc9c5a77ff0245b03f0b36d2_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
General
- Target 2026-08-27_f045acc1dc9c5a77ff0245b03f0b36d2_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
- Size 8.7MB
- Sample260828-cpakpsem7s
- SHA256 8f16a2efd7554cfa9ec0b6514ff0482003ccd30d44ead9ad2f6f1edb2adb8201
- MD5 f045acc1dc9c5a77ff0245b03f0b36d2
- SHA1 aa6be69ba8d9667456e57351c5a49c35501771f8
- SHA512 cf42b49f498fd4d33a103df14873a0df3704cf9bb504794e6667be510ba603875690a065c993a34d176f07c3498c0da554ee0cab575f4b4bb043d4bb62ced015
- SSDEEP 196608:EP57RVmQy5k6hWgBqY1FpqUHP57RVmQy5:EP5aSgBqWbHP5a
- TLSH T12E962332BA838076D9D210B522BDEBB7196C6525032644C7F3E48E794E701E37B3F666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-27_f045acc1dc9c5a77ff0245b03f0b36d2_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_f045acc1dc9c5a77ff0245b03f0b36d2_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f045acc1dc9c5a77ff0245b03f0b36d2_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1660