2026-09-09_ff3f235c3b9968350baf3a5e8f2786d8_amadey_elex_luca-stealer_medusalocker_njrat_remcos

General

Target
2026-09-09_ff3f235c3b9968350baf3a5e8f2786d8_amadey_elex_luca-stealer_medusalocker_njrat_remcos
Size 3.7MB
Sample260910-zp1s8aef76
SHA256 befd95695300727862168ec49cc1671dd286334e70b4189e45a379b23fc80757
MD5 ff3f235c3b9968350baf3a5e8f2786d8
SHA1 ccae79732eee75dc297b0a0b37259ccf83339f39
SHA512 c0c13f91553a5110da495b4fcbeb7328c9e7aff631bc6fd7612acef90047a24a79d5c3737ab932412296eeba27b6504ba05a00f5834923e7a37d450483abc3c9
SSDEEP 98304:RppSB2jHmzYcz4VTyysUz7iPjCYnI1UbjTdUfhDVwIyr:joBUHmOiPFnI1UbfqhB1yr
TLSH
T16906AE20BDD1C873D2231F30499AF2F971ADFDA4172E41972F843B1D2E3429EAA35566
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_ff3f235c3b9968350baf3a5e8f2786d8_amadey_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-09-09_ff3f235c3b9968350baf3a5e8f2786d8_amadey_elex_luca-stealer_medusalocker_njrat_remcos

.exe 3.7MB

2026-09-09_ff3f235c3b9968350baf3a5e8f2786d8_amadey_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 3cbc95d570560e9ee34e0c58190744cb
SHA256 befd95695300727862168ec49cc1671dd286334e70b4189e45a379b23fc80757
MD5 ff3f235c3b9968350baf3a5e8f2786d8
SHA1 ccae79732eee75dc297b0a0b37259ccf83339f39
SHA512 c0c13f91553a5110da495b4fcbeb7328c9e7aff631bc6fd7612acef90047a24a79d5c3737ab932412296eeba27b6504ba05a00f5834923e7a37d450483abc3c9
SSDEEP 98304:RppSB2jHmzYcz4VTyysUz7iPjCYnI1UbjTdUfhDVwIyr:joBUHmOiPFnI1UbfqhB1yr
TLSH
T16906AE20BDD1C873D2231F30499AF2F971ADFDA4172E41972F843B1D2E3429EAA35566
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43943

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\build\gitlab\build_dir\mCWGnw_b\0\cloudpc\desktop-src.cloud.mail.ru\disko\installer_wrapper\bin\DiskORelease\installer_wrapper.pdb

kernel32

GetFileAttributesW MultiByteToWideChar DeleteFileW WideCharToMultiByte CreateDirectoryW ReadFile SizeofResource GetFileSizeEx SetFilePointer WaitForSingleObject CreateFileW UnmapViewOfFile LockResource CloseHandle LoadResource FindResourceW CreateProcessW CreateFileMappingW MapViewOfFile GetExitCodeProcess FindFirstFileW FindNextFileW RemoveDirectoryW GetModuleFileNameW GetTempPathW FindClose InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId EncodePointer DecodePointer QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SetEndOfFile RtlUnwind RaiseException GetLastError SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP HeapAlloc HeapFree GetFileType GetConsoleCP GetConsoleMode CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapReAlloc FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap SetStdHandle FlushFileBuffers SetFilePointerEx WriteConsoleW HeapSize ReadConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_ff3f235c3b9968350baf3a5e8f2786d8_amadey_elex_luca-stealer_medusalocker_njrat_remcos

kernel32

generic