2026-08-17_63c0d670356a51a71c5c0c46c84d79f8_elex_luca-stealer_mespinoza_njrat_remcos_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-17_63c0d670356a51a71c5c0c46c84d79f8_elex_luca-stealer_mespinoza_njrat_remcos_vidar
Size 1.7MB
Sample260817-xtck3sdc67
SHA256 4294724a9acda144389f8406af7c9dc72cc24033c7d38d8b2ce3ffdbb8903318
MD5 63c0d670356a51a71c5c0c46c84d79f8
SHA1 71b03d519c41d4f7ac93aa2cb2efa31b7cf9df0f
SHA512 ec8226d6413679ae586bb3f52152fd9a567bf35352ca24ff0085c89172704d50eac47b3c0c1f5e4616c5b8d9b6b8c2a8b40d733b64ee1353fad7ee7cac0cad61
SSDEEP 24576:B+vObUwXxLxWDGuv1hjsTGtImWy6i1zuxw7ljsarakkqt4nUwG:AvWhLxWDpvjsT+IHy6i1zuajsauZnJG
TLSH
T1ED85BF1AB2D840F6E4B35131C6B55626D675B8311731A6CF2390CA3D3F36AD1AE3AF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-17_63c0d670356a51a71c5c0c46c84d79f8_elex_luca-stealer_mespinoza_njrat_remcos_vidar

File Explorer

2026-08-17_63c0d670356a51a71c5c0c46c84d79f8_elex_luca-stealer_mespinoza_njrat_remcos_vidar

.exe 1.7MB

2026-08-17_63c0d670356a51a71c5c0c46c84d79f8_elex_luca-stealer_mespinoza_njrat_remcos_vidar

IMPHASH fe567fb270a617d2bcfd5bb53ca8a661
SHA256 4294724a9acda144389f8406af7c9dc72cc24033c7d38d8b2ce3ffdbb8903318
MD5 63c0d670356a51a71c5c0c46c84d79f8
SHA1 71b03d519c41d4f7ac93aa2cb2efa31b7cf9df0f
SHA512 ec8226d6413679ae586bb3f52152fd9a567bf35352ca24ff0085c89172704d50eac47b3c0c1f5e4616c5b8d9b6b8c2a8b40d733b64ee1353fad7ee7cac0cad61
SSDEEP 24576:B+vObUwXxLxWDGuv1hjsTGtImWy6i1zuxw7ljsarakkqt4nUwG:AvWhLxWDpvjsT+IHy6i1zuajsauZnJG
TLSH
T1ED85BF1AB2D840F6E4B35131C6B55626D675B8311731A6CF2390CA3D3F36AD1AE3AF12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

461424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\b\c\b\win_pgo\src\out\Release\initialexe\chrome.exe.pdb

chrome_elf

GetInstallDetailsPayload SignalInitializeCrashReporting SignalChromeElf

advapi32

ImpersonateNamedPipeClient RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey SystemFunction036 RegDisablePredefinedCache RevertToSelf GetLengthSid SetKernelObjectSecurity ConvertStringSecurityDescriptorToSecurityDescriptorW GetKernelObjectSecurity SetSecurityInfo OpenProcessToken ConvertStringSidToSidW SetTokenInformation GetAce GetSecurityDescriptorSacl ConvertSidToStringSidW CreateProcessAsUserW SetThreadToken GetTokenInformation DuplicateTokenEx DuplicateToken CreateRestrictedToken EqualSid LookupPrivilegeValueW CopySid CreateWellKnownSid GetSecurityInfo SetEntriesInAclW

