2026-10-22_a58118290ce8f44749973df1358f9b86_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_a58118290ce8f44749973df1358f9b86_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos
Size 2.5MB
Sample261024-cbsjcsww2l
SHA256 8cff836ad87678086d26d71eb3ac0b39a67f0ac07ca5c8a71e597db25a4c3b84
MD5 a58118290ce8f44749973df1358f9b86
SHA1 953d6bcc84708ba8a6d3f12a29a39580660e6a91
SHA512 be808b3097dabb4fad98a5a5ecfbfc1b38e76682d34b7b37944c5f9a3db415788ecca81ee27df069314b0c5a9bb185a20ef687ba2c0524a0dd71540dba1b02e6
SSDEEP 12288:IFSsiEt5LODS6RcvRtd+sGum6QHArfePms//bV56OXPMiCSmRZQkEFjJ:VA5LODZWvT4sGz6QHVN3b6OhfmRqkoJ
TLSH
T11FC5AF53BB44D0B6C9330331CD79B2F4A2FEBD7195218A5B6B485E182EB04A07E1A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_a58118290ce8f44749973df1358f9b86_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-22_a58118290ce8f44749973df1358f9b86_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

.exe 2.5MB

2026-10-22_a58118290ce8f44749973df1358f9b86_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

IMPHASH 5a1e6b8d2b8f96541b09e3a5e6919194
SHA256 8cff836ad87678086d26d71eb3ac0b39a67f0ac07ca5c8a71e597db25a4c3b84
MD5 a58118290ce8f44749973df1358f9b86
SHA1 953d6bcc84708ba8a6d3f12a29a39580660e6a91
SHA512 be808b3097dabb4fad98a5a5ecfbfc1b38e76682d34b7b37944c5f9a3db415788ecca81ee27df069314b0c5a9bb185a20ef687ba2c0524a0dd71540dba1b02e6
SSDEEP 12288:IFSsiEt5LODS6RcvRtd+sGum6QHArfePms//bV56OXPMiCSmRZQkEFjJ:VA5LODZWvT4sGz6QHVN3b6OhfmRqkoJ
TLSH
T11FC5AF53BB44D0B6C9330331CD79B2F4A2FEBD7195218A5B6B485E182EB04A07E1A767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

487587

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

P:\Target\x86\ship\dw\x-none\dw20.pdb

advapi32

GetSecurityDescriptorDacl RegCloseKey RegCreateKeyExA RegDeleteValueA RegDeleteValueW RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW SetNamedSecurityInfoW ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA GetUserNameA RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA DeregisterEventSource RegisterEventSourceW ReportEventA ReportEventW AllocateAndInitializeSid CheckTokenMembership FreeSid RegEnumValueW RegQueryInfoKeyW OpenProcessToken GetTokenInformation RegCreateKeyExW RegOpenKeyExW AddAccessAllowedAce AddAccessDeniedAce CopySid CreateWellKnownSid EqualSid GetLengthSid InitializeAcl InitializeSecurityDescriptor IsValidSid SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken

comctl32

ord17 ImageList_Destroy ImageList_ReplaceIcon ImageList_Create

cabinet

ord10 ord13 ord12 ord14 ord20 ord21 ord22 ord23 ord11

gdi32

CreateSolidBrush CreateDCW SetMapMode SaveDC RestoreDC GetTextExtentPoint32W GetDeviceCaps DeleteObject DeleteDC CreateFontA CreateFontIndirectW CreateFontIndirectA GetTextFaceA GetObjectW ExtTextOutW GetObjectA GetTextMetricsA SetTextAlign SetBkMode SetTextColor SelectObject

kernel32

GetTimeFormatW GetFileSize SetFilePointer RaiseException ExitThread SuspendThread SetPriorityClass GetTickCount64 UnmapViewOfFile CreateFileMappingA GetComputerNameA GetModuleFileNameA GetModuleHandleW LoadLibraryExA MulDiv GetACP GetSystemDefaultUILanguage GetSystemDefaultLangID GetUserDefaultLangID GetSystemDefaultLCID SetEnvironmentVariableA ExpandEnvironmentStringsW CreateDirectoryW GetDateFormatW SetEndOfFile GetTempPathW SetEvent CreateRemoteThread SetThreadPriority CreateProcessW OpenProcess GetSystemInfo GetSystemDirectoryA VirtualQueryEx ReadProcessMemory WideCharToMultiByte IsDBCSLeadByte ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList EncodePointer HeapSize GetStdHandle ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetCurrentThread GetFileType DecodePointer HeapReAlloc OutputDebugStringA FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetStringTypeW GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW CreateFileW GetLongPathNameW GetShortPathNameW GlobalAlloc GlobalFree lstrcmpiW UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualAlloc FreeLibraryAndExitThread GetThreadTimes UnregisterWait MoveFileW LocalFree GetSystemWindowsDirectoryW GetTickCount GetSystemTimeAsFileTime SetLastError WriteFile FindNextFileW FindFirstFileW FindClose MultiByteToWideChar GetModuleFileNameW FreeLibrary GetVersionExW GetVersionExA DeleteCriticalSection InitializeCriticalSection GetProcessHeap MapViewOfFile SetProcessWorkingSetSize GetProcAddress GetModuleHandleA CreateThread TerminateProcess GetCurrentProcessId GetCurrentProcess WaitForMultipleObjects Sleep WaitForSingleObject ReleaseMutex SetErrorMode SetUnhandledExceptionFilter CloseHandle DeleteFileW GetCommandLineW GetLocalTime LeaveCriticalSection EnterCriticalSection GetLastError GetFileAttributesW VirtualProtect VirtualQuery LoadLibraryW LCIDToLocaleName LocaleNameToLCID GetLocaleInfoEx GetStringTypeExW GetUserDefaultLocaleName InitializeCriticalSectionEx IsWow64Process GetShortPathNameA GetLogicalProcessorInformation CreateMutexA CreateEventA OpenEventA OpenMutexA CreateSemaphoreA OpenSemaphoreA LocalAlloc CreateFileA GetSystemDefaultLocaleName EnumSystemLocalesEx GetDateFormatEx GetCalendarInfoEx GetThreadUILanguage LoadResource SizeofResource FindResourceW CompareStringEx DuplicateHandle TryEnterCriticalSection CreateTimerQueue SignalObjectAndWait SwitchToThread GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject

ole32

CoCreateGuid CoCreateInstance StringFromIID CoUninitialize CoTaskMemFree CoInitializeEx

oleaut32

SysStringLen SysFreeString SysAllocString SystemTimeToVariantTime VariantTimeToDosDateTime

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

Name

.text

Size

472KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_a58118290ce8f44749973df1358f9b86_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

advapi32

comctl32

cabinet

gdi32

kernel32

ole32

oleaut32

wintrust

generic