2026-11-01_c69cc8db5b414e6e53f4a396113e05d8_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_c69cc8db5b414e6e53f4a396113e05d8_amadey_darkgate_elex_luca-stealer_mespinoza_njrat
Size 2.0MB
Sample261102-k29jkassd1
SHA256 088d8a212c30ac282e3ecc3d2de37afb2f4d8ee8625df05fd6488aedb5e1660c
MD5 c69cc8db5b414e6e53f4a396113e05d8
SHA1 0e9bd8120f8c974ec9d5c4292ef70ac59221c5c2
SHA512 8d3d2dad3018fdd051d4b6cf3410bd6d58dfd60ccdb5acebd2e103c68bca0531c3df2c4d55dcf48722560f1e6f3500d30c69c88c59aba51789a055867ba64575
SSDEEP 49152:hjJ5Y/uArbIskADl/WZ81d08eI4k9uLCErWy98IpI/T2JQP:FJG/DbnkADB71d0834GumErWSl6QQP
TLSH
T1E1A5D005F5529075C8123172341DAB3D6A395E064F358CEBC7A4BDE82FB26D229363FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_c69cc8db5b414e6e53f4a396113e05d8_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-11-01_c69cc8db5b414e6e53f4a396113e05d8_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

.exe 2.0MB

2026-11-01_c69cc8db5b414e6e53f4a396113e05d8_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

IMPHASH e8de47d34b421be9d81fcf022fba6898
SHA256 088d8a212c30ac282e3ecc3d2de37afb2f4d8ee8625df05fd6488aedb5e1660c
MD5 c69cc8db5b414e6e53f4a396113e05d8
SHA1 0e9bd8120f8c974ec9d5c4292ef70ac59221c5c2
SHA512 8d3d2dad3018fdd051d4b6cf3410bd6d58dfd60ccdb5acebd2e103c68bca0531c3df2c4d55dcf48722560f1e6f3500d30c69c88c59aba51789a055867ba64575
SSDEEP 49152:hjJ5Y/uArbIskADl/WZ81d08eI4k9uLCErWy98IpI/T2JQP:FJG/DbnkADB71d0834GumErWSl6QQP
TLSH
T1E1A5D005F5529075C8123172341DAB3D6A395E064F358CEBC7A4BDE82FB26D229363FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

933344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

app_shell_updater.exe.pdb

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

advapi32

CreateProcessAsUserW DuplicateToken GetTokenInformation OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

user32

AllowSetForegroundWindow CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetQueueStatus GetWindowLongW KillTimer LoadStringW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SetTimer SetWindowLongW TranslateMessage UnregisterClassW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CallbackMayRunLong CloseHandle CloseThreadpool CloseThreadpoolWork CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateProcessW CreateThread CreateThreadpool CreateThreadpoolWork DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MapViewOfFile MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ReplaceFileW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SubmitThreadpoolWork SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolWorkCallbacks WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CLSIDFromString CoCreateInstance CoInitialize CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoSetProxyBlanket CoTaskMemFree CoUninitialize IIDFromString

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathMatchSpecW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

174B

Characteristics

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

796KB

Virtual Size

800KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_c69cc8db5b414e6e53f4a396113e05d8_amadey_darkgate_elex_luca-stealer_mespinoza_njrat

winhttp

advapi32

dbghelp

shell32

user32

winmm

kernel32

ole32

userenv

shlwapi

oleaut32

netapi32

iphlpapi

generic