2026-11-12_664bbbab7824a1476f2c09a48d94ccec_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_664bbbab7824a1476f2c09a48d94ccec_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos
Size 1.9MB
Sample261113-bvw58aev2v
SHA256 de9c2558cda40d2200b4bde4e782c250ec7d5796ba711a2f0f9ffc0631ec545d
MD5 664bbbab7824a1476f2c09a48d94ccec
SHA1 f99beec99438ef6f2cf4b28669e5cd32fbe7d2a5
SHA512 e95afa43a70c95a59c772b20575c38226d5ee250dabeaeabc255398e5ee6c74e81145aaef5f2bf7b8163a22c03460c248530a66a7c0160fdb6b6187cf7f80808
SSDEEP 24576:ncdIaquligZ+PSJbiqJAeLjFP+D0vPKs0DRXw:nLSZFbQe/t3z0D
TLSH
T11595D012BBC0D071E9B22930CA61A7F59ABDBD20F924CD1B67D43E4D79701D0A53A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_664bbbab7824a1476f2c09a48d94ccec_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-11-12_664bbbab7824a1476f2c09a48d94ccec_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

.exe 1.9MB

2026-11-12_664bbbab7824a1476f2c09a48d94ccec_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH c2837644c27bf27b304e97f1162b5384
SHA256 de9c2558cda40d2200b4bde4e782c250ec7d5796ba711a2f0f9ffc0631ec545d
MD5 664bbbab7824a1476f2c09a48d94ccec
SHA1 f99beec99438ef6f2cf4b28669e5cd32fbe7d2a5
SHA512 e95afa43a70c95a59c772b20575c38226d5ee250dabeaeabc255398e5ee6c74e81145aaef5f2bf7b8163a22c03460c248530a66a7c0160fdb6b6187cf7f80808
SSDEEP 24576:ncdIaquligZ+PSJbiqJAeLjFP+D0vPKs0DRXw:nLSZFbQe/t3z0D
TLSH
T11595D012BBC0D071E9B22930CA61A7F59ABDBD20F924CD1B67D43E4D79701D0A53A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Branch\win\Release\stubs\x86\Updater.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

InternetCrackUrlW InternetCloseHandle InternetOpenW InternetConnectW HttpOpenRequestW HttpAddRequestHeadersW InternetQueryOptionW InternetSetOptionW HttpSendRequestExW HttpEndRequestW InternetWriteFile InternetReadFile HttpQueryInfoW InternetErrorDlg FtpCommandW FtpOpenFileW HttpSendRequestW FtpGetFileSize InternetQueryDataAvailable InternetGetLastResponseInfoW InternetSetStatusCallbackW

msi

ord173

crypt32

CertNameToStrW

mpr

WNetAddConnection2W

kernel32

LCMapStringW GetFileType GetStringTypeW GetStdHandle GetModuleHandleExW ExitProcess IsValidCodePage InterlockedPushEntrySList InterlockedPopEntrySList FileTimeToSystemTime GetLastError SystemTimeToFileTime CompareFileTime RaiseException CopyFileExW DeleteFileW MoveFileW CreateFileW CloseHandle LocalFree LocalAlloc LoadLibraryW GetProcAddress FreeLibrary SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap MultiByteToWideChar WideCharToMultiByte FindClose FindFirstFileW SetLastError GetFileSize ReadFile SetFilePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount lstrcmpiW GetVersionExW GetModuleHandleW lstrlenW CompareStringW GetCurrentProcess GetTickCount Sleep WaitForSingleObject GetExitCodeThread TerminateThread CreateThread WriteFile CreateEventW SetEvent FlushFileBuffers ResetEvent GlobalFree MulDiv EnterCriticalSection LeaveCriticalSection GetOEMCP GetCurrentThreadId OutputDebugStringW GetModuleFileNameW CreateProcessW InterlockedIncrement InterlockedDecrement QueryPerformanceFrequency QueryPerformanceCounter GetSystemDefaultLangID RemoveDirectoryW GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetTempPathW GetTempFileNameW CopyFileW GetSystemTime FileTimeToLocalFileTime GetDateFormatW GetTimeFormatW GetLocaleInfoW GetExitCodeProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW FormatMessageW GetFileTime FindNextFileW SetFileAttributesW CreateDirectoryW GetEnvironmentVariableW UnmapViewOfFile ReleaseMutex CreateFileMappingW MapViewOfFile CreateMutexW OpenFileMappingW OpenEventW lstrcpynW DecodePointer GetACP LoadLibraryExW OpenProcess Module32FirstW InitializeSListHead EncodePointer IsDebuggerPresent LoadLibraryExA VirtualQuery VirtualProtect FlushInstructionCache GetSystemInfo IsProcessorFeaturePresent VirtualAlloc GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineA VirtualFree WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW GetSystemTimeAsFileTime TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind GetCommandLineW FindFirstFileExW SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx GetCurrentProcessId WriteConsoleW

