2026-10-14_b7c60e920d08f813d962cf2f27d03798_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-14_b7c60e920d08f813d962cf2f27d03798_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 2.0MB
Sample261014-qwpvvsdw4p
SHA256 de4091e9261f21cdfb1456b2c9712f23db5f02d8cbe87c9113e2eb04d7d73afa
MD5 b7c60e920d08f813d962cf2f27d03798
SHA1 b56648da2256915bbfa4fef666a1fd3a9feabc8d
SHA512 55d0905517c59de4639837a14cc6d7b2f7f3e6444ad3ab605071c8c6cda330252a219966d842df79d51a45f807a284c62b7244bd080afa820014bcc4a9710125
SSDEEP 49152:nZeJPwDKTf0BEUGIMRROph4ugIqP+wdvbg:nswDmf0BEUqDuh4uMxk
TLSH
T10195D012F445C072D3714673BCA86B39145ABE60B632998BF3883D5F3DE7A829925373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_b7c60e920d08f813d962cf2f27d03798_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-14_b7c60e920d08f813d962cf2f27d03798_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 2.0MB

2026-10-14_b7c60e920d08f813d962cf2f27d03798_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH bc51e7aa44a148cf1a42976740808084
SHA256 de4091e9261f21cdfb1456b2c9712f23db5f02d8cbe87c9113e2eb04d7d73afa
MD5 b7c60e920d08f813d962cf2f27d03798
SHA1 b56648da2256915bbfa4fef666a1fd3a9feabc8d
SHA512 55d0905517c59de4639837a14cc6d7b2f7f3e6444ad3ab605071c8c6cda330252a219966d842df79d51a45f807a284c62b7244bd080afa820014bcc4a9710125
SSDEEP 49152:nZeJPwDKTf0BEUGIMRROph4ugIqP+wdvbg:nswDmf0BEUqDuh4uMxk
TLSH
T10195D012F445C072D3714673BCA86B39145ABE60B632998BF3883D5F3DE7A829925373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\docker\Documents\workspace\build-v2\common\hrappstore2\bin\HrAppStoreUninst.pdb

kernel32

CreateThread SetEvent OpenEventW GetTempFileNameW ExpandEnvironmentStringsW GetTempPathW OpenMutexW CopyFileW SetCurrentDirectoryW FreeResource CreateMutexW GetModuleFileNameW LoadLibraryExW lstrcmpiW FreeLibrary GetFileAttributesW MoveFileW DeleteFileW MoveFileExW RemoveDirectoryW SetFileAttributesW FindClose FindNextFileW FindFirstFileW Process32NextW GetCurrentProcessId Process32FirstW CreateToolhelp32Snapshot TerminateProcess K32GetProcessImageFileNameW WaitForSingleObject CreateProcessW WinExec SetLastError GetCurrentThreadId DecodePointer WriteConsoleW GetConsoleCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW RaiseException InitializeCriticalSectionEx FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleHandleW LoadLibraryA CreateFileW GetVersion GetProcAddress GetModuleHandleA GetTickCount WideCharToMultiByte DeleteCriticalSection GetWindowsDirectoryW CloseHandle Sleep MultiByteToWideChar OpenProcess InitializeCriticalSection LeaveCriticalSection GetCurrentProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetConsoleMode SetFilePointerEx GetStringTypeW GetStdHandle GetModuleHandleExW ExitProcess RtlUnwind TlsFree TlsSetValue GetLongPathNameW EnterCriticalSection TlsAlloc InitializeCriticalSectionAndSpinCount GetLocalTime ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW EncodePointer InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA GetACP InterlockedIncrement InterlockedDecrement GetFileSize ReadFile LoadLibraryW GetCurrentDirectoryW MulDiv GetVersionExW lstrlenW GetFileType WriteFile SetFilePointer SetFileTime DuplicateHandle SystemTimeToFileTime DosDateTimeToFileTime CreateDirectoryW TlsGetValue

user32

GetParent ActivateKeyboardLayout ExitWindowsEx GetCursorPos SendMessageW GetSystemMetrics LoadImageW SetForegroundWindow FindWindowW DestroyWindow CharNextW ClientToScreen MoveWindow SetWindowRgn IsIconic OffsetRect IsZoomed SetTimer wvsprintfW SetCursor UnionRect GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect IntersectRect IsRectEmpty PtInRect EnumChildWindows NotifyWinEvent EnumDisplaySettingsW MonitorFromPoint DrawTextW SetWindowTextW GetWindowTextW GetWindowTextLengthW GetCaretBlinkTime GetCaretPos FillRect EqualRect RegisterClassW SetPropW GetPropW CharPrevW SetRect CreateCaret HideCaret ShowCaret SetCaretPos GetSysColor CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo PrivateExtractIconsW DestroyIcon DrawIconEx GetIconInfo CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW ScreenToClient KillTimer CallWindowProcW SetWindowLongW IsChild PostQuitMessage DispatchMessageW TranslateMessage SetFocus GetMessageW PeekMessageW IsWindow EnableWindow ShowWindow PostMessageW CopyRect GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos DefWindowProcW UnregisterClassW GetWindowRect IsWindowVisible

gdi32

GetObjectType CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC GetStockObject Rectangle RestoreDC RoundRect SaveDC SelectObject GetTextMetricsW ExtCreatePen GetObjectW CreateSolidBrush SetBkMode SetTextColor CombineRgn CreateCompatibleBitmap CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo SelectClipRgn ExtSelectClipRgn SetBkColor StretchBlt SetStretchBltMode CreateDIBSection MoveToEx TextOutW ExtTextOutW GetDeviceCaps GetObjectA CreateRoundRectRgn DeleteObject BitBlt

advapi32

RegQueryValueExA RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegOpenKeyExA RegQueryValueExW RegCloseKey OpenProcessToken

shell32

SHChangeNotify SHGetSpecialFolderPathW SHGetFileInfoW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitializeEx OleLockRunning CLSIDFromProgID CLSIDFromString CoCreateInstance CoUninitialize

oleaut32

SysAllocString VarUI4FromStr VariantInit SysFreeString VariantClear

shlwapi

SHDeleteKeyW PathIsUNCW PathIsDirectoryW

comctl32

InitCommonControlsEx ImageList_DrawIndirect _TrackMouseEvent ord17 ImageList_GetImageCount

oleacc

LresultFromObject CreateStdAccessibleObject

gdiplus

GdipFree GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipSetTextRenderingHint GdipDeleteGraphics GdipCreateFromHDC GdiplusStartup GdiplusShutdown GdipAlloc GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI

Name

.text

Size

482KB

Virtual Size

481KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

597KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

788KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-14_b7c60e920d08f813d962cf2f27d03798_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

oleacc

gdiplus

generic