2026-07-14_8211522672be8a0b6f74999e5424146c_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_8211522672be8a0b6f74999e5424146c_elex_luca-stealer_mespinoza_njrat_remcos
Size 1005KB
Sample260714-1vq2msgx2x
SHA256 e77a12403b6c1fcd3b5a5288e962bc3d5a6387a4dbd08793a7c0262ef60ca9f1
MD5 8211522672be8a0b6f74999e5424146c
SHA1 237a4c2be36f27a076e6af6368bb0164332d6fc6
SHA512 f9f431592cd6cc9a67db4fd492c15c86e1e905e8df5374f5bcd257f9036a0b7b56215863edc9bc4fc143040e0bfbfa27d757428637c73aea0654f5cc7bb09c7e
SSDEEP 12288:P16AVr2bVwDO1ZgyJmXpa4GJlDHVlYUwMh3jv9f8V14d1+wZbfBzeCOfnVAI7TZf:P16k2DZB9UP4d13IfnVA+Tsy6xf2j
TLSH
T1112581DC3D09D023DD6203F059B55EA2283DA91D07D453C7BAB4976A35E00E2DB3EADA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_8211522672be8a0b6f74999e5424146c_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-07-14_8211522672be8a0b6f74999e5424146c_elex_luca-stealer_mespinoza_njrat_remcos

.exe 1005KB

2026-07-14_8211522672be8a0b6f74999e5424146c_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 8e5f5cc387937e22b1e8ec081ab6631c
SHA256 e77a12403b6c1fcd3b5a5288e962bc3d5a6387a4dbd08793a7c0262ef60ca9f1
MD5 8211522672be8a0b6f74999e5424146c
SHA1 237a4c2be36f27a076e6af6368bb0164332d6fc6
SHA512 f9f431592cd6cc9a67db4fd492c15c86e1e905e8df5374f5bcd257f9036a0b7b56215863edc9bc4fc143040e0bfbfa27d757428637c73aea0654f5cc7bb09c7e
SSDEEP 12288:P16AVr2bVwDO1ZgyJmXpa4GJlDHVlYUwMh3jv9f8V14d1+wZbfBzeCOfnVAI7TZf:P16k2DZB9UP4d13IfnVA+Tsy6xf2j
TLSH
T1112581DC3D09D023DD6203F059B55EA2283DA91D07D453C7BAB4976A35E00E2DB3EADA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

332702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\xiaohei_xiaoxin\trunk\bin\Release\Win32\HNReport.pdb

kernel32

FindResourceW FindResourceExW GetProcAddress DeviceIoControl GetFileTime lstrcpynW GetModuleHandleW GetVolumeInformationW GetCommandLineA DecodePointer RaiseException GetSystemInfo DeleteCriticalSection Sleep SizeofResource LoadResource GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy LockResource CreateMutexW ReleaseMutex CreateThread Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte MultiByteToWideChar GetVersionExW CreateFileW GetModuleFileNameW lstrcpyW GetTickCount CloseHandle ReadFile WaitForSingleObject GetLastError WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP InitializeCriticalSectionAndSpinCount GlobalAlloc IsValidCodePage FindNextFileW FindFirstFileExW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection EncodePointer SetLastError CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo GetLocalTime ExpandEnvironmentStringsA LoadLibraryA FreeLibrary InitializeCriticalSection TryEnterCriticalSection SetEndOfFile GetStdHandle GetConsoleMode WriteFile SetFilePointer SleepEx FormatMessageA WaitForMultipleObjects GetFileType PeekNamedPipe VerSetConditionMask LoadLibraryW GetSystemDirectoryW VerifyVersionInfoW SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind LoadLibraryExW ExitProcess GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread FreeLibraryAndExitThread SetFilePointerEx GetACP ReadConsoleW GetConsoleCP GetTimeZoneInformation IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetCurrentDirectoryW GetFullPathNameW SetStdHandle FindClose

user32

wsprintfW CharUpperA

advapi32

RegCreateKeyExA RegOpenKeyW RegEnumKeyW RegOpenKeyExA RegSetValueExA RegQueryValueExA RegOpenKeyA RegQueryValueExW RegOpenKeyExW CryptDestroyHash RegCloseKey RegEnumKeyExA RegDeleteKeyA RegQueryInfoKeyW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptGetHashParam CryptImportKey CryptEncrypt CryptCreateHash CryptHashData

shell32

SHGetFolderPathW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx

oleaut32

VariantClear

shlwapi

PathCombineW StrIsIntlEqualW PathAppendW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

wldap32

ord41 ord301 ord147 ord133 ord79 ord142 ord167 ord145 ord46 ord14 ord216 ord208 ord118 ord26 ord27 ord127

ws2_32

sendto accept listen ioctlsocket gethostname recv recvfrom WSAStartup WSACleanup send WSAGetLastError __WSAFDIsSet select WSASetLastError bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAIoctl getaddrinfo freeaddrinfo

Name

.text

Size

480KB

Virtual Size

480KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

524B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

384KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_8211522672be8a0b6f74999e5424146c_elex_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

version

wldap32

ws2_32

generic