2026-10-14_de7f6518123fd3a647d4d1663c21be76_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-14_de7f6518123fd3a647d4d1663c21be76_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos
Size 1.4MB
Sample261014-ml2j5atset
SHA256 4c2d628bc80298b84f59f5fa50d281b66d2f193725f32d505feca75d3bf579ae
MD5 de7f6518123fd3a647d4d1663c21be76
SHA1 079bdb94d7e16bcb8fefde47ddd3ae810f9a61f7
SHA512 53ed63b0a4250c1874c7e5e70643b5d3dd7880985331b129e0dd8ceeedbd12aa8d520e849a3dc9a57ab4330232a43076520ee0a056a00f7e2b51da874d5f03e9
SSDEEP 24576:JmhxiscWmWCSmBDsw3HVGL9Gm9jKdatlYxWBgDzJD4dtRBHovfl:JmhDcSiwwcIWjKd4YxFDqjzol
TLSH
T14A65BF217D8C8121D6940735D622FF3A03BB5FEA1B38558BE2E03D623B78E81D936675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_de7f6518123fd3a647d4d1663c21be76_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos

File Explorer

2026-10-14_de7f6518123fd3a647d4d1663c21be76_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos

.exe 1.4MB

2026-10-14_de7f6518123fd3a647d4d1663c21be76_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos

IMPHASH f5166a4695cd2daabd9f6ac9cb8ad717
SHA256 4c2d628bc80298b84f59f5fa50d281b66d2f193725f32d505feca75d3bf579ae
MD5 de7f6518123fd3a647d4d1663c21be76
SHA1 079bdb94d7e16bcb8fefde47ddd3ae810f9a61f7
SHA512 53ed63b0a4250c1874c7e5e70643b5d3dd7880985331b129e0dd8ceeedbd12aa8d520e849a3dc9a57ab4330232a43076520ee0a056a00f7e2b51da874d5f03e9
SSDEEP 24576:JmhxiscWmWCSmBDsw3HVGL9Gm9jKdatlYxWBgDzJD4dtRBHovfl:JmhDcSiwwcIWjKd4YxFDqjzol
TLSH
T14A65BF217D8C8121D6940735D622FF3A03BB5FEA1B38558BE2E03D623B78E81D936675
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

111916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\docker\Documents\workspace\build-v2\common\hrappstore2\bin\HrASUpdate.pdb

kernel32

GetFullPathNameW ExitProcess GetModuleFileNameW SetCurrentDirectoryW InitializeCriticalSectionAndSpinCount GetCurrentThreadId CreateProcessW OpenMutexW MoveFileExW FindFirstFileW FindNextFileW FindClose SetFileAttributesW RemoveDirectoryW lstrcmpiW LoadLibraryExW CreateMutexW SetLastError OpenEventW SetEvent CopyFileW WinExec GetSystemDirectoryW FlushFileBuffers CreateThread TerminateThread SetEndOfFile WriteConsoleW GetConsoleCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW SetEnvironmentVariableW Process32FirstW ReadConsoleW GetConsoleMode SetFilePointerEx GetStringTypeW GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetACP GetStdHandle GetModuleHandleExW GetCommandLineW GetCommandLineA CreateDirectoryW RtlUnwind TlsFree TlsSetValue FreeLibrary TlsAlloc GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetVersionExW DecodePointer RaiseException Module32NextW Module32FirstW CreateToolhelp32Snapshot LoadLibraryW GetNativeSystemInfo ReadFile GetFileSize LocalAlloc FileTimeToSystemTime SystemTimeToFileTime GetSystemDirectoryA GetSystemTime GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetModuleHandleW GetSystemInfo LoadLibraryA CreateFileW VirtualProtect GetVersion GetProcAddress GetModuleHandleA GetTickCount WideCharToMultiByte DeleteCriticalSection LocalFree Sleep MultiByteToWideChar OpenProcess InitializeCriticalSection LeaveCriticalSection GetCurrentProcess EnterCriticalSection CloseHandle DeviceIoControl InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent LoadLibraryExA VirtualQuery GetSystemDefaultLangID InitializeCriticalSectionEx MoveFileW DeleteFileW WriteFile QueryPerformanceCounter WaitForSingleObject TerminateProcess TlsGetValue Process32NextW CreateFileA SetEnvironmentVariableA

user32

ExitWindowsEx UnregisterClassW GetSystemMetrics DefWindowProcW GetClientRect SetWindowPos PostMessageW KillTimer IsChild GetWindowRect GetWindowLongW IsZoomed GetMonitorInfoW MonitorFromWindow CopyRect OffsetRect SetWindowLongW IsIconic GetParent ScreenToClient ShowWindow LoadImageW SetWindowRgn PostQuitMessage SetFocus EnableWindow SendMessageW SetTimer CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW PeekMessageW GetMessageW TranslateMessage DispatchMessageW GetWindow MapWindowPoints FindWindowA DestroyWindow IsWindow FindWindowW CharNextW CallWindowProcW

gdi32

GetObjectType DeleteObject CreateRoundRectRgn

advapi32

RegEnumKeyExA GetSidSubAuthority CreateServiceW StartServiceW QueryServiceStatus QueryServiceConfigW CloseServiceHandle ControlService OpenServiceW OpenSCManagerW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW DuplicateToken CreateWellKnownSid CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW FreeSid AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegQueryValueExW OpenProcessToken GetTokenInformation RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW

ole32

CoCreateInstance CoInitializeEx CoInitialize CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW

comctl32

InitCommonControlsEx

crypt32

CryptQueryObject CertFindCertificateInStore CertGetNameStringW CertFreeCertificateContext CertCloseStore CryptMsgClose CryptMsgGetParam

gdiplus

GdipAddPathArc GdipDeleteBrush GdipDrawEllipse GdipCreateSolidFill GdipResetWorldTransform GdipDrawPath GdipRotateWorldTransform GdipTranslateWorldTransform GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipDeletePath GdipCreatePath GdipSetPenEndCap GdipSetPenStartCap GdipSetPenMode GdipDeletePen GdipCreatePen2 GdipCreateLineBrush

iphlpapi

GetAdaptersInfo

Name

.text

Size

259KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

315KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

772KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-14_de7f6518123fd3a647d4d1663c21be76_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

crypt32

gdiplus

iphlpapi

generic