2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat
Size 890KB
Sample260804-hz7abatemd
SHA256 6a007b8161eaaf5f000fdf59f2eb498ba4286dcd0750ef5933c9d79f5c2653db
MD5 5a1b1e161b0cc17318b5c276f9adfb3c
SHA1 09d01da52318f4aeff2a0ced27c8ad8f101fcb1d
SHA512 52f3889dbe79b5922cec79c87d346e561517901ee68aecbbbc5256c18d1c0b1fdac8125d15780af9137f797d7428d82987558fb3fd2472f3f5512a3701eff720
SSDEEP 24576:nFUtETPQEfzEw2g8S0FjgqmvWUkqggmo++q/JIXAkBRZtju:FjxfwwPAtUkRgj++0JjkBH
TLSH
T1861502213B4294B3C57302324F28AAAD50AE7A511E35967B63D8571CEE702C2EE35F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat

File Explorer

2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat

.exe 890KB

2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat

IMPHASH c7153089ba80d3bce0c99ae34af3bf10
SHA256 6a007b8161eaaf5f000fdf59f2eb498ba4286dcd0750ef5933c9d79f5c2653db
MD5 5a1b1e161b0cc17318b5c276f9adfb3c
SHA1 09d01da52318f4aeff2a0ced27c8ad8f101fcb1d
SHA512 52f3889dbe79b5922cec79c87d346e561517901ee68aecbbbc5256c18d1c0b1fdac8125d15780af9137f797d7428d82987558fb3fd2472f3f5512a3701eff720
SSDEEP 24576:nFUtETPQEfzEw2g8S0FjgqmvWUkqggmo++q/JIXAkBRZtju:FjxfwwPAtUkRgj++0JjkBH
TLSH
T1861502213B4294B3C57302324F28AAAD50AE7A511E35967B63D8571CEE702C2EE35F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31652

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\docker\Documents\workspace\build-v2\common\hrappstore2\bin\HrASTransition.pdb

kernel32

HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetProcAddress LoadLibraryW CreateEventW WaitForSingleObject CloseHandle GetModuleHandleW RaiseException DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTickCount GetModuleFileNameW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetLastError CreateFileW InitializeCriticalSectionEx LCMapStringW GetFileType GetACP WriteFile GetStdHandle MultiByteToWideChar ExitProcess GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc GetVersionExW LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread FreeLibrary GetThreadTimes EncodePointer UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DuplicateHandle WaitForSingleObjectEx Sleep GetCurrentProcess GetCurrentThread GetCurrentThreadId TryEnterCriticalSection WideCharToMultiByte QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime IsDebuggerPresent OutputDebugStringW SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer

user32

LoadCursorW CreateWindowExW SetProcessDPIAware SetTimer GetSystemMetrics GetMonitorInfoW MonitorFromWindow GetClassLongW SetClassLongW KillTimer ShowWindow GetMessageW TranslateMessage DispatchMessageW SetWindowRgn GetDC GetWindowRect GetWindowLongW SetWindowLongW UpdateLayeredWindow ReleaseDC SetWindowPos MessageBoxW IntersectRect DefWindowProcW RegisterClassExW

gdi32

BitBlt StretchBlt CreateDIBSection CreateCompatibleBitmap CreateRoundRectRgn GetObjectW SelectObject DeleteObject CreateCompatibleDC DeleteDC SetStretchBltMode GetDeviceCaps

shlwapi

PathFileExistsW

gdiplus

GdipAlloc GdipCreateImageAttributes GdiplusStartup GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipDisposeImage GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipCreatePath GdipDeletePath GdipResetPath GdipClosePathFigure GdipAddPathArcI GdipCreateFromHDC GdipDeleteGraphics GdipSetPageUnit GdipDrawPath GdipFillPath GdipDrawImageRectRectI GdipLoadImageFromFile GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromFile GdipFree GdipCreateHBITMAPFromBitmap

Name

.text

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

603KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat

kernel32

user32

gdi32

shlwapi

gdiplus

generic