2026-08-02_7f68d409b2f6b202a326ff3df915a1c6_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_7f68d409b2f6b202a326ff3df915a1c6_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos
Size 4.8MB
Sample260802-dfvd7acc47
SHA256 73eea484b7fe0fa2e9d820bba7be4e942815a8efc95693200b45ab7bb0483386
MD5 7f68d409b2f6b202a326ff3df915a1c6
SHA1 f43548926202fdc0683b50049d8ef5d489463447
SHA512 9a7db7c818f95dfb519837704fd2ec80754a41db5313c8125c7efddb63f3636f75a10e0b2ffb570600ddd83cb0e3851d72eba6f26bf0ccd6857f1c86857e887b
SSDEEP 98304:U27DOlNUcF5IOgqUXVBXNPL2Wf5N8er4XuN5oxqpCgbHyod1:UhF5dqRLB5N8S4XuN56qlyod1
TLSH
T1A63612213D82C035E6962132C97CFA6B466DAF201B3656EB639C1B3D1F705D32E32667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_7f68d409b2f6b202a326ff3df915a1c6_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

File Explorer

2026-08-02_7f68d409b2f6b202a326ff3df915a1c6_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

.exe 4.8MB

2026-08-02_7f68d409b2f6b202a326ff3df915a1c6_amadey_elex_luca-stealer_magniber_medusalocker_njrat_remcos

IMPHASH 8cf418129bdc8bc7d6f254bdf2bb92cc
SHA256 73eea484b7fe0fa2e9d820bba7be4e942815a8efc95693200b45ab7bb0483386
MD5 7f68d409b2f6b202a326ff3df915a1c6
SHA1 f43548926202fdc0683b50049d8ef5d489463447
SHA512 9a7db7c818f95dfb519837704fd2ec80754a41db5313c8125c7efddb63f3636f75a10e0b2ffb570600ddd83cb0e3851d72eba6f26bf0ccd6857f1c86857e887b
SSDEEP 98304:U27DOlNUcF5IOgqUXVBXNPL2Wf5N8er4XuN5oxqpCgbHyod1:UhF5dqRLB5N8S4XuN56qlyod1
TLSH
T1A63612213D82C035E6962132C97CFA6B466DAF201B3656EB639C1B3D1F705D32E32667
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

499047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\977679\out\Release\CadCompSetup.pdb

kernel32

FindResourceW FindResourceExW GetComputerNameW GetLocalTime FormatMessageW LocalFree GetExitCodeProcess GetCurrentThreadId WriteFile SetFilePointer GetFileSize CreateFileMappingW MapViewOfFileEx UnmapViewOfFile InterlockedCompareExchange LoadLibraryW lstrlenA OutputDebugStringW GetPrivateProfileStringW GetPrivateProfileIntW PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateIoCompletionPort GetQueuedCompletionStatus MapViewOfFile CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileSizeEx ReadFile SetFilePointerEx FlushViewOfFile SetEndOfFile GlobalAlloc GlobalFree FindFirstFileW DeleteFileW FindNextFileW FindClose RemoveDirectoryW MoveFileExW SetFileAttributesW GetLongPathNameW IsBadReadPtr GetWindowsDirectoryW GetDriveTypeW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetVolumeInformationW OpenProcess lstrlenW lstrcpynA GetFileAttributesExW Thread32First Thread32Next GetCurrentProcess lstrcmpiW VirtualAllocEx WriteProcessMemory VirtualFreeEx CreateRemoteThread ReadProcessMemory lstrcpyW Module32FirstW Module32NextW lstrcmpA OpenThread GetModuleHandleExW OutputDebugStringA OpenEventW ResumeThread ExpandEnvironmentStringsW GetThreadLocale SetThreadLocale GlobalLock GlobalSize GlobalUnlock GetVersionExW GetWindowsDirectoryA GetTempPathW SystemTimeToFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleHandleA GlobalMemoryStatusEx GetCommandLineW GetSystemDefaultLCID ReadConsoleW WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetFileType GetACP LockResource ExitProcess ExitThread VirtualQuery RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle SetProcessAffinityMask FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority SizeofResource GetProcessHeap HeapSize HeapDestroy InterlockedExchange CreateProcessW InitializeCriticalSection DeleteCriticalSection EnumDateFormatsExW EnumCalendarInfoExW GetCurrencyFormatW GetNumberFormatW GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess GetProcessTimes CreateWaitableTimerW CreateSemaphoreW Sleep CreateEventW CreateEventA CreateMutexW CreateMutexA WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl HeapFree HeapReAlloc HeapAlloc CreateThread SignalObjectAndWait CreateTimerQueue RtlCaptureStackBackTrace ReleaseSemaphore GetProcessAffinityMask GlobalMemoryStatus DosDateTimeToFileTime FileTimeToDosDateTime FileTimeToLocalFileTime MoveFileW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW CompareFileTime FindCloseChangeNotification FindFirstChangeNotificationW GetFileAttributesW GetStdHandle GetFileInformationByHandle SetFileTime InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime IsDebuggerPresent LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo TryEnterCriticalSection GetStringTypeW LoadResource GetCurrentProcessId GetModuleFileNameW GetModuleFileNameA SetErrorMode SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetFullPathNameW GetUserDefaultLCID CreateFileW

