2026-10-01_b86b6a02b44d034c49230da971a387d5_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_b86b6a02b44d034c49230da971a387d5_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 1.4MB
Sample261002-fffl5swcnc
SHA256 83ec86ec5d9985aeb9fcc7e175c38e5b4ffa21b4f577efe3508b609a22bdfaeb
MD5 b86b6a02b44d034c49230da971a387d5
SHA1 1682ee79f9ef3ff00dcd3c2c26e14eb3d3ec5c9b
SHA512 eabeff17d1fbe9867d8e4aad87e30fbfd87586f860eb772b11bb3fa96ead0b42f944bf3ae76b93728600ca1ebf45c434a89528811ea9abc32bfd7730305d0a9c
SSDEEP 24576:oz5mtteGDlSmoQqsaOkpcthTcMZgA3eM4f:oz0JSrtWthT1ZtOpf
TLSH
T1B6654AD023C7C466D845123A86ECEE6AC828AFF10BA741CB56F43BD91D716DE2B31D16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-10-01_b86b6a02b44d034c49230da971a387d5_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-01_b86b6a02b44d034c49230da971a387d5_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 1.4MB

2026-10-01_b86b6a02b44d034c49230da971a387d5_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 5b0523393d28ba7f1e9eea9af5045663
SHA256 83ec86ec5d9985aeb9fcc7e175c38e5b4ffa21b4f577efe3508b609a22bdfaeb
MD5 b86b6a02b44d034c49230da971a387d5
SHA1 1682ee79f9ef3ff00dcd3c2c26e14eb3d3ec5c9b
SHA512 eabeff17d1fbe9867d8e4aad87e30fbfd87586f860eb772b11bb3fa96ead0b42f944bf3ae76b93728600ca1ebf45c434a89528811ea9abc32bfd7730305d0a9c
SSDEEP 24576:oz5mtteGDlSmoQqsaOkpcthTcMZgA3eM4f:oz0JSrtWthT1ZtOpf
TLSH
T1B6654AD023C7C466D845123A86ECEE6AC828AFF10BA741CB56F43BD91D716DE2B31D16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

f6:85:7e:09:0e:e7:f9:13:f0:55:1e:48:fb:01:dd:75:34:e4:10:d3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=天津迅读科技有限公司,OU=IT,O=天津迅读科技有限公司,ST=天津,C=CN

Chains

Aug 14, 2020

CN=天津迅读科技有限公司,OU=IT,O=天津迅读科技有限公司,ST=天津,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=天津迅读科技有限公司,OU=IT,O=天津迅读科技有限公司,ST=天津,C=CN

Serial Number

25:44:0c:62:56:43:ed:0b:86:28:36:49:88:1d:dc:80

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 31, 2019 - Oct 30, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

603243

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\data_recovery\Output\Bin\Release\convHelper.pdb

kernel32

Process32FirstW Process32NextW SetUnhandledExceptionFilter GetLocalTime IsBadReadPtr VirtualProtect ExitProcess LocalFree UnmapViewOfFile SetEndOfFile CreateFileMappingW MapViewOfFile RemoveDirectoryW GetLongPathNameW DeviceIoControl lstrcmpA OpenEventW OpenFileMappingW GetThreadLocale SetThreadLocale SetErrorMode ReadFile GetFileSize WideCharToMultiByte LoadLibraryW GetExitCodeProcess CreateProcessW CreateDirectoryW WriteConsoleW FlushFileBuffers DeleteFileW SetEnvironmentVariableA FreeEnvironmentStringsW CreateToolhelp32Snapshot GetCommandLineA GetOEMCP IsValidCodePage SetFileAttributesW GetTimeZoneInformation GetConsoleCP SetStdHandle ReadConsoleW GetConsoleMode SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileType GetACP GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind QueryPerformanceCounter UnhandledExceptionFilter WaitForSingleObjectEx GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent GetStartupInfoW CreatePipe GetEnvironmentStringsW MoveFileExW CreateMutexW GetQueuedCompletionStatus InterlockedExchange CreateIoCompletionPort CreateEventW GetExitCodeThread GetSystemInfo PostQueuedCompletionStatus Sleep WaitForSingleObject SetProcessShutdownParameters WriteFile OutputDebugStringW CloseHandle SetFilePointer CreateFileW TerminateProcess DecodePointer GetCommandLineW SetEvent ResetEvent GetNativeSystemInfo lstrlenA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FindClose FindNextFileW FindFirstFileW GetFileAttributesExW lstrlenW CreateThread TerminateThread InitializeCriticalSection GetVersionExW GetTempPathW MulDiv GetCurrentProcessId OpenProcess GetVersion GlobalFree FindFirstFileExW GlobalAlloc LoadLibraryExW MultiByteToWideChar lstrcmpiW FreeLibrary GetCurrentProcess GetProcAddress GetModuleHandleW SetLastError RaiseException GetCurrentThreadId GetPrivateProfileStringW GetLastError GetTickCount WritePrivateProfileStringW GetPrivateProfileIntW InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement DeleteCriticalSection LeaveCriticalSection EnterCriticalSection FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleFileNameW

