2026-10-26_55b17dd8db8c351ac2112a36955f6288_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_55b17dd8db8c351ac2112a36955f6288_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos
Size 335KB
Sample261027-vn2lxaex71
SHA256 824f08aa4814acd2bd536dedefc6c26e6ee393caafde20358e9b8f44d536c5e4
MD5 55b17dd8db8c351ac2112a36955f6288
SHA1 7917ca87c265a5ad0614fa17483720d3f22a76ab
SHA512 f2529ce6ca4f9553645fe1dcfd04c69d501f978f682fe6c20192f5cda82d80b8756ac04eaa7144578d7fe3dd456a17ed8ca5a5ad2aea56b15949dea4873fa00b
SSDEEP 6144:TRtVUE7G0awQmJFOzURIeTaAOMLw7/ghC:TqiaHmJUOI/eo/ghC
TLSH
T12B749E11B785C072E5B249320A79DB67453EBC600F114ADFD3E85E2EEE348D19A32B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_55b17dd8db8c351ac2112a36955f6288_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-26_55b17dd8db8c351ac2112a36955f6288_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

.exe 335KB

2026-10-26_55b17dd8db8c351ac2112a36955f6288_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

IMPHASH a44b82594318ec2039f56a4e45705540
SHA256 824f08aa4814acd2bd536dedefc6c26e6ee393caafde20358e9b8f44d536c5e4
MD5 55b17dd8db8c351ac2112a36955f6288
SHA1 7917ca87c265a5ad0614fa17483720d3f22a76ab
SHA512 f2529ce6ca4f9553645fe1dcfd04c69d501f978f682fe6c20192f5cda82d80b8756ac04eaa7144578d7fe3dd456a17ed8ca5a5ad2aea56b15949dea4873fa00b
SSDEEP 6144:TRtVUE7G0awQmJFOzURIeTaAOMLw7/ghC:TqiaHmJUOI/eo/ghC
TLSH
T12B749E11B785C072E5B249320A79DB67453EBC600F114ADFD3E85E2EEE348D19A32B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

125696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

Shell_NotifyIconW ShellExecuteExW SHFileOperationW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW

kernel32

GetPrivateProfileStringW GetLocalTime FindFirstFileW FindNextFileW GetModuleFileNameW FindClose DeleteFileW ReadFile GetFileSizeEx WriteFile CreateFileW MultiByteToWideChar CloseHandle WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetFileAttributesW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetConsoleMode GetConsoleCP HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetProcessHeap GetPrivateProfileIntW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetACP GetStdHandle GetModuleHandleExW ExitProcess HeapFree HeapReAlloc HeapAlloc LoadLibraryExW FreeLibrary GetLastError RtlUnwind RaiseException WritePrivateProfileStringW GetCurrentDirectoryW SetFilePointerEx FlushFileBuffers IsProcessorFeaturePresent WriteConsoleW

user32

LoadIconW GetWindowLongW DefWindowProcW CallWindowProcW PostMessageW GetWindowRect DestroyWindow GetDC FillRect CreateWindowExW SendMessageW GetSystemMetrics SetWindowTextW CreatePopupMenu RegisterClassExW TrackPopupMenu ShowWindow GetDlgCtrlID ClientToScreen MapWindowPoints TrackMouseEvent AdjustWindowRect DestroyMenu DestroyIcon GetClassNameW SetCursor wsprintfW GetClientRect AppendMenuW DrawTextW PostQuitMessage PtInRect UpdateWindow SetForegroundWindow InvalidateRect ReleaseDC GetCursorPos BeginPaint EndPaint EnableWindow GetMessageW MessageBoxW DispatchMessageW TranslateMessage GetWindowTextLengthW IsWindow GetWindowTextW LoadCursorW SetWindowLongW

gdi32

SetBkMode CreateSolidBrush DeleteObject SetBkColor CreateFontW EnumFontFamiliesExW SelectObject SetTextColor GetStockObject

Name

.text

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

584B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_55b17dd8db8c351ac2112a36955f6288_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

shell32

comctl32

shlwapi

kernel32

user32

gdi32

generic