kernel32

GetSystemDefaultLCID GetModuleFileNameW GetModuleHandleA GetProcAddress SetLastError GetCurrentThreadId CreateEventW GetLastError GetCurrentProcess GetProcessId WaitForSingleObject DuplicateHandle SetProcessShutdownParameters SetCurrentDirectoryW LoadLibraryExW VirtualFree VirtualAlloc MultiByteToWideChar WideCharToMultiByte GetModuleHandleW GetVersionExW GetNativeSystemInfo ExpandEnvironmentStringsW GetCommandLineW LocalFree Sleep FileTimeToSystemTime GetCurrentThread QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime QueryPerformanceCounter HeapCreate HeapDestroy WriteFile CreateFileW DeleteFileW CloseHandle GetLocalTime GetCurrentDirectoryW GetCurrentProcessId FormatMessageA GetTickCount TerminateProcess OpenProcess GetExitCodeProcess ReadFile GetFileSizeEx SetEndOfFile GetFileInformationByHandle SetFilePointerEx FlushFileBuffers ReleaseSRWLockExclusive AcquireSRWLockExclusive GetUserDefaultLangID RegisterWaitForSingleObject UnregisterWaitEx CreateDirectoryW QueryDosDeviceW GetLongPathNameW RemoveDirectoryW GetTempPathW GetFileAttributesW UnmapViewOfFile SetFileAttributesW ReplaceFileW GetTempFileNameW CreateFileMappingW MapViewOfFile MoveFileW RaiseException CreateThread IsDebuggerPresent HeapFree HeapSize HeapReAlloc HeapAlloc GetThreadId GetThreadLocale SizeofResource LockResource LoadResource FindResourceW FindFirstFileW FindFirstFileExW FindNextFileW FindClose GetModuleHandleExW RtlCaptureStackBackTrace SetUnhandledExceptionFilter TlsSetValue TlsAlloc TlsGetValue TlsFree HeapSetInformation VirtualQuery SetEvent ResetEvent LoadLibraryW SetInformationJobObject GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort GetSystemInfo GetProcessTimes VirtualQueryEx InitializeCriticalSectionAndSpinCount DecodePointer DeleteCriticalSection CreateProcessW GetSystemDirectoryW GetWindowsDirectoryW SetEnvironmentVariableW OutputDebugStringW GetComputerNameExW FreeLibrary UnlockFileEx LockFileEx GetFileType SetConsoleCtrlHandler VirtualAllocEx GetUserDefaultLCID EnterCriticalSection LeaveCriticalSection InitializeCriticalSection TerminateJobObject SetHandleInformation GetProcessHandleCount SignalObjectAndWait ProcessIdToSessionId WriteProcessMemory AssignProcessToJobObject VirtualProtectEx QueryFullProcessImageNameW VirtualFreeEx CreateRemoteThread CreateJobObjectW CreateNamedPipeW CreateMutexW lstrlenW DebugBreak ReadProcessMemory SearchPathW VirtualProtect LoadLibraryExA GetThreadContext SuspendThread CreateSemaphoreW ReleaseSemaphore WaitNamedPipeW TransactNamedPipe GetVersion SetNamedPipeHandleState ConnectNamedPipe DisconnectNamedPipe GetFileInformationByHandleEx GetUserDefaultUILanguage ResumeThread SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage GetTimeZoneInformation WriteConsoleW EnumSystemLocalesW IsValidLocale ReadConsoleW GetACP GetStdHandle ExitProcess SetStdHandle GetFullPathNameW GetConsoleMode GetConsoleCP PeekNamedPipe GetDriveTypeW RtlUnwind GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetStringTypeW InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx InitOnceExecuteOnce GetEnvironmentVariableW

psapi

GetMappedFileNameW GetProcessMemoryInfo GetPerformanceInfo

shell32

ShellExecuteExW SHGetFolderPathW SHGetKnownFolderPath CommandLineToArgvW

user32

RegisterClassW GetMessageW GetThreadDesktop CreateDesktopW SetProcessWindowStation GetUserObjectInformationW GetProcessWindowStation CreateWindowStationW CloseWindowStation CloseDesktop wsprintfW GetWindowThreadProcessId AllowSetForegroundWindow SendMessageTimeoutW IsWindow GetWindowLongW DefWindowProcW FindWindowExW DestroyWindow CreateWindowExW UnregisterClassW SetWindowLongW PostMessageW DispatchMessageW TranslateMessage

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

winmm

timeGetTime

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winhttp

WinHttpCrackUrl WinHttpSetTimeouts WinHttpConnect WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpReadData WinHttpCloseHandle WinHttpWriteData WinHttpQueryHeaders WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse

Name

.text

Size

585KB

Virtual Size

585KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

189KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=259, version=23917,

count=173, id=261, version=23917,

count=2, id=261, version=23013,

count=5, id=199, version=41118,

count=26, id=259, version=24123,

count=34, id=260, version=24123,

count=2, id=262, version=23917,

count=33, id=260, version=23917,

count=63, id=261, version=24123,

count=24, id=257, version=23917,

count=1, id=259, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=261, productName=VS2015 UPD3 build 24213, version=24213,

count=3, id=257, productName=VS2015 UPD3 build 24213, version=24213,

count=411, id=1, productName=Unmarked objects,

count=419, id=265, version=24213,

count=1, id=256, productName=VS2015 UPD3 build 24213, version=24213,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=2, id=151,

count=1, id=258, productName=VS2015 UPD3 build 24213, version=24213,