2026-07-27_52f910f47b6639ca6e0ed3bd0390fd6f_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_52f910f47b6639ca6e0ed3bd0390fd6f_elex_luca-stealer_mespinoza_njrat_remcos
Size 1.7MB
Sample260727-xjaczayhpe
SHA256 d1488e92037004c13ecbe7e9912573313ef3594101a66c713cbfa487c16e8f59
MD5 52f910f47b6639ca6e0ed3bd0390fd6f
SHA1 9585713c92d51dcf59c991ceda5d018745ed1a4a
SHA512 688b2faa7aeee1d3234fffecc3e8e384098d467ab60c5c6a9bb321b45fd08ac24c35de251ce7ee19266a3af5fed1e928a8d20b2305ce91f90ecd265e2471038d
SSDEEP 24576:Iwl9WPwOZNMMMMMMMelbf5TpmwLt3iRu/ocxwKDJKIe05Qws:2TZNMMMMMMM+brmwx3lwcx/Kt0F
TLSH
T12A8501217981C072E5AB053149F9D7B42A6ABD310B2046DB73E47FBF7E712D12A34A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_52f910f47b6639ca6e0ed3bd0390fd6f_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-07-27_52f910f47b6639ca6e0ed3bd0390fd6f_elex_luca-stealer_mespinoza_njrat_remcos

.exe 1.7MB

2026-07-27_52f910f47b6639ca6e0ed3bd0390fd6f_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH a4abaac9a782a84e167b99c1bccda83b
SHA256 d1488e92037004c13ecbe7e9912573313ef3594101a66c713cbfa487c16e8f59
MD5 52f910f47b6639ca6e0ed3bd0390fd6f
SHA1 9585713c92d51dcf59c991ceda5d018745ed1a4a
SHA512 688b2faa7aeee1d3234fffecc3e8e384098d467ab60c5c6a9bb321b45fd08ac24c35de251ce7ee19266a3af5fed1e928a8d20b2305ce91f90ecd265e2471038d
SSDEEP 24576:Iwl9WPwOZNMMMMMMMelbf5TpmwLt3iRu/ocxwKDJKIe05Qws:2TZNMMMMMMM+brmwx3lwcx/Kt0F
TLSH
T12A8501217981C072E5AB053149F9D7B42A6ABD310B2046DB73E47FBF7E712D12A34A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\work\test3\Android\WiFiShare\2015\Release\WiFiShare10.pdb

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsCreateString WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoUninitialize RoInitialize

kernel32

SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx WaitForSingleObject GetCurrentThreadId HeapSize MultiByteToWideChar GetLastError HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap SizeofResource LoadLibraryExA FindResourceA GetModuleHandleA LoadLibraryA GetVersionExA IsDBCSLeadByte LoadResource GetProcAddress FreeLibrary WideCharToMultiByte lstrcmpiA CloseHandle TerminateProcess lstrlenA Sleep lstrcpyA CreateThread CreateProcessA GetExitCodeProcess SetEvent CreateEventA HeapFree FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose LCMapStringW GetFileType GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess VirtualQuery VirtualProtect GetSystemInfo LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetModuleFileNameA SetStdHandle GetStringTypeW GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW CreateFileW RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent OutputDebugStringW IsDebuggerPresent VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer

user32

GetParent IsWindowUnicode RegisterClassExA PeekMessageA GetClientRect SendMessageA TranslateMessage BringWindowToTop EnableWindow UnregisterClassA GetKeyState SetTimer MessageBoxA PostQuitMessage PostThreadMessageA CharNextA FindWindowA GetMessageW GetMessageA LoadImageA GetWindow DispatchMessageA GetWindowRect LoadCursorA DestroyWindow SetWindowPos MonitorFromWindow PostMessageA ShowWindow GetClassInfoExA DispatchMessageW SetWindowLongA CallWindowProcA IsChild MsgWaitForMultipleObjectsEx MapWindowPoints GetWindowLongA SetWindowTextA GetMonitorInfoA DefWindowProcA CreateWindowExA

advapi32

RegCloseKey RegQueryInfoKeyW RegDeleteKeyA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegDeleteValueA RegEnumKeyExA

shell32

ShellExecuteA

ole32

CLSIDFromProgID IIDFromString CoTaskMemRealloc OleInitialize CoTaskMemFree CoTaskMemAlloc OleUninitialize StringFromIID CoCreateInstance

oleaut32

VariantCopy DispCallFunc VariantClear SysStringLen SysAllocString SysAllocStringLen VarUI4FromStr VariantInit LoadTypeLi SysFreeString SysStringByteLen SysAllocStringByteLen

shlwapi

PathAppendA PathRemoveFileSpecA

Name

.text

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_52f910f47b6639ca6e0ed3bd0390fd6f_elex_luca-stealer_mespinoza_njrat_remcos

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic