2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat
Size 1.3MB
Sample261024-mcflashs5z
SHA256 cd7a83c0db190fe1c61d6e7e9a9415d480d39b4f4cbbcd1ddb9ffdc231700b43
MD5 682422984053f0713fdb6586e6e6f3f0
SHA1 316e9f7c391807318662034042f9608ef0f6aa44
SHA512 06cac51f1a875791fa171e2c54acb6df1290a8d7dbefafc802eac33bf28f929b3aa2afc3296520ce4fdcbe39833f752fa3805f625efe6e2ffbd5c9049ca55947
SSDEEP 24576:5jnT6k9lPBtwC7KEg6hMLFMGyY9xSjsZ9T74yU6dITiXLMkpdHrkhdcYLEwZLKPx:5/lPBqC7KKYFBRZJ7L7wmbHqdzgwRKPx
TLSH
T1B455F110F592E036D4072132552CF33DAA39A6054F708ED7D3888EADAFB52D15E366AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

.exe 1.3MB

2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

IMPHASH ebf7996c66246e1df14a95f0364d80d8
SHA256 cd7a83c0db190fe1c61d6e7e9a9415d480d39b4f4cbbcd1ddb9ffdc231700b43
MD5 682422984053f0713fdb6586e6e6f3f0
SHA1 316e9f7c391807318662034042f9608ef0f6aa44
SHA512 06cac51f1a875791fa171e2c54acb6df1290a8d7dbefafc802eac33bf28f929b3aa2afc3296520ce4fdcbe39833f752fa3805f625efe6e2ffbd5c9049ca55947
SSDEEP 24576:5jnT6k9lPBtwC7KEg6hMLFMGyY9xSjsZ9T74yU6dITiXLMkpdHrkhdcYLEwZLKPx:5/lPBqC7KKYFBRZJ7L7wmbHqdzgwRKPx
TLSH
T1B455F110F592E036D4072132552CF33DAA39A6054F708ED7D3888EADAFB52D15E366AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

494896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

courgette.exe.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateEventW CreateFileMappingW CreateFileW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessTimes GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MapViewOfFile MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureStackBackTrace RtlUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

CommandLineToArgvW

shlwapi

PathMatchSpecW

winmm

timeGetTime

advapi32

EventRegister EventUnregister EventWriteTransfer RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

Name

.text

Size

625KB

Virtual Size

625KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

249B

Characteristics

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

588KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

kernel32

shell32

shlwapi

winmm

advapi32

dbghelp

generic