user32

PeekMessageW DispatchMessageW LoadImageW LockWindowUpdate DestroyMenu EnableMenuItem TrackPopupMenu RegisterClassExW GetClassInfoExW GetSubMenu LoadMenuW ModifyMenuW GetMessagePos SetCursorPos RemovePropW SetPropW GetWindowDC DrawEdge GetActiveWindow DialogBoxParamW MoveWindow GetSystemMenu DrawMenuBar RegisterWindowMessageW GetMessageW GetDesktopWindow PostQuitMessage GetSystemMetrics GetMenuItemID GetPropW MonitorFromPoint EndPaint BeginPaint SetCursor FillRect SetFocus ReleaseCapture GetCapture PtInRect ScreenToClient GetCursorPos UpdateWindow InvalidateRect PostMessageW PostThreadMessageW ShowWindow EndDialog GetWindow MonitorFromWindow GetMonitorInfoW GetWindowRect MapWindowPoints CharNextW OffsetRect ReleaseDC GetDC IsWindow SetRectEmpty GetWindowTextW GetWindowTextLengthW CreateWindowExW SystemParametersInfoW LoadCursorW GetClassNameW GetClientRect EnableWindow GetDlgItem IsWindowVisible GetWindowThreadProcessId EnumWindows SetForegroundWindow MessageBoxW GetForegroundWindow SetMenuDefaultItem GetDlgCtrlID DrawFocusRect GetFocus DrawTextW GetSysColor IsWindowEnabled RedrawWindow SetWindowPos UnregisterClassW CallWindowProcW GetWindowLongW SetWindowLongW LoadStringW GetParent SetWindowTextW SendMessageW SetCapture DestroyWindow DefWindowProcW

gdi32

CreateBitmap PatBlt GetObjectW GetStockObject DeleteObject CreateFontIndirectW SelectObject SetTextColor SetBkMode CreatePatternBrush

shell32

SHBrowseForFolderW Shell_NotifyIconW ShellExecuteExW SHGetFolderPathW ShellExecuteW SHGetPathFromIDListW

ole32

CoRevokeClassObject CoRegisterClassObject CoTaskMemFree CoAddRefServerProcess CoReleaseServerProcess CoCreateInstance CLSIDFromString CoResumeClassObjects CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoInitializeEx

oleaut32

RevokeActiveObject VarUI4FromStr LoadTypeLi SysFreeString SysAllocString DispInvoke DispGetIDsOfNames

shlwapi

PathFileExistsW

comctl32

CreatePropertySheetPageW InitCommonControlsEx DestroyPropertySheetPage PropertySheetW _TrackMouseEvent

urlmon

FindMimeFromData

Name

.text

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_664bbbab7824a1476f2c09a48d94ccec_adposhel_darkgate_elex_luca-stealer_mespinoza_njrat_remcos

version

wininet

msi

crypt32

mpr

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

comctl32

urlmon

generic