user32

IsClipboardFormatAvailable RegisterClipboardFormatW GetSysColor GetCursorPos PtInRect GetClassInfoExW RegisterClassExW UnregisterClassW wsprintfW MessageBoxW SetCaretPos CreateCaret LoadCursorW CreateWindowExW SetWindowLongW GetWindowLongW CallWindowProcW CharNextW ShowWindow PostMessageW SendMessageW SetRectEmpty SystemParametersInfoW MoveWindow GetDlgItem KillTimer SetTimer FindWindowW DispatchMessageW TranslateMessage GetMessageW PeekMessageW EqualRect SetCursor ClientToScreen ScreenToClient GetDoubleClickTime GetParent CopyRect IntersectRect IsRectEmpty GetIconInfo DrawTextW BeginPaint EndPaint IsIconic GetClientRect InvalidateRect TrackMouseEvent SetFocus SetCapture ReleaseCapture GetWindowRect SetWindowRgn SetWindowPos MapWindowPoints GetMonitorInfoW MonitorFromWindow GetWindow EnableWindow GetForegroundWindow GetWindowTextW SetForegroundWindow DestroyWindow IsWindow GetCaretBlinkTime UpdateWindow FillRect GetFocus GetWindowTextLengthW SetWindowTextW IsZoomed MonitorFromRect OffsetRect SetLayeredWindowAttributes GetDC ReleaseDC GetWindowThreadProcessId AttachThreadInput DefWindowProcW IsWindowVisible PostQuitMessage BringWindowToTop SetActiveWindow UpdateLayeredWindow

gdi32

CreateFontIndirectW RestoreDC ExtSelectClipRgn CreateRectRgnIndirect SaveDC GetDeviceCaps CreateRectRgn CombineRgn CreateRoundRectRgn SetTextColor SetBkMode GetBitmapBits GetTextColor SetStretchBltMode DeleteDC BitBlt SetPixel CreateCompatibleDC GetObjectW CreateDIBSection Rectangle SelectObject CreatePen DeleteObject GetStockObject GetCurrentObject SetTextCharacterExtra SetBitmapBits SetBkColor CreateSolidBrush GetViewportOrgEx StretchBlt

advapi32

RegQueryValueExW GetUserNameW RegEnumKeyW CloseServiceHandle CreateServiceW OpenSCManagerW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

ord165 SHChangeNotify ShellExecuteW ShellExecuteExW SHCreateDirectoryExW SHGetSpecialFolderPathW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFolderPathW SHGetMalloc

ole32

CoInitializeSecurity RegisterDragDrop StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CreateStreamOnHGlobal CoUninitialize CoInitialize OleRun CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

LoadRegTypeLi SysFreeString LoadTypeLi VariantClear VariantInit VarBstrCmp GetErrorInfo VariantCopy SysAllocString VarUI4FromStr SysStringLen

shlwapi

SHGetValueW SHDeleteValueW PathRemoveExtensionW PathCanonicalizeW PathRemoveBackslashW PathFileExistsW PathFindExtensionW PathAppendW PathRemoveFileSpecW PathFindFileNameW PathCombineW PathIsDirectoryW StrStrIW PathSearchAndQualifyW PathIsPrefixW

comctl32

ord17

msimg32

AlphaBlend

wininet

InternetCrackUrlW InternetConnectW InternetOpenW InternetSetOptionW HttpOpenRequestW HttpSendRequestW HttpQueryInfoW InternetCloseHandle InternetReadFile

gdiplus

GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipAlloc GdipFree GdipGetImagePixelFormat GdipCreateBitmapFromStream GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromHICON GdipBitmapLockBits GdipCloneBrush GdipCreateSolidFill GdipSetTextRenderingHint GdipDrawString GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdiplusStartup GdipDeleteBrush

riched20

ord4

crypt32

CertGetNameStringW CryptBinaryToStringW CryptStringToBinaryW

netapi32

Netbios

version

VerQueryValueW

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

iphlpapi

GetAdaptersInfo GetIpAddrTable

psapi

EnumProcessModules

secur32

GetUserNameExW

Name

.text

Size

790KB

Virtual Size

789KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

185KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

600B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

430KB

Virtual Size

429KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_b86b6a02b44d034c49230da971a387d5_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

wininet

gdiplus

riched20

crypt32

netapi32

version

wintrust

iphlpapi

psapi

secur32

generic