2026-08-01_1530c5f71f693c90a78c7b342265d2f6_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_1530c5f71f693c90a78c7b342265d2f6_elex_luca-stealer_mespinoza_njrat_remcos
Size 455KB
Sample260802-ezezaadk2z
SHA256 96ab5dffd7e548f3fa7acbd7c8e29fb63454b55317b8f22413ff826fe32045e6
MD5 1530c5f71f693c90a78c7b342265d2f6
SHA1 ff9ac7e63fb41fa995b8341c784ba3075ea5160b
SHA512 f9515a5529f8dcfe6c49143164dbebf33df5a91803f38877e7d447ead9c7162dcbf91f2057e70159eb9fc72fbf43e8bcdcada0f949c93825631ea0038045f88a
SSDEEP 6144:BK0vmX1TWO2ND11YurXarl7KPAXkfljmPsakj6oVZov95jppXB5VzR:B+16f11YurXwlX6qPxb3
TLSH
T131A44A22BA41C031D3621B744D28E6B5556EBE300B649A8FF7E87E395E740C32A3765F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_1530c5f71f693c90a78c7b342265d2f6_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-08-01_1530c5f71f693c90a78c7b342265d2f6_elex_luca-stealer_mespinoza_njrat_remcos

.exe 455KB

2026-08-01_1530c5f71f693c90a78c7b342265d2f6_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 58747b8be9da21488bc4600c12fe488a
SHA256 96ab5dffd7e548f3fa7acbd7c8e29fb63454b55317b8f22413ff826fe32045e6
MD5 1530c5f71f693c90a78c7b342265d2f6
SHA1 ff9ac7e63fb41fa995b8341c784ba3075ea5160b
SHA512 f9515a5529f8dcfe6c49143164dbebf33df5a91803f38877e7d447ead9c7162dcbf91f2057e70159eb9fc72fbf43e8bcdcada0f949c93825631ea0038045f88a
SSDEEP 6144:BK0vmX1TWO2ND11YurXarl7KPAXkfljmPsakj6oVZov95jppXB5VzR:B+16f11YurXwlX6qPxb3
TLSH
T131A44A22BA41C031D3621B744D28E6B5556EBE300B649A8FF7E87E395E740C32A3765F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\VCProjects\OSR-DSClient\Output\win32\DS_x86.pdb

kernel32

GetFileAttributesW FindClose FlushFileBuffers GetFileSize ReadFile DuplicateHandle GetCurrentProcess ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetPrivateProfileIntW OpenMutexW ReleaseMutex OpenFileMappingW MapViewOfFile OpenEventW UnmapViewOfFile GetWindowsDirectoryW lstrlenW LocalSize ExitProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW FindNextFileW OpenProcess Sleep CreateProcessW GetModuleHandleExW GetNativeSystemInfo CreateFileMappingW VirtualFree VirtualAlloc GetVersion GetStartupInfoA GetLocaleInfoA GetCommandLineA RtlUnwind GetStdHandle lstrlenA lstrcpyA lstrcatW WriteProcessMemory WaitForMultipleObjects VirtualQuery VirtualProtectEx TerminateThread ReleaseSemaphore ReadProcessMemory LoadLibraryExA GetTickCount GetThreadContext GetOverlappedResult GetModuleFileNameA GetExitCodeThread InterlockedIncrement FormatMessageA DeviceIoControl CreateThread CreateSemaphoreA CreateProcessA CreatePipe CreateMutexA CreateFileMappingA CreateFileA CreateEventA CancelIo FreeLibraryAndExitThread HeapQueryInformation GetCommandLineW QueryPerformanceFrequency GetStringTypeW LCMapStringW GetFileType GetTimeZoneInformation IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA FindFirstFileExW SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW ReadConsoleW GetThreadLocale VirtualProtect CompareStringW lstrcmpA GetCurrentThread ResumeThread SetThreadPriority CreateEventW WaitForSingleObject SetEvent GlobalFlags LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FormatMessageW LocalFree GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalFindAtomW GlobalAddAtomW FindResourceW LoadLibraryA lstrcmpW GlobalDeleteAtom SizeofResource LockResource LoadResource LoadLibraryExW FreeLibrary GetSystemDirectoryW GetCurrentThreadId EncodePointer LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA SetLastError OutputDebugStringA GetACP MultiByteToWideChar ExitThread GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount HeapFree lstrcpyW ExpandEnvironmentStringsW SetEndOfFile WriteFile WideCharToMultiByte CreateFileW CloseHandle GetLastError ProcessIdToSessionId GetCurrentProcessId GetModuleFileNameW CreateMutexW GetCurrentDirectoryW

user32

MessageBoxA PeekMessageA OpenInputDesktop MsgWaitForMultipleObjects GetUserObjectInformationA GetThreadDesktop DispatchMessageA CloseDesktop GetSysColorBrush LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem DestroyMenu GetSystemMetrics RealChildWindowFromPoint ClientToScreen ReleaseDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetWindowThreadProcessId SetWindowTextW IsWindowEnabled GetMonitorInfoW MonitorFromWindow WinHelpW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetTopWindow GetClassNameW GetClassLongW SetWindowLongW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient AdjustWindowRectEx GetWindowRect RemovePropW GetPropW SetPropW RedrawWindow ValidateRect SetForegroundWindow GetForegroundWindow GetMenuItemCount GetMenuItemID GetSubMenu SetMenu GetMenu EnableWindow GetCapture GetKeyState GetFocus GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos BeginDeferWindowPos SetWindowPos IsMenu IsWindow GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW PostMessageW GetMessageTime GetMessagePos PeekMessageW RegisterWindowMessageW GetWindow GetWindowLongW GetWindowTextW GetScrollPos SendMessageW GetParent OffsetRect SetRectEmpty GetClientRect GetLastActivePopup MessageBoxW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW UpdateWindow CreateWindowExW RegisterClassExW LoadCursorW LoadIconW DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW LoadStringW DeferWindowPos

dsloader.x86

_DSLOADER_StopDaemon@0 _DSLOADER_StartDaemon@4

oleacc

CreateStdAccessibleObject LresultFromObject

gdi32

GetClipBox PtVisible RectVisible RestoreDC GetStockObject SaveDC SelectObject Escape OffsetViewportOrgEx DeleteObject DeleteDC ScaleViewportExtEx ScaleWindowExtEx CreateBitmap SetMapMode GetDeviceCaps SetTextColor SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetBkColor

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

CloseServiceHandle OpenServiceW OpenSCManagerW GetTokenInformation AdjustTokenPrivileges OpenProcessToken FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor AllocateAndInitializeSid RegSetValueExW RegEnumKeyW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegSetValueExA RegQueryValueExA ControlService RegOpenKeyExA RegDeleteValueA LookupPrivilegeValueA GetKernelObjectSecurity SystemFunction036

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

VariantInit SysReAllocStringLen VariantChangeType VariantClear SysFreeString SysAllocStringLen

Name

.text

Size

180KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CODE

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

236B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

DATA

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=11, id=241, version=40116,

count=166, id=243, version=40116,

count=25, id=242, version=40116,

count=1, productName=Unmarked objects (old),

count=2, id=199, version=41118,

count=2, id=257, productName=VS2015 UPD1 build 23506, version=23506,

count=2, id=261, version=23013,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=21, id=259, version=23406,

count=20, id=260, version=23406,

count=125, id=261, version=23406,

count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=672, id=1, productName=Unmarked objects,

count=17, id=265, version=23506,

count=1, id=255, productName=VS2015 UPD1 build 23506, version=23506,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD1 build 23506, version=23506,