2026-11-01_801a155e40fb5ad02e79c8ed2a2b1e42_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_801a155e40fb5ad02e79c8ed2a2b1e42_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 2.0MB
Sample261102-t4eawabv7w
SHA256 cb6e30987e22439838b59ebf2a91770fd69e68610b3478e9b546e3a6428a2622
MD5 801a155e40fb5ad02e79c8ed2a2b1e42
SHA1 18575e541e0ccad1ee5330386e54eb93e0403fb7
SHA512 e08bf272ebd7e4d4fe2ae9b3407067f5c9420335568f6c014c3aff1db1de4e7e2c3b0f0595f473dd3a9b03637fe4949d8ae0d7fbcc1a0c5cbbd8098c095e20e8
SSDEEP 49152:QZeJPwDKTf0BEUGIMtlJ7s25Mw2OylsYv:QswDmf0BEUq3hs25F0v
TLSH
T13195E012F445C072D3724733BDA82B39149ABE60B636998BF3883D5F2DE76819925373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_801a155e40fb5ad02e79c8ed2a2b1e42_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-11-01_801a155e40fb5ad02e79c8ed2a2b1e42_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 2.0MB

2026-11-01_801a155e40fb5ad02e79c8ed2a2b1e42_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH bc51e7aa44a148cf1a42976740808084
SHA256 cb6e30987e22439838b59ebf2a91770fd69e68610b3478e9b546e3a6428a2622
MD5 801a155e40fb5ad02e79c8ed2a2b1e42
SHA1 18575e541e0ccad1ee5330386e54eb93e0403fb7
SHA512 e08bf272ebd7e4d4fe2ae9b3407067f5c9420335568f6c014c3aff1db1de4e7e2c3b0f0595f473dd3a9b03637fe4949d8ae0d7fbcc1a0c5cbbd8098c095e20e8
SSDEEP 49152:QZeJPwDKTf0BEUGIMtlJ7s25Mw2OylsYv:QswDmf0BEUq3hs25F0v
TLSH
T13195E012F445C072D3724733BDA82B39149ABE60B636998BF3883D5F2DE76819925373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\docker\Documents\workspace\build-v2\common\hrappstore2\bin\HrAppStoreUninst.pdb

kernel32

CreateThread SetEvent OpenEventW GetTempFileNameW ExpandEnvironmentStringsW GetTempPathW OpenMutexW CopyFileW SetCurrentDirectoryW FreeResource CreateMutexW GetModuleFileNameW LoadLibraryExW lstrcmpiW FreeLibrary GetFileAttributesW MoveFileW DeleteFileW MoveFileExW RemoveDirectoryW SetFileAttributesW FindClose FindNextFileW FindFirstFileW Process32NextW GetCurrentProcessId Process32FirstW CreateToolhelp32Snapshot TerminateProcess K32GetProcessImageFileNameW WaitForSingleObject CreateProcessW WinExec SetLastError GetCurrentThreadId DecodePointer WriteConsoleW GetConsoleCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW RaiseException InitializeCriticalSectionEx FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleHandleW LoadLibraryA CreateFileW GetVersion GetProcAddress GetModuleHandleA GetTickCount WideCharToMultiByte DeleteCriticalSection GetWindowsDirectoryW CloseHandle Sleep MultiByteToWideChar OpenProcess InitializeCriticalSection LeaveCriticalSection GetCurrentProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetConsoleMode SetFilePointerEx GetStringTypeW GetStdHandle GetModuleHandleExW ExitProcess RtlUnwind TlsFree TlsSetValue GetLongPathNameW EnterCriticalSection TlsAlloc InitializeCriticalSectionAndSpinCount GetLocalTime ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW EncodePointer InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA GetACP InterlockedIncrement InterlockedDecrement GetFileSize ReadFile LoadLibraryW GetCurrentDirectoryW MulDiv GetVersionExW lstrlenW GetFileType WriteFile SetFilePointer SetFileTime DuplicateHandle SystemTimeToFileTime DosDateTimeToFileTime CreateDirectoryW TlsGetValue

user32

GetParent ActivateKeyboardLayout ExitWindowsEx GetCursorPos SendMessageW GetSystemMetrics LoadImageW SetForegroundWindow FindWindowW DestroyWindow CharNextW ClientToScreen MoveWindow SetWindowRgn IsIconic OffsetRect IsZoomed SetTimer wvsprintfW SetCursor UnionRect GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect IntersectRect IsRectEmpty PtInRect EnumChildWindows NotifyWinEvent EnumDisplaySettingsW MonitorFromPoint DrawTextW SetWindowTextW GetWindowTextW GetWindowTextLengthW GetCaretBlinkTime GetCaretPos FillRect EqualRect RegisterClassW SetPropW GetPropW CharPrevW SetRect CreateCaret HideCaret ShowCaret SetCaretPos GetSysColor CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo PrivateExtractIconsW DestroyIcon DrawIconEx GetIconInfo CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW ScreenToClient KillTimer CallWindowProcW SetWindowLongW IsChild PostQuitMessage DispatchMessageW TranslateMessage SetFocus GetMessageW PeekMessageW IsWindow EnableWindow ShowWindow PostMessageW CopyRect GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos DefWindowProcW UnregisterClassW GetWindowRect IsWindowVisible

gdi32

GetObjectType CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC GetStockObject Rectangle RestoreDC RoundRect SaveDC SelectObject GetTextMetricsW ExtCreatePen GetObjectW CreateSolidBrush SetBkMode SetTextColor CombineRgn CreateCompatibleBitmap CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo SelectClipRgn ExtSelectClipRgn SetBkColor StretchBlt SetStretchBltMode CreateDIBSection MoveToEx TextOutW ExtTextOutW GetDeviceCaps GetObjectA CreateRoundRectRgn DeleteObject BitBlt

advapi32

RegQueryValueExA RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegOpenKeyExA RegQueryValueExW RegCloseKey OpenProcessToken

shell32

SHChangeNotify SHGetSpecialFolderPathW SHGetFileInfoW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitializeEx OleLockRunning CLSIDFromProgID CLSIDFromString CoCreateInstance CoUninitialize

oleaut32

SysAllocString VarUI4FromStr VariantInit SysFreeString VariantClear

shlwapi

SHDeleteKeyW PathIsUNCW PathIsDirectoryW

comctl32

InitCommonControlsEx ImageList_DrawIndirect _TrackMouseEvent ord17 ImageList_GetImageCount

oleacc

LresultFromObject CreateStdAccessibleObject

gdiplus

GdipFree GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipSetTextRenderingHint GdipDeleteGraphics GdipCreateFromHDC GdiplusStartup GdiplusShutdown GdipAlloc GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI

Name

.text

Size

482KB

Virtual Size

481KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

597KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

787KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_801a155e40fb5ad02e79c8ed2a2b1e42_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

oleacc

gdiplus

generic