2026-09-26_4d5e11cf749be50cc536710349d81739_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_4d5e11cf749be50cc536710349d81739_elex_luca-stealer_mespinoza_njrat_remcos
Size 518KB
Sample260926-25grdstcmb
SHA256 f9e0bcc976626becc37f0b49f844d80a70ba5b6148f9f0d25b4226bb0e6f322f
MD5 4d5e11cf749be50cc536710349d81739
SHA1 70638a3605b887aed8bce2e38ee4e484b53df397
SHA512 2154cfbbfcbe06af661f0b500e3637cc70c425d7f188f08db1ee6dc693bcd1df4fe86c79951f0a60a48d38284f9494978764f9baaae9232ecfccd1dba1f6dbed
SSDEEP 12288:xhLbCMUAAe9iAbPg4x/UrzYQ7ssxSorEOCjq9TnUeZMue:x5RK4x/UnpsArKQ7ZVe
TLSH
T114B45A21B5ABC935CE7601B89D9CFB7BD409A8B0177000D3B3C806993E555D36A3EEA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-26_4d5e11cf749be50cc536710349d81739_elex_luca-stealer_mespinoza_njrat_remcos

.exe 518KB

2026-09-26_4d5e11cf749be50cc536710349d81739_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 7d8e3c41dd8493368fb12e65ada2153d
SHA256 f9e0bcc976626becc37f0b49f844d80a70ba5b6148f9f0d25b4226bb0e6f322f
MD5 4d5e11cf749be50cc536710349d81739
SHA1 70638a3605b887aed8bce2e38ee4e484b53df397
SHA512 2154cfbbfcbe06af661f0b500e3637cc70c425d7f188f08db1ee6dc693bcd1df4fe86c79951f0a60a48d38284f9494978764f9baaae9232ecfccd1dba1f6dbed
SSDEEP 12288:xhLbCMUAAe9iAbPg4x/UrzYQ7ssxSorEOCjq9TnUeZMue:x5RK4x/UnpsArKQ7ZVe
TLSH
T114B45A21B5ABC935CE7601B89D9CFB7BD409A8B0177000D3B3C806993E555D36A3EEA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

5c:d0:d1:48:61:e1:ba:d0:d9:65:3a:95:f2:3c:5d:7a:c6:4c:19:0c:3f:d8:25:14:11:b0:6e:d7:eb:f2:ee:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=601692492,CN=F5\, Inc.,O=F5\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 29, 2025

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

Serial Number

11:b4:1a:cd:ce:55:6f:4b:e3:24:6c:a6:97:68:f5:46

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 5, 2024 - Sep 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

264736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\cc-builds\apmclients725x-win\1515101\src\rh\TerminalProxy\ElevationHelper\out\Release\f5ElevationHelper.pdb

kernel32

SetEvent GetSystemDirectoryA GetVersionExA GetSystemInfo ResetEvent VerSetConditionMask GetCurrentProcessId WideCharToMultiByte VerifyVersionInfoW CreateDirectoryA GetSystemTime FormatMessageA GetTempFileNameA CreateEventA QueryPerformanceCounter GetTickCount SizeofResource LoadLibraryExA FindResourceA GetCommandLineA CreateThread IsDBCSLeadByte LoadResource GetLocalTime lstrcmpiA IsWow64Process SetUnhandledExceptionFilter OpenEventA TerminateThread WritePrivateProfileStringA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCPInfo GetModuleHandleExA IsValidCodePage FindFirstFileExA ReadConsoleW ReadFile GetConsoleMode GetConsoleCP LCMapStringW SetFilePointerEx SetStdHandle GetStringTypeW HeapReAlloc HeapSize GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess SetEndOfFile GetFileType GetTempPathA Sleep GetLocaleInfoA GetModuleHandleA CreateFileW FindClose lstrlenA InitializeCriticalSection LeaveCriticalSection FindNextFileA GetUserDefaultUILanguage GetSystemDefaultUILanguage EnterCriticalSection FindFirstFileA GetModuleFileNameA GetProcessHeap LocalFree VirtualProtect HeapAlloc LocalAlloc HeapFree FlushFileBuffers CreateProcessA SetFileAttributesA DeleteFileA CreateFileA MoveFileExA GetFileAttributesA CopyFileA TerminateProcess FreeLibrary GetProcAddress CloseHandle LoadLibraryA MultiByteToWideChar ReleaseMutex WaitForSingleObject CreateMutexA DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionEx SetLastError VirtualQuery SetThreadContext FlushInstructionCache GetThreadContext GetLastError ResumeThread GetCurrentThreadId RtlUnwind LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent GetModuleHandleW CreateEventW WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter VirtualAlloc GetCurrentProcess VirtualFree GetOEMCP WriteConsoleW

user32

CreateWindowExA DefWindowProcA GetWindowLongA SetWindowLongA ShowWindow LoadStringA SetWindowPos DestroyWindow LoadCursorA GetWindowRect DispatchMessageA CallWindowProcA PostThreadMessageA GetClassInfoExA wsprintfA GetMessageA CharNextA SetFocus GetClientRect RegisterClassExA UnregisterClassA ShutdownBlockReasonDestroy ShutdownBlockReasonCreate

gdi32

GetStockObject

advapi32

AllocateAndInitializeSid OpenServiceA DeleteService OpenSCManagerA RegQueryInfoKeyW ConvertSidToStringSidA LookupAccountSidA ConvertStringSidToSidA RegDeleteKeyA GetSidSubAuthorityCount GetSidSubAuthority RegCreateKeyExW ControlService CheckTokenMembership RegOpenKeyExW RegEnumKeyExA IsValidSid OpenProcessToken FreeSid GetLengthSid GetTokenInformation RegCreateKeyExA RegFlushKey RegEnumKeyA RegCloseKey RegOpenKeyA RegQueryValueExA RegSetValueExA RegOpenKeyExA RegEnumValueA RegDeleteValueA CreateServiceA CloseServiceHandle

ole32

CoTaskMemAlloc CoUninitialize CoCreateInstance CoTaskMemFree CoRegisterClassObject CoTaskMemRealloc CoRevokeClassObject CoInitialize

oleaut32

SysAllocString SysStringLen SysAllocStringLen VarUI4FromStr SysFreeString

rpcrt4

RpcEpRegisterA RpcBindingInqAuthClientA RpcServerInqBindings UuidCreate UuidToStringA RpcMgmtWaitServerListen RpcServerRegisterIfEx RpcServerListen NdrServerCall2 RpcServerUseProtseqEpA RpcMgmtStopServerListening RpcServerUseProtseqA RpcStringFreeA RpcServerUnregisterIf

mpr

WNetAddConnection3A WNetCancelConnection2A

rasapi32

RasSetEntryPropertiesW RasSetEntryPropertiesA

traffic

TcDeleteFilter TcCloseInterface TcDeleteFlow TcAddFlow TcAddFilter TcRegisterClient TcEnumerateInterfaces TcDeregisterClient TcOpenInterfaceW

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

setupapi

SetupDiChangeState SetupDiGetClassDevsA SetupDiSetClassInstallParamsA SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA SetupDiDestroyDeviceInfoList

wininet

InternetSetOptionW InternetSetOptionA

ws2_32

htons htonl inet_addr WSASetEvent

Name

.text

Size

357KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_4d5e11cf749be50cc536710349d81739_elex_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

gdi32

advapi32

ole32

oleaut32

rpcrt4

mpr

rasapi32

traffic

version

setupapi

wininet

ws2_32

generic