2026-10-30_e2ae2b4edbd3a4ed948452f8d9581d1e_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_e2ae2b4edbd3a4ed948452f8d9581d1e_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos
Size 1.4MB
Sample261030-rtlwvscy6w
SHA256 dd843d9a0e6df8f95a48a89f3ac6fd7cb99483c8a66405248de5cb1026de891e
MD5 e2ae2b4edbd3a4ed948452f8d9581d1e
SHA1 9fa209eac7b17e1eaedb8e31d0c9ade7c6b606c5
SHA512 0c7a7792de3242b5b8b9d512f64945010fc269a1f25327bc1020f4c3763253ad289fe05d640835c09aec39deb023dd0a5fc1047dfbf22324de443350039d2711
SSDEEP 24576:1mhxiscWmWCSmBDsmuJB3zlrZeYbs9n4f/2ER/GEbURgOGZ5Rs:1mhDcSiwm4BDlrsYk+R/bggXs
TLSH
T18F65AE216D8C8121D6540735D622FB3A03BB5FEA1B35558BE2E03D623B78EC1D93B678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_e2ae2b4edbd3a4ed948452f8d9581d1e_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos

File Explorer

2026-10-30_e2ae2b4edbd3a4ed948452f8d9581d1e_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos

.exe 1.4MB

2026-10-30_e2ae2b4edbd3a4ed948452f8d9581d1e_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos

IMPHASH f5166a4695cd2daabd9f6ac9cb8ad717
SHA256 dd843d9a0e6df8f95a48a89f3ac6fd7cb99483c8a66405248de5cb1026de891e
MD5 e2ae2b4edbd3a4ed948452f8d9581d1e
SHA1 9fa209eac7b17e1eaedb8e31d0c9ade7c6b606c5
SHA512 0c7a7792de3242b5b8b9d512f64945010fc269a1f25327bc1020f4c3763253ad289fe05d640835c09aec39deb023dd0a5fc1047dfbf22324de443350039d2711
SSDEEP 24576:1mhxiscWmWCSmBDsmuJB3zlrZeYbs9n4f/2ER/GEbURgOGZ5Rs:1mhDcSiwm4BDlrsYk+R/bggXs
TLSH
T18F65AE216D8C8121D6540735D622FB3A03BB5FEA1B35558BE2E03D623B78EC1D93B678
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

111916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\docker\Documents\workspace\build-v2\common\hrappstore2\bin\HrASUpdate.pdb

kernel32

GetFullPathNameW ExitProcess GetModuleFileNameW SetCurrentDirectoryW InitializeCriticalSectionAndSpinCount GetCurrentThreadId CreateProcessW OpenMutexW MoveFileExW FindFirstFileW FindNextFileW FindClose SetFileAttributesW RemoveDirectoryW lstrcmpiW LoadLibraryExW CreateMutexW SetLastError OpenEventW SetEvent CopyFileW WinExec GetSystemDirectoryW FlushFileBuffers CreateThread TerminateThread SetEndOfFile WriteConsoleW GetConsoleCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW SetEnvironmentVariableW Process32FirstW ReadConsoleW GetConsoleMode SetFilePointerEx GetStringTypeW GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetACP GetStdHandle GetModuleHandleExW GetCommandLineW GetCommandLineA CreateDirectoryW RtlUnwind TlsFree TlsSetValue FreeLibrary TlsAlloc GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetVersionExW DecodePointer RaiseException Module32NextW Module32FirstW CreateToolhelp32Snapshot LoadLibraryW GetNativeSystemInfo ReadFile GetFileSize LocalAlloc FileTimeToSystemTime SystemTimeToFileTime GetSystemDirectoryA GetSystemTime GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetModuleHandleW GetSystemInfo LoadLibraryA CreateFileW VirtualProtect GetVersion GetProcAddress GetModuleHandleA GetTickCount WideCharToMultiByte DeleteCriticalSection LocalFree Sleep MultiByteToWideChar OpenProcess InitializeCriticalSection LeaveCriticalSection GetCurrentProcess EnterCriticalSection CloseHandle DeviceIoControl InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent LoadLibraryExA VirtualQuery GetSystemDefaultLangID InitializeCriticalSectionEx MoveFileW DeleteFileW WriteFile QueryPerformanceCounter WaitForSingleObject TerminateProcess TlsGetValue Process32NextW CreateFileA SetEnvironmentVariableA

user32

ExitWindowsEx UnregisterClassW GetSystemMetrics DefWindowProcW GetClientRect SetWindowPos PostMessageW KillTimer IsChild GetWindowRect GetWindowLongW IsZoomed GetMonitorInfoW MonitorFromWindow CopyRect OffsetRect SetWindowLongW IsIconic GetParent ScreenToClient ShowWindow LoadImageW SetWindowRgn PostQuitMessage SetFocus EnableWindow SendMessageW SetTimer CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW PeekMessageW GetMessageW TranslateMessage DispatchMessageW GetWindow MapWindowPoints FindWindowA DestroyWindow IsWindow FindWindowW CharNextW CallWindowProcW

gdi32

GetObjectType DeleteObject CreateRoundRectRgn

advapi32

RegEnumKeyExA GetSidSubAuthority CreateServiceW StartServiceW QueryServiceStatus QueryServiceConfigW CloseServiceHandle ControlService OpenServiceW OpenSCManagerW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW DuplicateToken CreateWellKnownSid CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW FreeSid AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegQueryValueExW OpenProcessToken GetTokenInformation RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW

ole32

CoCreateInstance CoInitializeEx CoInitialize CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW

comctl32

InitCommonControlsEx

crypt32

CryptQueryObject CertFindCertificateInStore CertGetNameStringW CertFreeCertificateContext CertCloseStore CryptMsgClose CryptMsgGetParam

gdiplus

GdipAddPathArc GdipDeleteBrush GdipDrawEllipse GdipCreateSolidFill GdipResetWorldTransform GdipDrawPath GdipRotateWorldTransform GdipTranslateWorldTransform GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipDeletePath GdipCreatePath GdipSetPenEndCap GdipSetPenStartCap GdipSetPenMode GdipDeletePen GdipCreatePen2 GdipCreateLineBrush

iphlpapi

GetAdaptersInfo

Name

.text

Size

259KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

315KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

772KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_e2ae2b4edbd3a4ed948452f8d9581d1e_darkgate_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

crypt32

gdiplus

iphlpapi

generic