2026-11-01_864c42c136acb601ded41728e9b18ea4_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_864c42c136acb601ded41728e9b18ea4_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi
Size 1.5MB
Sample261102-te77nabt2w
SHA256 aa7aacc4ee0524a4b24f15c316da6f8350a75997a2cf2cf65ab814865d477c54
MD5 864c42c136acb601ded41728e9b18ea4
SHA1 4480a2e7509d1e95952947c150964d49f2487029
SHA512 78dc29a36dcf4544ba62f1fa467ff8308eef15e7e844349fc3ede904d503419daa80457384665df50d9b9c3f6b5c876c0159d274d84569932d550709f19f89b4
SSDEEP 24576:QXVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWIZAmOLB:C5RP/d6IxNIKnL5mO8ofTrZAmm
TLSH
T150759D01A4629075CB522271EC2CF73D6B206E1D4BF249F7FB946DE9AFB01E0353259A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_864c42c136acb601ded41728e9b18ea4_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi

File Explorer

2026-11-01_864c42c136acb601ded41728e9b18ea4_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi

.exe 1.5MB

2026-11-01_864c42c136acb601ded41728e9b18ea4_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi

IMPHASH 01bf557f4427f3c38117e8cd2a56eebb
SHA256 aa7aacc4ee0524a4b24f15c316da6f8350a75997a2cf2cf65ab814865d477c54
MD5 864c42c136acb601ded41728e9b18ea4
SHA1 4480a2e7509d1e95952947c150964d49f2487029
SHA512 78dc29a36dcf4544ba62f1fa467ff8308eef15e7e844349fc3ede904d503419daa80457384665df50d9b9c3f6b5c876c0159d274d84569932d550709f19f89b4
SSDEEP 24576:QXVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWIZAmOLB:C5RP/d6IxNIKnL5mO8ofTrZAmm
TLSH
T150759D01A4629075CB522271EC2CF73D6B206E1D4BF249F7FB946DE9AFB01E0353259A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1634304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\build\nw29_win32\node-webkit\src\outst\nw\initialexe\nw.exe.pdb

nw_elf

SignalChromeElf GetInstallDetailsPayload

advapi32

ImpersonateNamedPipeClient SetEntriesInAclW GetSecurityInfo OpenProcessToken GetTokenInformation ConvertSidToStringSidW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegDeleteValueW RegSetValueExW SystemFunction036 EventRegister EventUnregister EventWrite RevertToSelf RegDisablePredefinedCache ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityInfo ConvertStringSidToSidW GetLengthSid SetTokenInformation GetKernelObjectSecurity GetAce SetKernelObjectSecurity DuplicateTokenEx EqualSid CreateProcessAsUserW SetThreadToken CreateRestrictedToken DuplicateToken LookupPrivilegeValueW CopySid CreateWellKnownSid

