2026-05-11_181baf5550d45f0f0d9b19de76911106_elex_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-11_181baf5550d45f0f0d9b19de76911106_elex_luca-stealer_magniber_njrat
Size 6.4MB
Sample260511-qq5dcset3j
SHA256 791f0261a75ce6f8cca56d949f2ffa3b0d4d04894a9fb68e11cb3399c2afa18a
MD5 181baf5550d45f0f0d9b19de76911106
SHA1 3f38778cc0a95551a2faa9804c893049a4643a68
SHA512 c5a9012b1bab937a27a881529546ca17422329f4ce644c2e4c004a4cd5db5b82273415c65c288fbe7d5b2505a8d69a108e0f9ef0faf9d197cf393936b5631957
SSDEEP 98304:uzFn2N5DSxIED25fumsCBmINVWyTBKDfAl4m/m:vLTur8mLzfAl4+m
TLSH
T1A666BDD1ED52D123E3B7007161A9427CF96D3EE4432984FF61A0F5FA6635AF82436A83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-11_181baf5550d45f0f0d9b19de76911106_elex_luca-stealer_magniber_njrat

File Explorer

2026-05-11_181baf5550d45f0f0d9b19de76911106_elex_luca-stealer_magniber_njrat

.exe 6.4MB

2026-05-11_181baf5550d45f0f0d9b19de76911106_elex_luca-stealer_magniber_njrat

IMPHASH 1881faf9079ac1a77dc1614af4a76d09
SHA256 791f0261a75ce6f8cca56d949f2ffa3b0d4d04894a9fb68e11cb3399c2afa18a
MD5 181baf5550d45f0f0d9b19de76911106
SHA1 3f38778cc0a95551a2faa9804c893049a4643a68
SHA512 c5a9012b1bab937a27a881529546ca17422329f4ce644c2e4c004a4cd5db5b82273415c65c288fbe7d5b2505a8d69a108e0f9ef0faf9d197cf393936b5631957
SSDEEP 98304:uzFn2N5DSxIED25fumsCBmINVWyTBKDfAl4m/m:vLTur8mLzfAl4+m
TLSH
T1A666BDD1ED52D123E3B7007161A9427CF96D3EE4432984FF61A0F5FA6635AF82436A83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

15:7a:39:39:3d:9b:20:1b:1e:bd:ee:60:9d:fa:0a:86:97:ba:04:c2:f5:1b:b3:f9:a8:23:ae:49:97:54:b4:23

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 26, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2024 - Apr 10, 2027

Subject

CN=Dummy certificate

Serial Number

Issuer

CN=Dummy issuer

Timespan

Jan 1, 2013 - Apr 1, 2013

Minor OS version

Major OS version

Entry point

431552

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\YYY\Y\_int\ceshi\debug\win32\debuger\ceshi.pdb

kernel32

MulDiv DebugBreak InitializeCriticalSection GetTickCount FreeResource LoadResource LockResource SizeofResource FindResourceW FreeLibrary GetProcAddress LoadLibraryW GetUserDefaultLCID GetCommandLineW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileAttributesExW ReadFile RemoveDirectoryW CreatePipe PeekNamedPipe WaitForSingleObject GetCurrentProcess GetExitCodeProcess CreateProcessW GetSystemInfo GetVersionExW VirtualQuery GlobalFlags LocalFree FormatMessageW CopyFileW IsBadReadPtr IsBadWritePtr SetSystemPowerState MultiByteToWideChar WideCharToMultiByte GenerateConsoleCtrlEvent GetQueuedCompletionStatus SetEvent ResetEvent CreateThread SetThreadPriority FileTimeToLocalFileTime GetSystemTimeAsFileTime GetLocalTime GlobalLock FileTimeToSystemTime LoadLibraryExW lstrcmpiW lstrcpynW FlushFileBuffers GetStringTypeW SetStdHandle HeapQueryInformation SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx GetConsoleOutputCP SetFilePointerEx ReadConsoleW GetConsoleMode GetCurrentThread SetConsoleCtrlHandler HeapValidate GetCommandLineA WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer InterlockedFlushSList InterlockedPushEntrySList RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GlobalUnlock GlobalSize GlobalReAlloc GlobalAlloc TryEnterCriticalSection OutputDebugStringW GetProcessHandleCount OpenProcess TerminateProcess DecodePointer GetCurrentProcessId WriteFile GetModuleHandleW GetCurrentThreadId LeaveCriticalSection EnterCriticalSection IsDebuggerPresent CreateEventW GetModuleFileNameW GetWindowsDirectoryW GetSystemDirectoryW GetTempPathW IsBadStringPtrW Sleep CloseHandle CreateFileW GlobalFree IsBadStringPtrA ExitProcess DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException SetLocalTime SetEndOfFile

user32

EnumWindows UnregisterClassW MessageBoxW GetMessageW TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW DestroyWindow GetSystemMetrics GetClientRect CharNextW wsprintfW GetKeyState GetMonitorInfoW GetWindowRect LoadStringW SendMessageW PostMessageW RegisterClassW GetClassInfoW CreateWindowExW GetActiveWindow SetTimer SetPropW GetPropW RemovePropW GetWindowLongW GetDC GetDesktopWindow GetParent LoadCursorW LoadIconW LoadImageW CopyImage ExitWindowsEx AttachThreadInput WaitForInputIdle ReleaseDC MoveWindow GetWindowDC MonitorFromWindow EnumDisplaySettingsW GetWindowThreadProcessId OpenClipboard SetForegroundWindow SetActiveWindow EmptyClipboard GetClipboardData SetClipboardData CloseClipboard

gdi32

CreateDIBSection SetStretchBltMode StretchBlt SelectPalette SelectObject RealizePalette GetSystemPaletteEntries GetStockObject GetDIBits GetDeviceCaps DeleteObject CreatePalette CreateCompatibleDC CreateCompatibleBitmap BitBlt SetDIBColorTable GetObjectW CreateFontIndirectW GetTextExtentPoint32W GdiAlphaBlend DeleteDC

advapi32

RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegSetValueExW RegQueryValueExW RegQueryValueW RegOpenKeyExW AdjustTokenPrivileges RegCloseKey LookupPrivilegeValueW OpenProcessToken

shell32

SHGetSpecialFolderPathW DragAcceptFiles ShellExecuteW

ole32

CreateStreamOnHGlobal CoUninitialize CoInitializeEx CoCreateInstance CLSIDFromString IIDFromString CLSIDFromProgID OleRun CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

VariantCopyInd VariantChangeType VariantCopy VariantClear VarUI4FromStr VariantTimeToSystemTime SystemTimeToVariantTime VarUdateFromDate OleCreatePictureIndirect OleCreateFontIndirect GetActiveObject RegisterTypeLi LoadTypeLi LHashValOfNameSys SysFreeString SysAllocString SysStringLen SafeArrayCreate SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData VariantInit VarCmp

comctl32

ImageList_Destroy ImageList_Create InitCommonControlsEx ImageList_AddMasked

ws2_32

WSACleanup WSAStartup

gdiplus

GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePixelFormat GdipDeleteGraphics GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipBitmapUnlockBits GdipDrawImageRectI GdipGetImageHeight GdipGetImagePalette GdipSetCompositingMode

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_181baf5550d45f0f0d9b19de76911106_elex_luca-stealer_magniber_njrat

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

gdiplus

generic