2026-10-26_a0489027d9f8f4ea410afe35921a37c3_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_a0489027d9f8f4ea410afe35921a37c3_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos
Size 1.1MB
Sample261027-mk6sfsdc44
SHA256 17f9165644d5c5b73eb12da6f862dd394a49a56ad42295633d47055c680e5d14
MD5 a0489027d9f8f4ea410afe35921a37c3
SHA1 d0ca1dfcb2740a53c7974eaaf3b2c08adb762619
SHA512 e9c66dd1d108c3fa81f223fe6310b675ce7aa4e4cf361ce5f2aee5d33133062bf057aac348225c943b43feadd4ccf7be8d4e3a8e35bcd9a945bbf8f570237385
SSDEEP 24576:svPuGtXLUYJv2Zm9R1jBvALZhKc4mbPo8pTPXalVmWKXgpz4tRa6W:0zUJZmv1FwYSw8FPXewCpz4T
TLSH
T12045F101F8C1D072E0B611700B79EB72153DB9301B6995EBB3E45DAE9FB02D07A36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_a0489027d9f8f4ea410afe35921a37c3_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-26_a0489027d9f8f4ea410afe35921a37c3_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

.exe 1.1MB

2026-10-26_a0489027d9f8f4ea410afe35921a37c3_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

IMPHASH 7a51b72b2a6e97ac4dd2a61c38773e2a
SHA256 17f9165644d5c5b73eb12da6f862dd394a49a56ad42295633d47055c680e5d14
MD5 a0489027d9f8f4ea410afe35921a37c3
SHA1 d0ca1dfcb2740a53c7974eaaf3b2c08adb762619
SHA512 e9c66dd1d108c3fa81f223fe6310b675ce7aa4e4cf361ce5f2aee5d33133062bf057aac348225c943b43feadd4ccf7be8d4e3a8e35bcd9a945bbf8f570237385
SSDEEP 24576:svPuGtXLUYJv2Zm9R1jBvALZhKc4mbPo8pTPXalVmWKXgpz4tRa6W:0zUJZmv1FwYSw8FPXewCpz4T
TLSH
T12045F101F8C1D072E0B611700B79EB72153DB9301B6995EBB3E45DAE9FB02D07A36B66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

123682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA FindNextFileW FindClose GetLastError OpenThread TerminateThread CloseHandle SetLastError InitializeCriticalSectionEx CreateThread DecodePointer FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetCommandLineW CreateMutexW WriteConsoleW CreateFileW FlushFileBuffers SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW SetFilePointerEx GetTimeZoneInformation HeapSize GetConsoleMode GetConsoleCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetSystemDefaultLangID GetDateFormatW GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess HeapReAlloc ReadFile RtlUnwind GetCurrentProcessId WideCharToMultiByte lstrlenW MultiByteToWideChar GetUserDefaultUILanguage OutputDebugStringA GetCurrentThreadId RaiseException GetCurrentProcess DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetTempPathW GetLocalTime InitializeCriticalSection QueryPerformanceCounter GetStartupInfoW WaitForSingleObjectEx ResetEvent SetEvent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache Sleep SystemTimeToFileTime InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetProcessHeap HeapFree HeapAlloc OutputDebugStringW IsDebuggerPresent SetEndOfFile GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount EncodePointer GetTimeFormatW GetSystemTime

user32

KillTimer PostQuitMessage ShowWindow MessageBoxW MessageBoxTimeoutW IsWindowVisible DestroyWindow UnregisterClassW CreateDialogParamW SetWindowLongW CharNextW DispatchMessageW TranslateMessage wvsprintfW IsDialogMessageW RegisterDeviceNotificationW PostMessageW SetWindowTextW SendMessageW GetDlgItem EnableWindow SetWindowPos MapWindowPoints GetClientRect GetMessageW PeekMessageW FindWindowW GetParent GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindowLongW GetWindow LoadImageW SetTimer UnregisterDeviceNotification DefWindowProcW GetSystemMetrics

advapi32

RegQueryInfoKeyW LookupPrivilegeValueW AdjustTokenPrivileges RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW OpenProcessToken RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey InitiateSystemShutdownW

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

libwdi

wdi_register_logger wdi_destroy_list wdi_install_driver wdi_get_vendor_name wdi_create_list wdi_is_driver_supported _wdi_create_lockdown@0 wdi_set_log_level wdi_prepare_driver wdi_unregister_logger wdi_read_logger

winmm

timeGetTime

setupapi

SetupUninstallOEMInfW SetupDiRemoveDevice SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupGetInfDriverStoreLocationW SetupGetInfPublishedNameW SetupDiDestroyDeviceInfoList CM_Locate_DevNodeW CM_Reenumerate_DevNode SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyW SetupDiGetDriverInfoDetailW SetupDiDestroyDriverInfoList

iphlpapi

GetAdaptersInfo

ws2_32

closesocket setsockopt socket connect ntohs inet_ntoa gethostbyname inet_addr htons htonl bind getsockname recv WSACleanup WSAStartup send

Name

.text

Size

266KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

770KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_a0489027d9f8f4ea410afe35921a37c3_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

libwdi

winmm

setupapi

iphlpapi

ws2_32

generic