kernel32

GetThreadLocale GetSystemDefaultLCID GetCurrentThreadId GetModuleFileNameW CreateEventW GetLastError SetLastError GetCurrentProcess DuplicateHandle GetProcessId WaitForSingleObject GetCurrentDirectoryW SetCurrentDirectoryW LoadLibraryExW GetProcAddress SetProcessShutdownParameters VirtualAlloc VirtualFree MultiByteToWideChar WideCharToMultiByte ExitProcess InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCommandLineW LocalFree GetModuleHandleW GetSystemTimeAsFileTime ReleaseSRWLockExclusive TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime QueryPerformanceFrequency QueryPerformanceCounter QueryThreadCycleTime GetCurrentThread GetThreadPriority SetThreadPriority Sleep LoadLibraryW GetModuleHandleA ExpandEnvironmentStringsW CloseHandle DeleteFileW OutputDebugStringA WriteFile CreateFileW GetCurrentProcessId GetLocalTime GetTickCount FormatMessageA OpenProcess TerminateProcess GetExitCodeProcess SetFilePointerEx ReadFile GetFileSizeEx SetEndOfFile SetFileTime GetFileInformationByHandle FlushFileBuffers HeapCreate HeapDestroy UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery IsDebuggerPresent RaiseException CreateThread GetThreadId TryAcquireSRWLockExclusive AcquireSRWLockExclusive GetVersionExW GetNativeSystemInfo GetFileAttributesW SetFileAttributesW RemoveDirectoryW MoveFileW ReplaceFileW CreateDirectoryW GetTempPathW GetLongPathNameW QueryDosDeviceW GetSystemDirectoryW GetWindowsDirectoryW UnregisterWaitEx RegisterWaitForSingleObject SetUnhandledExceptionFilter RtlCaptureStackBackTrace TlsGetValue HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessTimes GetModuleHandleExW GetUserDefaultLangID FreeLibrary FindClose FindNextFileW FindFirstFileExW SetEnvironmentVariableW GetEnvironmentVariableW FlushViewOfFile TlsAlloc TlsFree TlsSetValue IsWow64Process SwitchToThread CreateIoCompletionPort PostQueuedCompletionStatus SetInformationJobObject GetQueuedCompletionStatus VirtualQueryEx GetSystemInfo HeapSetInformation ResetEvent SetEvent VirtualProtect SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeCriticalSectionAndSpinCount DecodePointer CreateProcessW GetTimeZoneInformation CreateSemaphoreW ReleaseSemaphore OutputDebugStringW LockFileEx UnlockFileEx GetFileType GetStdHandle SetConsoleCtrlHandler VirtualAllocEx TerminateJobObject GetUserDefaultLCID ProcessIdToSessionId SetHandleInformation AssignProcessToJobObject WriteProcessMemory GetProcessHandleCount GetProcessHeaps SignalObjectAndWait VirtualProtectEx ReadProcessMemory VirtualFreeEx CreateNamedPipeW CreateRemoteThread CreateJobObjectW CreateMutexW SearchPathW lstrlenW DebugBreak LoadLibraryExA GetThreadContext SuspendThread TransactNamedPipe SetNamedPipeHandleState WaitNamedPipeW DisconnectNamedPipe ConnectNamedPipe GetFileInformationByHandleEx GetVersion SleepEx SetFilePointer GetThreadTimes WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage EnumSystemLocalesW IsValidLocale ResumeThread ReadConsoleW SetStdHandle GetFullPathNameW GetConsoleMode GetConsoleCP PeekNamedPipe GetDriveTypeW GetACP RtlUnwind GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetStringTypeW GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx InitOnceExecuteOnce

psapi

GetProcessMemoryInfo GetPerformanceInfo QueryWorkingSetEx

shell32

SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW

shlwapi

PathMatchSpecW

user32

RegisterClassW PostThreadMessageW PeekMessageW SetProcessDPIAware GetMessageW GetUserObjectInformationW CreateDesktopW SetProcessWindowStation GetThreadDesktop CreateWindowStationW GetProcessWindowStation CloseWindowStation CloseDesktop wsprintfW UnregisterClassW DefWindowProcW SetWindowLongW GetWindowLongW CreateWindowExW DestroyWindow RegisterClassExW DispatchMessageW TranslateMessage PostQuitMessage MsgWaitForMultipleObjectsEx GetQueueStatus SetTimer PostMessageW KillTimer

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

winmm

timeBeginPeriod timeGetTime timeEndPeriod

winhttp

WinHttpSetTimeouts WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpWriteData WinHttpReadData WinHttpReceiveResponse WinHttpCloseHandle WinHttpQueryHeaders WinHttpCrackUrl

Name

.text

Size

1003KB

Virtual Size

1002KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_text32

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

303KB

Virtual Size

302KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

��u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_864c42c136acb601ded41728e9b18ea4_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi

nw_elf

advapi32

kernel32

psapi

shell32

shlwapi

user32

version

winmm

winhttp

generic