2026-10-22_7219e7d525767084c01f1c16de77f15d_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_7219e7d525767084c01f1c16de77f15d_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 2.0MB
Sample261024-kveqlstsfv
SHA256 aa1e834b3a66f5a173d56c7a4c35b5bed0871519800deded73ac7b88058d7e54
MD5 7219e7d525767084c01f1c16de77f15d
SHA1 1bfc8a86ec197580cd30e75d8c169d2b2771ffb0
SHA512 d874763db123830b4d30f231a0b78ab06775777660f2f3215d59754ebb4020028b7ad93fed9fa3c0e6e0a4864ef3750f81309dee2be13a62cf09af0dd4247d35
SSDEEP 49152:TZeJPwDKTf0BEUGIMKcIWjKd4YxFDqjzol:TswDmf0BEUqKcydHxFDqHK
TLSH
T17E95D012F446C032D3714A33BDA82F39149ABE60A636995BF3883D5F3DE76819925373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_7219e7d525767084c01f1c16de77f15d_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-22_7219e7d525767084c01f1c16de77f15d_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 2.0MB

2026-10-22_7219e7d525767084c01f1c16de77f15d_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH bc51e7aa44a148cf1a42976740808084
SHA256 aa1e834b3a66f5a173d56c7a4c35b5bed0871519800deded73ac7b88058d7e54
MD5 7219e7d525767084c01f1c16de77f15d
SHA1 1bfc8a86ec197580cd30e75d8c169d2b2771ffb0
SHA512 d874763db123830b4d30f231a0b78ab06775777660f2f3215d59754ebb4020028b7ad93fed9fa3c0e6e0a4864ef3750f81309dee2be13a62cf09af0dd4247d35
SSDEEP 49152:TZeJPwDKTf0BEUGIMKcIWjKd4YxFDqjzol:TswDmf0BEUqKcydHxFDqHK
TLSH
T17E95D012F446C032D3714A33BDA82F39149ABE60A636995BF3883D5F3DE76819925373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\docker\Documents\workspace\build-v2\common\hrappstore2\bin\HrAppStoreUninst.pdb

kernel32

CreateThread SetEvent OpenEventW GetTempFileNameW ExpandEnvironmentStringsW GetTempPathW OpenMutexW CopyFileW SetCurrentDirectoryW FreeResource CreateMutexW GetModuleFileNameW LoadLibraryExW lstrcmpiW FreeLibrary GetFileAttributesW MoveFileW DeleteFileW MoveFileExW RemoveDirectoryW SetFileAttributesW FindClose FindNextFileW FindFirstFileW Process32NextW GetCurrentProcessId Process32FirstW CreateToolhelp32Snapshot TerminateProcess K32GetProcessImageFileNameW WaitForSingleObject CreateProcessW WinExec SetLastError GetCurrentThreadId DecodePointer WriteConsoleW GetConsoleCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW RaiseException InitializeCriticalSectionEx FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleHandleW LoadLibraryA CreateFileW GetVersion GetProcAddress GetModuleHandleA GetTickCount WideCharToMultiByte DeleteCriticalSection GetWindowsDirectoryW CloseHandle Sleep MultiByteToWideChar OpenProcess InitializeCriticalSection LeaveCriticalSection GetCurrentProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetConsoleMode SetFilePointerEx GetStringTypeW GetStdHandle GetModuleHandleExW ExitProcess RtlUnwind TlsFree TlsSetValue GetLongPathNameW EnterCriticalSection TlsAlloc InitializeCriticalSectionAndSpinCount GetLocalTime ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW EncodePointer InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA GetACP InterlockedIncrement InterlockedDecrement GetFileSize ReadFile LoadLibraryW GetCurrentDirectoryW MulDiv GetVersionExW lstrlenW GetFileType WriteFile SetFilePointer SetFileTime DuplicateHandle SystemTimeToFileTime DosDateTimeToFileTime CreateDirectoryW TlsGetValue

user32

GetParent ActivateKeyboardLayout ExitWindowsEx GetCursorPos SendMessageW GetSystemMetrics LoadImageW SetForegroundWindow FindWindowW DestroyWindow CharNextW ClientToScreen MoveWindow SetWindowRgn IsIconic OffsetRect IsZoomed SetTimer wvsprintfW SetCursor UnionRect GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect IntersectRect IsRectEmpty PtInRect EnumChildWindows NotifyWinEvent EnumDisplaySettingsW MonitorFromPoint DrawTextW SetWindowTextW GetWindowTextW GetWindowTextLengthW GetCaretBlinkTime GetCaretPos FillRect EqualRect RegisterClassW SetPropW GetPropW CharPrevW SetRect CreateCaret HideCaret ShowCaret SetCaretPos GetSysColor CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo PrivateExtractIconsW DestroyIcon DrawIconEx GetIconInfo CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW ScreenToClient KillTimer CallWindowProcW SetWindowLongW IsChild PostQuitMessage DispatchMessageW TranslateMessage SetFocus GetMessageW PeekMessageW IsWindow EnableWindow ShowWindow PostMessageW CopyRect GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos DefWindowProcW UnregisterClassW GetWindowRect IsWindowVisible

gdi32

GetObjectType CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC GetStockObject Rectangle RestoreDC RoundRect SaveDC SelectObject GetTextMetricsW ExtCreatePen GetObjectW CreateSolidBrush SetBkMode SetTextColor CombineRgn CreateCompatibleBitmap CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo SelectClipRgn ExtSelectClipRgn SetBkColor StretchBlt SetStretchBltMode CreateDIBSection MoveToEx TextOutW ExtTextOutW GetDeviceCaps GetObjectA CreateRoundRectRgn DeleteObject BitBlt

advapi32

RegQueryValueExA RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegOpenKeyExA RegQueryValueExW RegCloseKey OpenProcessToken

shell32

SHChangeNotify SHGetSpecialFolderPathW SHGetFileInfoW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitializeEx OleLockRunning CLSIDFromProgID CLSIDFromString CoCreateInstance CoUninitialize

oleaut32

SysAllocString VarUI4FromStr VariantInit SysFreeString VariantClear

shlwapi

SHDeleteKeyW PathIsUNCW PathIsDirectoryW

comctl32

InitCommonControlsEx ImageList_DrawIndirect _TrackMouseEvent ord17 ImageList_GetImageCount

oleacc

LresultFromObject CreateStdAccessibleObject

gdiplus

GdipFree GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipSetTextRenderingHint GdipDeleteGraphics GdipCreateFromHDC GdiplusStartup GdiplusShutdown GdipAlloc GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI

Name

.text

Size

482KB

Virtual Size

481KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

597KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

787KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_7219e7d525767084c01f1c16de77f15d_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

oleacc

gdiplus

generic