2026-09-29_e95fd390a253abfa15629df91de17846_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

General

Target
2026-09-29_e95fd390a253abfa15629df91de17846_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 1.7MB
Sample260930-szfgpsybnc
SHA256 d9c89678f9e0197c7012ac3a3792469bb10d1c377b17c32996a761239175e252
MD5 e95fd390a253abfa15629df91de17846
SHA1 5402d5bb1d405aadaab07b129b51030c48ce7b94
SHA512 ea1f5a919979cdde86ed77f4099b8aea0c3ef290e972404efdaee166851e54665f436c15c885a896af00ff0083677b7e0d1ba0f150f3e257e52dfcaa4eebcdb0
SSDEEP 24576:Yp1Q4PNBmv0ZymUEKs2Dy1tWIi+GGWHBqUxiaVZehFT6rY4wlHH:SbHxyl3kfGZHBqUxiaVZyFT6rY4wR
TLSH
T1E9858C707AD7C03BD1761971082DE76EA1B9BA701F72488BA3942F3D1A708D35A31E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_e95fd390a253abfa15629df91de17846_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-09-29_e95fd390a253abfa15629df91de17846_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 1.7MB

2026-09-29_e95fd390a253abfa15629df91de17846_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH eea8f1a5703b1f0584012e1cfa48e7f4
SHA256 d9c89678f9e0197c7012ac3a3792469bb10d1c377b17c32996a761239175e252
MD5 e95fd390a253abfa15629df91de17846
SHA1 5402d5bb1d405aadaab07b129b51030c48ce7b94
SHA512 ea1f5a919979cdde86ed77f4099b8aea0c3ef290e972404efdaee166851e54665f436c15c885a896af00ff0083677b7e0d1ba0f150f3e257e52dfcaa4eebcdb0
SSDEEP 24576:Yp1Q4PNBmv0ZymUEKs2Dy1tWIi+GGWHBqUxiaVZehFT6rY4wlHH:SbHxyl3kfGZHBqUxiaVZyFT6rY4wR
TLSH
T1E9858C707AD7C03BD1761971082DE76EA1B9BA701F72488BA3942F3D1A708D35A31E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

845528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Branch\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW WriteFile CloseHandle DeleteCriticalSection GetLastError InitializeCriticalSectionAndSpinCount HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap RaiseException SetEvent EnterCriticalSection InitializeCriticalSection LeaveCriticalSection SizeofResource LockResource LoadResource FindResourceW FindResourceExW lstrcpynW MulDiv WaitForSingleObject CreateThread GetProcAddress LoadLibraryExW DecodePointer GetCurrentThreadId Sleep GetDiskFreeSpaceExW SetLastError CreateEventW GetExitCodeThread GetCurrentProcessId CreateDirectoryW GetSystemDirectoryW FreeLibrary lstrlenW GetVersionExW lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW InterlockedDecrement InterlockedIncrement GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc lstrcmpW GetTempPathW GetSystemTime SystemTimeToFileTime GetTempFileNameW DeleteFileW FindFirstFileW RemoveDirectoryW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW SetFileAttributesW GetFileTime CopyFileW ReadFile FindClose MultiByteToWideChar WideCharToMultiByte InterlockedExchange GetCurrentProcess GetSystemInfo WaitForMultipleObjects VirtualProtect VirtualQuery LoadLibraryExA GetShortPathNameW GetStringTypeW SetUnhandledExceptionFilter FormatMessageW GetEnvironmentVariableW LocalFree LoadLibraryA GetModuleFileNameA GetCurrentThread GetFullPathNameW SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo SetFilePointer FlushFileBuffers OutputDebugStringW CreateProcessW GetExitCodeProcess GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW MoveFileW ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree IsDebuggerPresent GetCPInfo TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter RtlUnwind QueryPerformanceFrequency GetACP ExitProcess GetModuleHandleExW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode IsValidCodePage GetOEMCP SetFilePointerEx FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW ReadConsoleW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

336KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_e95fd390a253abfa15629df91de17846_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

kernel32

generic