2026-09-19_8f6a1674b9e0dc211c3ccbaac0c1681c_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_8f6a1674b9e0dc211c3ccbaac0c1681c_elex_luca-stealer_mespinoza_njrat_remcos
Size 253KB
Sample260919-28zrdace49
SHA256 0873210de83d5ca7d6a3b879aa3c2c9e84e444d0292b66e223e297b28977a142
MD5 8f6a1674b9e0dc211c3ccbaac0c1681c
SHA1 a312af39c5509266922fc8e7d5e7482820b0be19
SHA512 c8bbfc85b779c914285c79c668f440e1132fe327b8872a24df31c53bc2444cfd311664d5f0b1236ba99a7ca33495275c1e281ff00415f4fc829225401920b15d
SSDEEP 6144:JE2b+m4wwqPlcokRSB78q2pSojVGeN6CnkGqW8z6o6G:F4TSB78q2pVVv6CkGI2o6G
TLSH
T1CD448C30B6A2C432D53701BA9D68D3BAF819B934576084D7A3C5076CAE39CF316379A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-19_8f6a1674b9e0dc211c3ccbaac0c1681c_elex_luca-stealer_mespinoza_njrat_remcos

.exe 253KB

2026-09-19_8f6a1674b9e0dc211c3ccbaac0c1681c_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH f06cacce5a6d0b121d23e43e69b8740d
SHA256 0873210de83d5ca7d6a3b879aa3c2c9e84e444d0292b66e223e297b28977a142
MD5 8f6a1674b9e0dc211c3ccbaac0c1681c
SHA1 a312af39c5509266922fc8e7d5e7482820b0be19
SHA512 c8bbfc85b779c914285c79c668f440e1132fe327b8872a24df31c53bc2444cfd311664d5f0b1236ba99a7ca33495275c1e281ff00415f4fc829225401920b15d
SSDEEP 6144:JE2b+m4wwqPlcokRSB78q2pSojVGeN6CnkGqW8z6o6G:F4TSB78q2pVVv6CkGI2o6G
TLSH
T1CD448C30B6A2C432D53701BA9D68D3BAF819B934576084D7A3C5076CAE39CF316379A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

a0:df:fe:09:8e:d6:21:ca:d6:36:d1:3c:59:23:9b:97:10:45:c7:00:f7:d0:46:86:2c:1c:f6:61:32:97:29:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=601692492,CN=F5\, Inc.,O=F5\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 29, 2025

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

Serial Number

11:b4:1a:cd:ce:55:6f:4b:e3:24:6c:a6:97:68:f5:46

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 5, 2024 - Sep 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

93840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\cc-builds\apmclients725x-win\1515101\src\rh\TerminalProxy\TrafficMgr\out\Release\f5TrafficMgr.pdb

traffic

TcDeleteFlow TcDeregisterClient TcAddFilter TcAddFlow TcCloseInterface TcOpenInterfaceW TcEnumerateInterfaces TcDeleteFilter TcRegisterClient

rpcrt4

RpcMgmtWaitServerListen RpcMgmtStopServerListening RpcServerUseProtseqEpA RpcServerRegisterIfEx RpcServerListen NdrServerCall2

kernel32

GetTempPathA CloseHandle GetLastError QueryPerformanceCounter HeapAlloc HeapFree GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ReleaseMutex WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetSystemInfo GetSystemTime GetVersionExA FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA LocalFree FormatMessageA lstrlenA CopyFileA MultiByteToWideChar WideCharToMultiByte GetLocaleInfoA GetSystemDefaultUILanguage GetUserDefaultUILanguage FindFirstFileExA HeapReAlloc GetConsoleMode GetConsoleCP GetFileType LCMapStringW CompareStringW GetStringTypeW GetACP GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleHandleExW ExitProcess SetLastError DecodePointer FlushFileBuffers FindNextFileA FindFirstFileA FindClose DeleteFileA CreateFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle SetFilePointerEx HeapSize WriteConsoleW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException EncodePointer InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent GetModuleHandleW CreateEventW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SetEndOfFile ReadFile ReadConsoleW

advapi32

RegCloseKey StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

ws2_32

htonl htons WSASetEvent

Name

.text

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_8f6a1674b9e0dc211c3ccbaac0c1681c_elex_luca-stealer_mespinoza_njrat_remcos

traffic

rpcrt4

kernel32

advapi32

version

ws2_32

generic