2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat
Size 2.0MB
Sample260930-e2kbsassfz
SHA256 3bf03ba36b0acb175c686dc63a18695fae4d561b85193cf8b97ad6eb0bca0681
MD5 2262036161bdb702048d85ae962975f6
SHA1 9883133a8c8165938ba55614b3855ac27b2cbd0a
SHA512 49120dcdbcd5bf8c0244b91d417347330da5ce2d7103759da7eea8267c7e66aa3db6602431ff3b2bbd4765b9ca53592d361127032d87b6b8f96ea2c8234a3e2f
SSDEEP 49152:HclPBqC7KKYFBGZJ7LxfJ4klKXn6m1gvtlxSGLdrFxz:HclPpEGZXfJ4kigf8G5rFxz
TLSH
T1E7A50111B491E036D8032172652CF339A639E6064F708ED7D3889DAC6FF55D21E3A7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

.exe 2.0MB

2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

IMPHASH ebf7996c66246e1df14a95f0364d80d8
SHA256 3bf03ba36b0acb175c686dc63a18695fae4d561b85193cf8b97ad6eb0bca0681
MD5 2262036161bdb702048d85ae962975f6
SHA1 9883133a8c8165938ba55614b3855ac27b2cbd0a
SHA512 49120dcdbcd5bf8c0244b91d417347330da5ce2d7103759da7eea8267c7e66aa3db6602431ff3b2bbd4765b9ca53592d361127032d87b6b8f96ea2c8234a3e2f
SSDEEP 49152:HclPBqC7KKYFBGZJ7LxfJ4klKXn6m1gvtlxSGLdrFxz:HclPpEGZXfJ4kigf8G5rFxz
TLSH
T1E7A50111B491E036D8032172652CF339A639E6064F708ED7D3889DAC6FF55D21E3A7AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

494896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

courgette.exe.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateEventW CreateFileMappingW CreateFileW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessTimes GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MapViewOfFile MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureStackBackTrace RtlUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

CommandLineToArgvW

shlwapi

PathMatchSpecW

winmm

timeGetTime

advapi32

EventRegister EventUnregister EventWriteTransfer RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

Name

.text

Size

625KB

Virtual Size

625KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

249B

Characteristics

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

kernel32

shell32

shlwapi

winmm

advapi32

dbghelp

generic