2026-09-07_09741143a596104cce9a4b877e79bab2_badda_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_09741143a596104cce9a4b877e79bab2_badda_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 815KB
Sample260909-jfml8sdk7x
SHA256 abe444e456d09ac8d4ec9f8460e8da5be92eae58952117fa4afb4361ed0d0576
MD5 09741143a596104cce9a4b877e79bab2
SHA1 4164dc24fc5c6e1571f2d8374368309611dccd23
SHA512 65bc70f9de2938cb4392e10b44867c926bfd95e21e35a467ea94063c063afc7a7884749feb46cdec238b72eae70b35f920df2401e48002158599011cc7864d29
SSDEEP 12288:/LFPghVEJN2U7RTSKWqQqkd1BtOkodxduog/TXJa/x82IErOJs7V/QtQbG:MuBSKWNGuog/TXJmxOYI9
TLSH
T1E8059E6BA1D44029D0E0017AEE71F7187DFD6C74EF22E2D3814DD92E28E12D5863DAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_09741143a596104cce9a4b877e79bab2_badda_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-09-07_09741143a596104cce9a4b877e79bab2_badda_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 815KB

2026-09-07_09741143a596104cce9a4b877e79bab2_badda_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH d248e7506bbb57c42ab299a2d816544c
SHA256 abe444e456d09ac8d4ec9f8460e8da5be92eae58952117fa4afb4361ed0d0576
MD5 09741143a596104cce9a4b877e79bab2
SHA1 4164dc24fc5c6e1571f2d8374368309611dccd23
SHA512 65bc70f9de2938cb4392e10b44867c926bfd95e21e35a467ea94063c063afc7a7884749feb46cdec238b72eae70b35f920df2401e48002158599011cc7864d29
SSDEEP 12288:/LFPghVEJN2U7RTSKWqQqkd1BtOkodxduog/TXJa/x82IErOJs7V/QtQbG:MuBSKWNGuog/TXJmxOYI9
TLSH
T1E8059E6BA1D44029D0E0017AEE71F7187DFD6C74EF22E2D3814DD92E28E12D5863DAB6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

843776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\r\ws\St_Make\code\build\win\results\FlashPlayerApp\Release\Win32\FlashPlayerApp.pdb

uxtheme

GetCurrentThemeName

kernel32

GetFileSizeEx CloseHandle CreateDirectoryW GetLastError WideCharToMultiByte GetSystemWow64DirectoryW GetSystemDirectoryW VerSetConditionMask VerifyVersionInfoW GetModuleHandleW GetProcAddress GetCommandLineW SetLastError GetModuleHandleA LoadLibraryA LoadLibraryW GetModuleFileNameW OutputDebugStringA DeleteCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection RaiseException GetCurrentThreadId DecodePointer CreateProcessW WaitForSingleObject GetExitCodeProcess GetUserDefaultUILanguage GetVersionExW CreateFileW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleCP ReadConsoleW GetConsoleMode GetFileType SetFilePointerEx ReadFile LCMapStringW HeapReAlloc HeapSize GetStringTypeW GetFileAttributesW FindClose DeleteFileW FindNextFileW FindFirstFileW SystemTimeToFileTime GetSystemTime RemoveDirectoryW MultiByteToWideChar WriteConsoleW FlushFileBuffers SetEndOfFile GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess RtlUnwind LoadLibraryExW FreeLibrary TlsFree IsDebuggerPresent OutputDebugStringW EncodePointer HeapAlloc HeapFree GetProcessHeap InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TlsAlloc TlsGetValue TlsSetValue

user32

GetDesktopWindow SendMessageW SetWindowPos CreateWindowExW MapWindowPoints ClientToScreen ReleaseDC GetDC GetNextDlgTabItem GetFocus EndDialog GetWindowTextW GetWindowTextLengthW SetFocus DestroyWindow CallWindowProcW DefWindowProcW MoveWindow GetWindowRect GetClientRect DialogBoxParamW GetActiveWindow MessageBoxW SetWindowLongW GetParent GetWindowLongW GetWindow EnableWindow ShowWindow GetDlgItem SetWindowTextW UnregisterClassW

gdi32

SelectObject GetTextExtentPoint32W

advapi32

CheckTokenMembership AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA FreeSid

shell32

SHGetFolderPathW ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW SHFileOperationW

ole32

CoTaskMemFree

Name

.text

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

499KB

Virtual Size

499KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.BadDay

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_09741143a596104cce9a4b877e79bab2_badda_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

uxtheme

kernel32

user32

gdi32

advapi32

shell32

ole32

generic