2026-07-11_9469bb2943150e35678de732704a31db_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_9469bb2943150e35678de732704a31db_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos
Size 4.8MB
Sample260711-p4dbcsa13p
SHA256 828cec4025696a3ea09c6f8baa742d04b609fd5906e0d777431f1fc8837a93ba
MD5 9469bb2943150e35678de732704a31db
SHA1 f0becaf93d604e6f8661530db02364db1ac74d5c
SHA512 e941f0907d972ce786b8d97e6e852c416f8c6c94b1e0c8ad95b923e31d84cadcc0485979019f3e54d6d5df203ac74fd9589c4a1c12618db23654a9443fcffd01
SSDEEP 98304:U27DOlNUcF5IOgqUXVBXNPL2Wf5N8er4XuN5oxqpCgbHyod8:UhF5dqRLB5N8S4XuN56qlyod8
TLSH
T1D03612213D82C035E6962132C97CFA6B466DAF201B3656EB639C1B3D1F705D32E32667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_9469bb2943150e35678de732704a31db_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

File Explorer

2026-07-11_9469bb2943150e35678de732704a31db_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

.exe 4.8MB

2026-07-11_9469bb2943150e35678de732704a31db_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

IMPHASH 8cf418129bdc8bc7d6f254bdf2bb92cc
SHA256 828cec4025696a3ea09c6f8baa742d04b609fd5906e0d777431f1fc8837a93ba
MD5 9469bb2943150e35678de732704a31db
SHA1 f0becaf93d604e6f8661530db02364db1ac74d5c
SHA512 e941f0907d972ce786b8d97e6e852c416f8c6c94b1e0c8ad95b923e31d84cadcc0485979019f3e54d6d5df203ac74fd9589c4a1c12618db23654a9443fcffd01
SSDEEP 98304:U27DOlNUcF5IOgqUXVBXNPL2Wf5N8er4XuN5oxqpCgbHyod8:UhF5dqRLB5N8S4XuN56qlyod8
TLSH
T1D03612213D82C035E6962132C97CFA6B466DAF201B3656EB639C1B3D1F705D32E32667
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

499047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\977679\out\Release\CadCompSetup.pdb

kernel32

FindResourceW FindResourceExW GetComputerNameW GetLocalTime FormatMessageW LocalFree GetExitCodeProcess GetCurrentThreadId WriteFile SetFilePointer GetFileSize CreateFileMappingW MapViewOfFileEx UnmapViewOfFile InterlockedCompareExchange LoadLibraryW lstrlenA OutputDebugStringW GetPrivateProfileStringW GetPrivateProfileIntW PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateIoCompletionPort GetQueuedCompletionStatus MapViewOfFile CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileSizeEx ReadFile SetFilePointerEx FlushViewOfFile SetEndOfFile GlobalAlloc GlobalFree FindFirstFileW DeleteFileW FindNextFileW FindClose RemoveDirectoryW MoveFileExW SetFileAttributesW GetLongPathNameW IsBadReadPtr GetWindowsDirectoryW GetDriveTypeW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetVolumeInformationW OpenProcess lstrlenW lstrcpynA GetFileAttributesExW Thread32First Thread32Next GetCurrentProcess lstrcmpiW VirtualAllocEx WriteProcessMemory VirtualFreeEx CreateRemoteThread ReadProcessMemory lstrcpyW Module32FirstW Module32NextW lstrcmpA OpenThread GetModuleHandleExW OutputDebugStringA OpenEventW ResumeThread ExpandEnvironmentStringsW GetThreadLocale SetThreadLocale GlobalLock GlobalSize GlobalUnlock GetVersionExW GetWindowsDirectoryA GetTempPathW SystemTimeToFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleHandleA GlobalMemoryStatusEx GetCommandLineW GetSystemDefaultLCID ReadConsoleW WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetFileType GetACP LockResource ExitProcess ExitThread VirtualQuery RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle SetProcessAffinityMask FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority SizeofResource GetProcessHeap HeapSize HeapDestroy InterlockedExchange CreateProcessW InitializeCriticalSection DeleteCriticalSection EnumDateFormatsExW EnumCalendarInfoExW GetCurrencyFormatW GetNumberFormatW GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess GetProcessTimes CreateWaitableTimerW CreateSemaphoreW Sleep CreateEventW CreateEventA CreateMutexW CreateMutexA WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl HeapFree HeapReAlloc HeapAlloc CreateThread SignalObjectAndWait CreateTimerQueue RtlCaptureStackBackTrace ReleaseSemaphore GetProcessAffinityMask GlobalMemoryStatus DosDateTimeToFileTime FileTimeToDosDateTime FileTimeToLocalFileTime MoveFileW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW CompareFileTime FindCloseChangeNotification FindFirstChangeNotificationW GetFileAttributesW GetStdHandle GetFileInformationByHandle SetFileTime InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime IsDebuggerPresent LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo TryEnterCriticalSection GetStringTypeW LoadResource GetCurrentProcessId GetModuleFileNameW GetModuleFileNameA SetErrorMode SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetFullPathNameW GetUserDefaultLCID CreateFileW

