2026-07-30_597b7ba44efa93254d3a5c52d4b4d543_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_597b7ba44efa93254d3a5c52d4b4d543_elex_luca-stealer_mespinoza_njrat_remcos
Size 303KB
Sample260730-dzwflack4t
SHA256 dbd95a3da3f6cf0085296700422b8af01f6afcc1ae70203d102fbab27b811715
MD5 597b7ba44efa93254d3a5c52d4b4d543
SHA1 1b01f160d7f2c31cda0331b87a78f5a01dd4aff3
SHA512 2ed17e196cb45774ada18fe681e9d06b4f3ed64ac64b629268c02c9da45aa7e71472c30ff3798ef8d4319ee0e8987b3c35259c00949f0cdda55fd93b520bffc1
SSDEEP 6144:Ja+cyedRZv1lQewfTtkzhlAO6N8QHcSrDu:JSy21lW2tlDQ8SrDu
TLSH
T18B648D11B2D5C4B2E273493209799766593DBC600F3587EF93D86E2EDE349C19A32B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_597b7ba44efa93254d3a5c52d4b4d543_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-07-30_597b7ba44efa93254d3a5c52d4b4d543_elex_luca-stealer_mespinoza_njrat_remcos

.exe 303KB

2026-07-30_597b7ba44efa93254d3a5c52d4b4d543_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 290c4a72fa1747321670868a536b299e
SHA256 dbd95a3da3f6cf0085296700422b8af01f6afcc1ae70203d102fbab27b811715
MD5 597b7ba44efa93254d3a5c52d4b4d543
SHA1 1b01f160d7f2c31cda0331b87a78f5a01dd4aff3
SHA512 2ed17e196cb45774ada18fe681e9d06b4f3ed64ac64b629268c02c9da45aa7e71472c30ff3798ef8d4319ee0e8987b3c35259c00949f0cdda55fd93b520bffc1
SSDEEP 6144:Ja+cyedRZv1lQewfTtkzhlAO6N8QHcSrDu:JSy21lW2tlDQ8SrDu
TLSH
T18B648D11B2D5C4B2E273493209799766593DBC600F3587EF93D86E2EDE349C19A32B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

92179

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

Shell_NotifyIconW

comctl32

InitCommonControlsEx

ws2_32

WSAStartup freeaddrinfo getaddrinfo WSAAddressToStringW gethostname WSACleanup

shlwapi

PathFileExistsW

kernel32

GetCurrentDirectoryW GetDiskFreeSpaceExW GetFileAttributesW OutputDebugStringA OutputDebugStringW FindClose FindFirstFileW FindNextFileW CopyFileW MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId GetLocalTime GetTickCount GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW DeleteFileW RemoveDirectoryW SetFileAttributesW CloseHandle GetLastError CreateProcessW GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId InitializeSListHead FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale SetStdHandle GetFileType GetACP WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess HeapReAlloc HeapFree HeapAlloc LoadLibraryExW FreeLibrary RtlUnwind RaiseException HeapSize GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW GetCPInfo CreateFileW

user32

LoadCursorW GetClassNameW SetWindowLongW GetWindowLongW PtInRect FillRect MapWindowPoints ClientToScreen GetCursorPos SetCursor AdjustWindowRect GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DestroyIcon UpdateWindow DrawTextW TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu EnableWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageW TrackMouseEvent MessageBoxW DispatchMessageW TranslateMessage GetMessageW GetSystemMetrics wsprintfW SetForegroundWindow LoadIconW GetDlgCtrlID

gdi32

CreateSolidBrush CreateFontW GetStockObject SelectObject SetBkColor SetBkMode SetTextColor DeleteObject EnumFontFamiliesExW

Name

.text

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

412B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_597b7ba44efa93254d3a5c52d4b4d543_elex_luca-stealer_mespinoza_njrat_remcos

shell32

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

generic