2026-07-20_c53d43f5ef0417f4d5569bb40fb8d75f_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_c53d43f5ef0417f4d5569bb40fb8d75f_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos
Size 4.8MB
Sample260720-rhgg1aex2w
SHA256 3bfe4d005088c06d31b4466fade662b4ef1a68f5f1b5a1e1184a5cdc01aa3e3e
MD5 c53d43f5ef0417f4d5569bb40fb8d75f
SHA1 eff5ddd4c8d34f3d0776492ebead2e14a2f2d4fb
SHA512 6fe96de0613a8d9feae986c2995c194f4b32627753095a76458b7c04f071362b124e3c86612868eb4cccf0903cb32d5537841c4c9001e1767c49c7467ce86499
SSDEEP 98304:U27DOlNUcF5IOgqUXVBXNPL2Wf5N8er4XuN5oxqpCgbHyodQ:UhF5dqRLB5N8S4XuN56qlyodQ
TLSH
T1B43612213D82C035E6962132C97CFA6B466DAF201B3656EB639C1B3D1F705D32E32667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_c53d43f5ef0417f4d5569bb40fb8d75f_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

File Explorer

2026-07-20_c53d43f5ef0417f4d5569bb40fb8d75f_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

.exe 4.8MB

2026-07-20_c53d43f5ef0417f4d5569bb40fb8d75f_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

IMPHASH 8cf418129bdc8bc7d6f254bdf2bb92cc
SHA256 3bfe4d005088c06d31b4466fade662b4ef1a68f5f1b5a1e1184a5cdc01aa3e3e
MD5 c53d43f5ef0417f4d5569bb40fb8d75f
SHA1 eff5ddd4c8d34f3d0776492ebead2e14a2f2d4fb
SHA512 6fe96de0613a8d9feae986c2995c194f4b32627753095a76458b7c04f071362b124e3c86612868eb4cccf0903cb32d5537841c4c9001e1767c49c7467ce86499
SSDEEP 98304:U27DOlNUcF5IOgqUXVBXNPL2Wf5N8er4XuN5oxqpCgbHyodQ:UhF5dqRLB5N8S4XuN56qlyodQ
TLSH
T1B43612213D82C035E6962132C97CFA6B466DAF201B3656EB639C1B3D1F705D32E32667
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

499047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\977679\out\Release\CadCompSetup.pdb

kernel32

FindResourceW FindResourceExW GetComputerNameW GetLocalTime FormatMessageW LocalFree GetExitCodeProcess GetCurrentThreadId WriteFile SetFilePointer GetFileSize CreateFileMappingW MapViewOfFileEx UnmapViewOfFile InterlockedCompareExchange LoadLibraryW lstrlenA OutputDebugStringW GetPrivateProfileStringW GetPrivateProfileIntW PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateIoCompletionPort GetQueuedCompletionStatus MapViewOfFile CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileSizeEx ReadFile SetFilePointerEx FlushViewOfFile SetEndOfFile GlobalAlloc GlobalFree FindFirstFileW DeleteFileW FindNextFileW FindClose RemoveDirectoryW MoveFileExW SetFileAttributesW GetLongPathNameW IsBadReadPtr GetWindowsDirectoryW GetDriveTypeW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetVolumeInformationW OpenProcess lstrlenW lstrcpynA GetFileAttributesExW Thread32First Thread32Next GetCurrentProcess lstrcmpiW VirtualAllocEx WriteProcessMemory VirtualFreeEx CreateRemoteThread ReadProcessMemory lstrcpyW Module32FirstW Module32NextW lstrcmpA OpenThread GetModuleHandleExW OutputDebugStringA OpenEventW ResumeThread ExpandEnvironmentStringsW GetThreadLocale SetThreadLocale GlobalLock GlobalSize GlobalUnlock GetVersionExW GetWindowsDirectoryA GetTempPathW SystemTimeToFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleHandleA GlobalMemoryStatusEx GetCommandLineW GetSystemDefaultLCID ReadConsoleW WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetFileType GetACP LockResource ExitProcess ExitThread VirtualQuery RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle SetProcessAffinityMask FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority SizeofResource GetProcessHeap HeapSize HeapDestroy InterlockedExchange CreateProcessW InitializeCriticalSection DeleteCriticalSection EnumDateFormatsExW EnumCalendarInfoExW GetCurrencyFormatW GetNumberFormatW GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess GetProcessTimes CreateWaitableTimerW CreateSemaphoreW Sleep CreateEventW CreateEventA CreateMutexW CreateMutexA WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl HeapFree HeapReAlloc HeapAlloc CreateThread SignalObjectAndWait CreateTimerQueue RtlCaptureStackBackTrace ReleaseSemaphore GetProcessAffinityMask GlobalMemoryStatus DosDateTimeToFileTime FileTimeToDosDateTime FileTimeToLocalFileTime MoveFileW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW CompareFileTime FindCloseChangeNotification FindFirstChangeNotificationW GetFileAttributesW GetStdHandle GetFileInformationByHandle SetFileTime InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime IsDebuggerPresent LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo TryEnterCriticalSection GetStringTypeW LoadResource GetCurrentProcessId GetModuleFileNameW GetModuleFileNameA SetErrorMode SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetFullPathNameW GetUserDefaultLCID CreateFileW

user32

BringWindowToTop SetActiveWindow PostMessageW DispatchMessageW UnhookWinEvent PostThreadMessageW UnregisterClassW GetMessageW SetWinEventHook UpdateWindow InvalidateRect AttachThreadInput GetForegroundWindow GetWindowThreadProcessId IsWindow RegisterClassExW CreateWindowExW SetForegroundWindow SetWindowLongW ShowWindow IsIconic GetClassLongW DestroyWindow GetWindowLongW DefWindowProcW wsprintfW GetActiveWindow MessageBoxW EnumWindows EnumDesktopWindows IsWindowVisible SetWindowPos WaitForInputIdle OpenClipboard IsClipboardFormatAvailable GetClipboardData CloseClipboard FindWindowW GetClassNameW GetWindowTextW SetLayeredWindowAttributes CharUpperW SendMessageW TranslateMessage

gdi32

SelectObject CreateCompatibleDC GetObjectW SetDIBColorTable DeleteDC DeleteObject CreateDIBSection

advapi32

RegEnumKeyExW RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyA RegDeleteKeyW RegDeleteValueA RegDeleteValueW RegOpenKeyExA RegOpenKeyExW ConvertSidToStringSidW LookupAccountNameW GetUserNameW GetUserNameA LookupAccountNameA GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid LookupAccountSidW GetTokenInformation FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW EnumServicesStatusExW CreateProcessAsUserW DuplicateTokenEx AccessCheck MapGenericMask DuplicateToken OpenProcessToken GetFileSecurityW CloseServiceHandle EnumServicesStatusW OpenSCManagerW RegOpenKeyW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA ImpersonateSelf

shell32

SHGetFolderPathW ord16 SHGetFolderLocation ord102 ShellExecuteExW ord165 ord232 ShellExecuteW SHGetSpecialFolderPathW ord680 SHGetFileInfoW ord178 ord155 ord18 CommandLineToArgvW SHGetDesktopFolder ord17

ole32

CLSIDFromString CoCreateGuid CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoCreateInstance StringFromCLSID CoTaskMemAlloc

oleaut32

VariantClear VariantInit VariantCopy SysAllocStringByteLen SysStringLen SysAllocStringLen SysFreeString SysAllocString

shlwapi

StrCmpNIW PathRelativePathToW PathCommonPrefixW PathIsPrefixW StrFormatByteSizeW PathCanonicalizeW PathIsDirectoryW PathIsRootW StrCmpIW PathRemoveBackslashW StrCpyNW ord176 SHSetValueW SHDeleteValueW StrStrIW UrlGetPartW SHDeleteKeyA SHDeleteKeyW SHQueryValueExA SHQueryValueExW SHCopyKeyA SHCopyKeyW PathFileExistsW PathRemoveFileSpecW PathAppendW PathCombineW PathFindFileNameW PathFindExtensionW PathAppendA SHGetValueW

ws2_32

select WSASetLastError __WSAFDIsSet

version

GetFileVersionInfoW GetFileVersionInfoA GetFileVersionInfoSizeW GetFileVersionInfoSizeA VerQueryValueW

psapi

EnumPageFilesA EnumPageFilesW GetPerformanceInfo GetDeviceDriverFileNameW GetDeviceDriverFileNameA EnumProcessModules GetModuleFileNameExA GetModuleFileNameExW GetWsChanges GetProcessImageFileNameA GetProcessImageFileNameW GetModuleBaseNameA GetModuleBaseNameW EmptyWorkingSet QueryWorkingSet InitializeProcessForWsWatch GetMappedFileNameW GetMappedFileNameA EnumDeviceDrivers GetDeviceDriverBaseNameA GetDeviceDriverBaseNameW

wintrust

CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminAcquireContext CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertCloseStore CertFreeCertificateContext CertFindCertificateInStore CryptMsgClose CryptQueryObject CryptStringToBinaryW CryptBinaryToStringW CryptBinaryToStringA CryptMsgGetParam CertGetNameStringW CryptStringToBinaryA

iphlpapi

GetAdaptersInfo GetIpAddrTable

gdiplus

GdipDeleteGraphics GdipDrawImageI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipFree GdipGetImagePalette GdipGetImageGraphicsContext GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipDisposeImage GdipBitmapUnlockBits GdiplusStartup GdiplusShutdown GdipCreateBitmapFromFileICM GdipAlloc GdipGetImagePaletteSize

dbghelp

ImageNtHeader ImageDirectoryEntryToData

wininet

InternetCrackUrlW InternetConnectW InternetOpenW HttpOpenRequestW HttpSendRequestW InternetCloseHandle InternetSetOptionW HttpQueryInfoW InternetReadFile InternetSetFilePointer

setupapi

SetupIterateCabinetW

msi

ord173 ord217

winmm

timeKillEvent timeSetEvent

generic

count=18, id=241, version=40116,

count=163, id=243, version=40116,

count=31, id=242, version=40116,

count=12, id=260, version=27051,

count=36, id=261, version=27051,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=129, id=261, version=26706,

count=36, id=260, version=26706,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=491, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=49, id=265, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,