user32

BringWindowToTop SetActiveWindow PostMessageW DispatchMessageW UnhookWinEvent PostThreadMessageW UnregisterClassW GetMessageW SetWinEventHook UpdateWindow InvalidateRect AttachThreadInput GetForegroundWindow GetWindowThreadProcessId IsWindow RegisterClassExW CreateWindowExW SetForegroundWindow SetWindowLongW ShowWindow IsIconic GetClassLongW DestroyWindow GetWindowLongW DefWindowProcW wsprintfW GetActiveWindow MessageBoxW EnumWindows EnumDesktopWindows IsWindowVisible SetWindowPos WaitForInputIdle OpenClipboard IsClipboardFormatAvailable GetClipboardData CloseClipboard FindWindowW GetClassNameW GetWindowTextW SetLayeredWindowAttributes CharUpperW SendMessageW TranslateMessage

gdi32

SelectObject CreateCompatibleDC GetObjectW SetDIBColorTable DeleteDC DeleteObject CreateDIBSection

advapi32

RegEnumKeyExW RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyA RegDeleteKeyW RegDeleteValueA RegDeleteValueW RegOpenKeyExA RegOpenKeyExW ConvertSidToStringSidW LookupAccountNameW GetUserNameW GetUserNameA LookupAccountNameA GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid LookupAccountSidW GetTokenInformation FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW EnumServicesStatusExW CreateProcessAsUserW DuplicateTokenEx AccessCheck MapGenericMask DuplicateToken OpenProcessToken GetFileSecurityW CloseServiceHandle EnumServicesStatusW OpenSCManagerW RegOpenKeyW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA ImpersonateSelf

shell32

SHGetFolderPathW ord16 SHGetFolderLocation ord102 ShellExecuteExW ord165 ord232 ShellExecuteW SHGetSpecialFolderPathW ord680 SHGetFileInfoW ord178 ord155 ord18 CommandLineToArgvW SHGetDesktopFolder ord17

ole32

CLSIDFromString CoCreateGuid CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoCreateInstance StringFromCLSID CoTaskMemAlloc

oleaut32

VariantClear VariantInit VariantCopy SysAllocStringByteLen SysStringLen SysAllocStringLen SysFreeString SysAllocString

shlwapi

StrCmpNIW PathRelativePathToW PathCommonPrefixW PathIsPrefixW StrFormatByteSizeW PathCanonicalizeW PathIsDirectoryW PathIsRootW StrCmpIW PathRemoveBackslashW StrCpyNW ord176 SHSetValueW SHDeleteValueW StrStrIW UrlGetPartW SHDeleteKeyA SHDeleteKeyW SHQueryValueExA SHQueryValueExW SHCopyKeyA SHCopyKeyW PathFileExistsW PathRemoveFileSpecW PathAppendW PathCombineW PathFindFileNameW PathFindExtensionW PathAppendA SHGetValueW

ws2_32

select WSASetLastError __WSAFDIsSet

version

GetFileVersionInfoW GetFileVersionInfoA GetFileVersionInfoSizeW GetFileVersionInfoSizeA VerQueryValueW

psapi

EnumPageFilesA EnumPageFilesW GetPerformanceInfo GetDeviceDriverFileNameW GetDeviceDriverFileNameA EnumProcessModules GetModuleFileNameExA GetModuleFileNameExW GetWsChanges GetProcessImageFileNameA GetProcessImageFileNameW GetModuleBaseNameA GetModuleBaseNameW EmptyWorkingSet QueryWorkingSet InitializeProcessForWsWatch GetMappedFileNameW GetMappedFileNameA EnumDeviceDrivers GetDeviceDriverBaseNameA GetDeviceDriverBaseNameW

wintrust

CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminAcquireContext CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertCloseStore CertFreeCertificateContext CertFindCertificateInStore CryptMsgClose CryptQueryObject CryptStringToBinaryW CryptBinaryToStringW CryptBinaryToStringA CryptMsgGetParam CertGetNameStringW CryptStringToBinaryA

iphlpapi

GetAdaptersInfo GetIpAddrTable

gdiplus

GdipDeleteGraphics GdipDrawImageI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipFree GdipGetImagePalette GdipGetImageGraphicsContext GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipDisposeImage GdipBitmapUnlockBits GdiplusStartup GdiplusShutdown GdipCreateBitmapFromFileICM GdipAlloc GdipGetImagePaletteSize

dbghelp

ImageNtHeader ImageDirectoryEntryToData

wininet

InternetCrackUrlW InternetConnectW InternetOpenW HttpOpenRequestW HttpSendRequestW InternetCloseHandle InternetSetOptionW HttpQueryInfoW InternetReadFile InternetSetFilePointer

setupapi

SetupIterateCabinetW

msi

ord173 ord217

winmm

timeKillEvent timeSetEvent

generic

count=18, id=241, version=40116,

count=163, id=243, version=40116,

count=31, id=242, version=40116,

count=12, id=260, version=27051,

count=36, id=261, version=27051,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=129, id=261, version=26706,

count=36, id=260, version=26706,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=491, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=49, id=265, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,