2026-10-10_22d19a25f7d63d321d8110006db61b8f_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_22d19a25f7d63d321d8110006db61b8f_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
Size 1.2MB
Sample261011-xtnckscs5y
SHA256 efb40e4ce12258ba76450eafc10b0f4310192401b752a3f57f1ba67c3c570196
MD5 22d19a25f7d63d321d8110006db61b8f
SHA1 71c05d96c0310292f9e2c5c4d48dfcc1c0380746
SHA512 6eba11bd12c58d2a992a094af709f5ade2c32e0e712cfabd0e9b6ba6e7e8fa1a5a33917b7881463fcb2f37ac2c2201c6148e188ffd0191b049e3b08f9056082b
SSDEEP 24576:cqG4kUaBIjAt38Q8rrBxB31Q8DZ4Dp9EqY0DEEIhty925VV8uRVqGGwlX5qVycHn:Ra1t38Q8rrBxB3dDeD9Y0tIy9AVVRVZe
TLSH
T14B45F12279F1C076C2B382314D79F72911ADBD700E354AEF77E41B2DAE744816B296A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_22d19a25f7d63d321d8110006db61b8f_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-10-10_22d19a25f7d63d321d8110006db61b8f_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

.exe 1.2MB

2026-10-10_22d19a25f7d63d321d8110006db61b8f_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 07c4eda97a6c38661ab9928826caa7e0
SHA256 efb40e4ce12258ba76450eafc10b0f4310192401b752a3f57f1ba67c3c570196
MD5 22d19a25f7d63d321d8110006db61b8f
SHA1 71c05d96c0310292f9e2c5c4d48dfcc1c0380746
SHA512 6eba11bd12c58d2a992a094af709f5ade2c32e0e712cfabd0e9b6ba6e7e8fa1a5a33917b7881463fcb2f37ac2c2201c6148e188ffd0191b049e3b08f9056082b
SSDEEP 24576:cqG4kUaBIjAt38Q8rrBxB31Q8DZ4Dp9EqY0DEEIhty925VV8uRVqGGwlX5qVycHn:Ra1t38Q8rrBxB3dDeD9Y0tIy9AVVRVZe
TLSH
T14B45F12279F1C076C2B382314D79F72911ADBD700E354AEF77E41B2DAE744816B296A3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

122358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\consoleproxy-new\output\ConsoleProxy.pdb

kernel32

SetEvent GetCurrentThread Process32FirstW CloseHandle GetSystemInfo DeleteCriticalSection CreateProcessW SetThreadExecutionState Process32NextW CreateFileW WriteConsoleW GetLastError CreateEventW CreateToolhelp32Snapshot GetVersionExW WaitForSingleObject GetModuleFileNameW HeapSize SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle SetThreadAffinityMask MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId WideCharToMultiByte DuplicateHandle WaitForSingleObjectEx Sleep GetCurrentProcess SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress EncodePointer DecodePointer GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualFree VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind RaiseException HeapAlloc HeapFree HeapReAlloc ExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameA ExitProcess GetCommandLineA GetCommandLineW GetACP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetProcessHeap GetTimeZoneInformation FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA

user32

PostMessageW

hgate

?GetInstance@WireSock@@SAPAV1@XZ ?Start@WireSock@@QAE_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?Stop@WireSock@@QAE_NXZ ?GetStatus@WireSock@@QAE?AW4ProxyGatewayStatus@@XZ ?GetProxySzie@WireSock@@QAEHXZ

ws2_32

WSAStartup WSAGetLastError WSACleanup inet_ntoa

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_22d19a25f7d63d321d8110006db61b8f_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

kernel32

user32

hgate

ws2_32

iphlpapi

generic