2026-04-23_a3e751967d56586b73f390b9f5460861_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-23_a3e751967d56586b73f390b9f5460861_elex_luca-stealer_mespinoza_njrat_remcos
Size 233KB
Sample260423-c8henag151
SHA256 ff11a7007f8969cb3bb89fe9cb475ac2b4896b9d4ff4858efc890e3cb0fd7875
MD5 a3e751967d56586b73f390b9f5460861
SHA1 c30ad25e583fc7b89e4d88318351531622fa6104
SHA512 4fbc357eaf9d8a85acb931c3456cf9b9ade4e8240cc3262d2b7cd43f23021eed8020aa44c470d0b6d0751345e5c4e59017a11e22a967c8e7fc9226f99341a819
SSDEEP 3072:NB+J3Ym1AQai0uvJRgxeZ/8huBxVYlG2ZEwKlSxzIAAKr+sP2bZmKLxgtrnKfn:L++KAQai08RtuhuBx6EwKlSxcZmNlCn
TLSH
T16A34381133E18471F5B35E3168F89A75592EBD604BA0EDEF93C4121E0A74AE29A34F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-04-23_a3e751967d56586b73f390b9f5460861_elex_luca-stealer_mespinoza_njrat_remcos

.exe 233KB

2026-04-23_a3e751967d56586b73f390b9f5460861_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 9a9260c3900c5b36758d2bf7c0049c48
SHA256 ff11a7007f8969cb3bb89fe9cb475ac2b4896b9d4ff4858efc890e3cb0fd7875
MD5 a3e751967d56586b73f390b9f5460861
SHA1 c30ad25e583fc7b89e4d88318351531622fa6104
SHA512 4fbc357eaf9d8a85acb931c3456cf9b9ade4e8240cc3262d2b7cd43f23021eed8020aa44c470d0b6d0751345e5c4e59017a11e22a967c8e7fc9226f99341a819
SSDEEP 3072:NB+J3Ym1AQai0uvJRgxeZ/8huBxVYlG2ZEwKlSxzIAAKr+sP2bZmKLxgtrnKfn:L++KAQai08RtuhuBx6EwKlSxcZmNlCn
TLSH
T16A34381133E18471F5B35E3168F89A75592EBD604BA0EDEF93C4121E0A74AE29A34F73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

b7:68:c1:89:83:6a:5b:52:c0:21:83:5b:b2:56:df:9e:b9:b1:7f:4f:32:7b:7e:b1:49:e9:a5:dd:b5:b7:cb:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Apr 30, 2021

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

6b:b7:6e:0b:c3:a0:36:c5:93:a8:db:87:37:9b:22:93:96:d3:44:ee

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Apr 30, 2021

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 25, 2020 - Feb 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 25, 2020 - Feb 22, 2024

Minor OS version

Major OS version

Entry point

22274

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\WorkPlace\AndroidEmulator\7KUI_Git_Jonhu_Mu\Basic\Client\Output\Binfinal\UiTools\TUiInst.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

shlwapi

PathFileExistsW PathRemoveFileSpecW PathFindFileNameW StrStrIW PathIsDirectoryW

kernel32

DecodePointer InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadResource LockResource SizeofResource FindResourceW FindResourceExW GetModuleFileNameW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCommandLineW GetPrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileSectionW Sleep MultiByteToWideChar GetVersion GetSystemDirectoryW CreateProcessW WaitForSingleObject WideCharToMultiByte EnterCriticalSection LeaveCriticalSection CloseHandle CreateFileW GetProcAddress GetCurrentThreadId WriteFile ExpandEnvironmentStringsW GetLongPathNameW GetLocalTime CreateDirectoryW LoadLibraryW SetFileAttributesW FindFirstFileW FreeLibrary GetCurrentProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess GetFileAttributesW RemoveDirectoryW MoveFileExW FindNextFileW FindClose CopyFileW VirtualAlloc VirtualFree MoveFileW OutputDebugStringW IsDebuggerPresent GetEnvironmentStringsW GetCPInfo GetOEMCP GetModuleHandleW GetLastError RaiseException InterlockedExchange InterlockedCompareExchange WriteConsoleW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx DeleteFileW IsValidCodePage FindNextFileA FindFirstFileExA LCMapStringW CompareStringW GetStringTypeW GetFileType SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetLastError RtlUnwind GetFileAttributesExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetStdHandle GetCommandLineA GetACP

advapi32

OpenProcessToken RegDeleteKeyW CloseServiceHandle DeleteService ControlService OpenServiceW OpenSCManagerW AdjustTokenPrivileges LookupPrivilegeValueW LookupPrivilegeNameW GetTokenInformation RegSetValueExW RegCreateKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHCreateDirectoryExW

ole32

CoUninitialize CoInitialize CoCreateInstance

Name

.text

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-23_a3e751967d56586b73f390b9f5460861_elex_luca-stealer_mespinoza_njrat_remcos

PE Signature issue

version

psapi

shlwapi

kernel32

advapi32

shell32

ole32

generic