2026-10-19_bb900b5645cfb0112c086510be72f606_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_bb900b5645cfb0112c086510be72f606_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos
Size 394KB
Sample261020-mc4m5act8l
SHA256 5c6da115c50ec27d3d09d080d1bc07abc962057740a3578da8c9189353a4865e
MD5 bb900b5645cfb0112c086510be72f606
SHA1 fa8487a6ae3da9233e32281eb99b22683f35a07d
SHA512 c85f393f03416d08366502c11f3baa25bca1ccb7e9767374f2ce09e4fa5a539b5264c8f2daacd1c2926c7b80bf6a8bc3a950e4fc679aae7a7737c88fe4380c90
SSDEEP 6144:SC4ANICFqfcteupXC08/vwT/ruAPljKq4V1AOIPTiD3PK85s:SCgrf+Ct/vwT/jPIzOL+n5s
TLSH
T1A184AE20F642D136D5A241704FA9EB6B543DBA600B6506DBF3D81EAE0E746D12F32F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-19_bb900b5645cfb0112c086510be72f606_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

.exe 394KB

2026-10-19_bb900b5645cfb0112c086510be72f606_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

IMPHASH b71e8d9f6cb7bba600a6109725e18623
SHA256 5c6da115c50ec27d3d09d080d1bc07abc962057740a3578da8c9189353a4865e
MD5 bb900b5645cfb0112c086510be72f606
SHA1 fa8487a6ae3da9233e32281eb99b22683f35a07d
SHA512 c85f393f03416d08366502c11f3baa25bca1ccb7e9767374f2ce09e4fa5a539b5264c8f2daacd1c2926c7b80bf6a8bc3a950e4fc679aae7a7737c88fe4380c90
SSDEEP 6144:SC4ANICFqfcteupXC08/vwT/ruAPljKq4V1AOIPTiD3PK85s:SCgrf+Ct/vwT/jPIzOL+n5s
TLSH
T1A184AE20F642D136D5A241704FA9EB6B543DBA600B6506DBF3D81EAE0E746D12F32F63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

85:18:3e:06:00:7d:6f:22:90:b8:0d:27:76:86:9b:7c:99:e1:df:b1:2c:57:f2:bf:e9:61:d5:ad:0f:89:81:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Chains

Jan 25, 2017

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

78:ad:50:da:d5:9d:e7:4f:02:90:30:8c:ee:8c:2b:3f:40:87:52:23

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Chains

Jan 25, 2017

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Serial Number

0c:f3:53:69:a9:71:07:62:c3:6f:68:05:fc:9e:45:d6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 18, 2016 - Oct 12, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

d2:ab:be:e8:aa:58:38:5b:00:00:00:00:55:91:7a:09

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 1, 2015 - Dec 1, 2026

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jun 22, 2029

Minor OS version

Major OS version

Entry point

150001

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Y:\jenkins-workspace\workspace\client-builder-remoteieframe\ut_win\Build\Win32\Release\RemoteIEFrame.pdb

kernel32

GetTickCount MultiByteToWideChar WideCharToMultiByte InterlockedDecrement InterlockedIncrement ReadFile GetModuleFileNameA VirtualAlloc SetFilePointer CreateFileW CreateFileA GetCurrentProcessId SetUnhandledExceptionFilter GetSystemTimeAsFileTime DebugBreak CreateDirectoryW TerminateProcess WaitForSingleObject GetVersion CreateEventW Sleep SetEvent TerminateThread GlobalAlloc LoadLibraryW CreateThread LocalFree ExitProcess VerSetConditionMask GetModuleHandleW VerifyVersionInfoW GetLocaleInfoW WriteFile CreateNamedPipeW DisconnectNamedPipe GetOverlappedResult ConnectNamedPipe FlushFileBuffers GetFileSizeEx SetLastError GetCommandLineW HeapSize WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetProcessHeap SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ReadProcessMemory CloseHandle GetVersionExA GetModuleHandleA GetCurrentThreadId GetDriveTypeW GetModuleFileNameW GetProcAddress LoadLibraryA GetCurrentProcess GetVolumeInformationA GetConsoleMode GetLastError GetConsoleCP GetFileType GetACP GetStdHandle GetModuleHandleExW HeapFree HeapReAlloc HeapAlloc LoadLibraryExW FreeLibrary RtlUnwind RaiseException InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetCPInfo LCMapStringW TlsFree GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue

user32

GetClientRect PostQuitMessage FindWindowW InvalidateRect BeginPaint EndPaint SetWindowLongW GetWindowLongW GetMessageW DefWindowProcW GetKeyState PostMessageW LoadCursorA DestroyWindow SetWindowPos CreateWindowExW RegisterClassExW ShowWindow DispatchMessageW MoveWindow TranslateMessage

advapi32

SystemFunction036

shell32

DragQueryFileW SHGetSpecialFolderPathW DragFinish CommandLineToArgvW

ole32

StgCreateStorageEx OleInitialize ReleaseStgMedium OleUninitialize OleSetContainedObject OleCreate CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal

oleaut32

SysAllocString SysStringLen DispGetParam SysFreeString VariantInit VariantClear

shlwapi

PathFindExtensionW PathFileExistsW PathRemoveFileSpecW PathCombineW PathFindFileNameW

Name

.text

Size

273KB

Virtual Size

272KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

748B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_bb900b5645cfb0112c086510be72f606_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic