2026-07-11_408875935cb404f4951a7c0c2a26b8ef_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_408875935cb404f4951a7c0c2a26b8ef_elex_luca-stealer_mespinoza_njrat_remcos
Size 481KB
Sample260711-xdzexabs8x
SHA256 2e57463ae835dbc89bbc3953cbe2c14a4d29c6ea1dbee812fc149663a05fe857
MD5 408875935cb404f4951a7c0c2a26b8ef
SHA1 340c24978ef238742950b91ccd5879e598209c3d
SHA512 b4edf24b64a03029bbc6699410cc627c8958cbcc12bbdf0ff444e76ad70575f5090a1021bb834b5346219489a0eaee05888fc37dd6bfa1fae7a1640356c01d31
SSDEEP 12288:nl1dT6lwu/pgXttZmPds3kmDU3pRQa/JSQ:l1d0wucmPds3kP3zQa/JS
TLSH
T1E5A48C203B42C431E9B209331A789A6A147DBF310F7296DF67C8766EDDB05D15A34F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_408875935cb404f4951a7c0c2a26b8ef_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-07-11_408875935cb404f4951a7c0c2a26b8ef_elex_luca-stealer_mespinoza_njrat_remcos

.exe 481KB

2026-07-11_408875935cb404f4951a7c0c2a26b8ef_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 1e743e7031b416d1c1fb3a84535cf1d6
SHA256 2e57463ae835dbc89bbc3953cbe2c14a4d29c6ea1dbee812fc149663a05fe857
MD5 408875935cb404f4951a7c0c2a26b8ef
SHA1 340c24978ef238742950b91ccd5879e598209c3d
SHA512 b4edf24b64a03029bbc6699410cc627c8958cbcc12bbdf0ff444e76ad70575f5090a1021bb834b5346219489a0eaee05888fc37dd6bfa1fae7a1640356c01d31
SSDEEP 12288:nl1dT6lwu/pgXttZmPds3kmDU3pRQa/JSQ:l1d0wucmPds3kP3zQa/JS
TLSH
T1E5A48C203B42C431E9B209331A789A6A147DBF310F7296DF67C8766EDDB05D15A34F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

134561

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\Lightshot_exe.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

FreeLibrary FindFirstFileW SetLastError FindNextFileW GetCurrentProcess GetModuleFileNameW FindClose MultiByteToWideChar GetTickCount CompareStringW lstrlenW GetVersionExW GetLocalTime lstrcmpiW MulDiv InterlockedDecrement InterlockedIncrement Beep GetComputerNameW LCMapStringW GetStringTypeW GetFileType GetACP GetStdHandle GetModuleHandleExW ExitProcess QueryPerformanceFrequency FatalAppExitA RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc LoadLibraryA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GlobalFree ResetEvent SetEvent CreateEventW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetConsoleCP LeaveCriticalSection EnterCriticalSection WideCharToMultiByte GetModuleHandleW GetFileSize GetProcAddress FindResourceW LoadResource FindResourceExW LockResource ReleaseMutex GetCurrentThreadId CreateFileW CreateMutexW WriteFile SizeofResource ReadFile GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc CreateThread RaiseException CloseHandle HeapReAlloc TerminateThread GetLastError HeapSize WaitForSingleObject InitializeCriticalSectionAndSpinCount HeapFree GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW

user32

PostQuitMessage DialogBoxParamW SetTimer MoveWindow PostMessageW RegisterWindowMessageW GetMessageW DispatchMessageW TranslateMessage KillTimer MapVirtualKeyW RemoveMenu LoadIconW DestroyMenu GetKeyNameTextW EnableWindow GetAsyncKeyState GetWindowLongW GetWindowTextLengthW DefWindowProcW CallWindowProcW GetWindow GetWindowRect RegisterHotKey DestroyIcon GetActiveWindow GetSubMenu TrackPopupMenu MonitorFromPoint LoadMenuW UnregisterHotKey GetClassInfoExW RegisterWindowMessageA RegisterClassExW MessageBoxW GetFocus DestroyWindow GetDC SetWindowPos MonitorFromWindow FillRect CreateWindowExW ScreenToClient EndDialog SetWindowTextW IsWindow OffsetRect GetCapture GetMonitorInfoW GetDlgCtrlID MapWindowPoints DrawFocusRect GetSysColor IsWindowEnabled SetFocus CharNextW LoadCursorW GetClassNameW SetCapture SetCursor SetRectEmpty SetWindowLongW GetClientRect GetDlgItem DrawTextW SystemParametersInfoW GetParent PtInRect UpdateWindow ReleaseCapture InvalidateRect GetCursorPos BeginPaint EndPaint GetWindowTextW InsertMenuItemW SetMenuItemInfoW TrackMouseEvent ReleaseDC GetSystemMetrics GetWindowDC SendMessageW UnregisterClassW SetForegroundWindow

gdi32

SelectObject CreateFontW GetDeviceCaps DeleteObject GetObjectW CreateFontIndirectW CreateSolidBrush SetBkColor SetBkMode GetStockObject SetTextColor

advapi32

RegQueryValueExW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW CryptDestroyKey CryptEncrypt CryptDecrypt CryptSetKeyParam CryptImportKey CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegDeleteValueW RegEnumValueW RegCloseKey

shell32

ShellExecuteW Shell_NotifyIconW

ole32

CoTaskMemRealloc CoTaskMemFree CoUninitialize CoTaskMemAlloc CoInitialize StringFromGUID2 CoCreateGuid CoCreateInstance

oleaut32

VarUI4FromStr SysFreeString SysAllocString

shlwapi

PathFileExistsW PathCanonicalizeW PathAppendW PathRemoveFileSpecW PathAddBackslashW PathIsDirectoryW

comctl32

DestroyPropertySheetPage PropertySheetW CreatePropertySheetPageW

wininet

InternetQueryOptionW

Name

.text

Size

226KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

308B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_408875935cb404f4951a7c0c2a26b8ef_elex_luca-stealer_mespinoza_njrat_remcos

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wininet

generic