user32

BringWindowToTop SetActiveWindow PostMessageW DispatchMessageW UnhookWinEvent PostThreadMessageW UnregisterClassW GetMessageW SetWinEventHook UpdateWindow InvalidateRect AttachThreadInput GetForegroundWindow GetWindowThreadProcessId IsWindow RegisterClassExW CreateWindowExW SetForegroundWindow SetWindowLongW ShowWindow IsIconic GetClassLongW DestroyWindow GetWindowLongW DefWindowProcW wsprintfW GetActiveWindow MessageBoxW EnumWindows EnumDesktopWindows IsWindowVisible SetWindowPos WaitForInputIdle OpenClipboard IsClipboardFormatAvailable GetClipboardData CloseClipboard FindWindowW GetClassNameW GetWindowTextW SetLayeredWindowAttributes CharUpperW SendMessageW TranslateMessage

gdi32

SelectObject CreateCompatibleDC GetObjectW SetDIBColorTable DeleteDC DeleteObject CreateDIBSection

advapi32

RegEnumKeyExW RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyA RegDeleteKeyW RegDeleteValueA RegDeleteValueW RegOpenKeyExA RegOpenKeyExW ConvertSidToStringSidW LookupAccountNameW GetUserNameW GetUserNameA LookupAccountNameA GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid LookupAccountSidW GetTokenInformation FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW EnumServicesStatusExW CreateProcessAsUserW DuplicateTokenEx AccessCheck MapGenericMask DuplicateToken OpenProcessToken GetFileSecurityW CloseServiceHandle EnumServicesStatusW OpenSCManagerW RegOpenKeyW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA ImpersonateSelf

shell32

SHGetFolderPathW ord16 SHGetFolderLocation ord102 ShellExecuteExW ord165 ord232 ShellExecuteW SHGetSpecialFolderPathW ord680 SHGetFileInfoW ord178 ord155 ord18 CommandLineToArgvW SHGetDesktopFolder ord17

ole32

CLSIDFromString CoCreateGuid CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoCreateInstance StringFromCLSID CoTaskMemAlloc

oleaut32

VariantClear VariantInit VariantCopy SysAllocStringByteLen SysStringLen SysAllocStringLen SysFreeString SysAllocString

shlwapi

StrCmpNIW PathRelativePathToW PathCommonPrefixW PathIsPrefixW StrFormatByteSizeW PathCanonicalizeW PathIsDirectoryW PathIsRootW StrCmpIW PathRemoveBackslashW StrCpyNW ord176 SHSetValueW SHDeleteValueW StrStrIW UrlGetPartW SHDeleteKeyA SHDeleteKeyW SHQueryValueExA SHQueryValueExW SHCopyKeyA SHCopyKeyW PathFileExistsW PathRemoveFileSpecW PathAppendW PathCombineW PathFindFileNameW PathFindExtensionW PathAppendA SHGetValueW

ws2_32

select WSASetLastError __WSAFDIsSet

version

GetFileVersionInfoW GetFileVersionInfoA GetFileVersionInfoSizeW GetFileVersionInfoSizeA VerQueryValueW

psapi

EnumPageFilesA EnumPageFilesW GetPerformanceInfo GetDeviceDriverFileNameW GetDeviceDriverFileNameA EnumProcessModules GetModuleFileNameExA GetModuleFileNameExW GetWsChanges GetProcessImageFileNameA GetProcessImageFileNameW GetModuleBaseNameA GetModuleBaseNameW EmptyWorkingSet QueryWorkingSet InitializeProcessForWsWatch GetMappedFileNameW GetMappedFileNameA EnumDeviceDrivers GetDeviceDriverBaseNameA GetDeviceDriverBaseNameW

wintrust

CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminAcquireContext CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertCloseStore CertFreeCertificateContext CertFindCertificateInStore CryptMsgClose CryptQueryObject CryptStringToBinaryW CryptBinaryToStringW CryptBinaryToStringA CryptMsgGetParam CertGetNameStringW CryptStringToBinaryA

iphlpapi

GetAdaptersInfo GetIpAddrTable

gdiplus

GdipDeleteGraphics GdipDrawImageI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipFree GdipGetImagePalette GdipGetImageGraphicsContext GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipDisposeImage GdipBitmapUnlockBits GdiplusStartup GdiplusShutdown GdipCreateBitmapFromFileICM GdipAlloc GdipGetImagePaletteSize

dbghelp

ImageNtHeader ImageDirectoryEntryToData

wininet

InternetCrackUrlW InternetConnectW InternetOpenW HttpOpenRequestW HttpSendRequestW InternetCloseHandle InternetSetOptionW HttpQueryInfoW InternetReadFile InternetSetFilePointer

setupapi

SetupIterateCabinetW

msi

ord173 ord217

winmm

timeKillEvent timeSetEvent

generic

count=18, id=241, version=40116,

count=163, id=243, version=40116,

count=31, id=242, version=40116,

count=12, id=260, version=27051,

count=36, id=261, version=27051,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=129, id=261, version=26706,

count=36, id=260, version=26706,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=491, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=49, id=265, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,