2026-09-28_ebbfa057213d11ac9ad695fda52b5dad_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_ebbfa057213d11ac9ad695fda52b5dad_elex_luca-stealer_mespinoza_njrat_remcos
Size 859KB
Sample260928-2dbq3avepf
SHA256 15440824fa27f43ce9804bf9e3cec46ace2d05a498915008d392f7464d69e333
MD5 ebbfa057213d11ac9ad695fda52b5dad
SHA1 300d314de1230940dc2daa8372b941e2ac47cc5b
SHA512 90ad3a7f1e67476bc2829407958a3770d4f77a1fbfa930ac6f8cae32102163b246226fe73b66cd7a995af0adc20a9f0a9251684ec29672e3b63fd0d9eb8c73b7
SSDEEP 12288:h1hKBS3HvxcduLSrzELRTg/mvdp1LF5vX4h40/JmkoiZXa9FPxtJqI8GbH9d:RGS3vxcEDTnlpRF2FJmtyK9jbdd
TLSH
T178158E207682C03AE6B201725A7C9A6B103E7B640F75A1DF67D85B6E1DB45C24F31F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_ebbfa057213d11ac9ad695fda52b5dad_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-09-28_ebbfa057213d11ac9ad695fda52b5dad_elex_luca-stealer_mespinoza_njrat_remcos

.exe 859KB

2026-09-28_ebbfa057213d11ac9ad695fda52b5dad_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH bf5b3ca4d2d020ee1c8de73a5768247d
SHA256 15440824fa27f43ce9804bf9e3cec46ace2d05a498915008d392f7464d69e333
MD5 ebbfa057213d11ac9ad695fda52b5dad
SHA1 300d314de1230940dc2daa8372b941e2ac47cc5b
SHA512 90ad3a7f1e67476bc2829407958a3770d4f77a1fbfa930ac6f8cae32102163b246226fe73b66cd7a995af0adc20a9f0a9251684ec29672e3b63fd0d9eb8c73b7
SSDEEP 12288:h1hKBS3HvxcduLSrzELRTg/mvdp1LF5vX4h40/JmkoiZXa9FPxtJqI8GbH9d:RGS3vxcEDTnlpRF2FJmtyK9jbdd
TLSH
T178158E207682C03AE6B201725A7C9A6B103E7B640F75A1DF67D85B6E1DB45C24F31F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

390165

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\repo\web-installer-new\WebInstaller\Release\WebInstaller.pdb

gdiplus

GdipAlloc GdipSetSmoothingMode GdipCreateSolidFill GdipFree GdipCreateFromHDC GdipFillRectangleI GdipDeleteGraphics GdipSetPenMode GdipDeletePen GdipCreatePen1 GdiplusStartup GdiplusShutdown GdipDeleteBrush GdipGetImageHeight GdipCloneImage GdipCreateBitmapFromStream GdipDrawImageRectI GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageWidth GdipCreateBitmapFromFile GdipReleaseDC

wininet

InternetCrackUrlW HttpSendRequestW InternetCloseHandle HttpQueryInfoW InternetSetOptionW InternetReadFile InternetOpenW InternetQueryOptionW HttpOpenRequestW InternetConnectW InternetGetConnectedState

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

QueryPerformanceFrequency GetModuleHandleExW FreeLibraryAndExitThread ExitThread DeleteCriticalSection HeapFree InitializeCriticalSectionAndSpinCount HeapSize GetLastError HeapReAlloc RaiseException HeapAlloc DecodePointer HeapDestroy GetProcessHeap GetVersionExW ReadFile GetStdHandle WriteFile EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects MultiByteToWideChar WideCharToMultiByte CreateDirectoryW GetFullPathNameW lstrlenW RemoveDirectoryW SetFileTime CreateFileW SetFileAttributesW DeleteFileW CloseHandle FindFirstFileW FindNextFileW FindClose SetFilePointer SetEndOfFile GetFileSize GetSystemInfo GetProcAddress GetModuleHandleW VirtualFree VirtualAlloc InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent GetTimeZoneInformation FlushFileBuffers GlobalHandle SetLastError InterlockedDecrement GetModuleFileNameW GetCurrentThreadId Sleep LockResource GlobalAlloc GlobalFree FindResourceExW LoadResource FindResourceW GlobalLock FreeLibrary InterlockedIncrement lstrcmpiW GlobalUnlock lstrcmpW MulDiv LoadLibraryExW GetSystemDefaultLCID GetProcessId LocalAlloc LocalFree GetExitCodeProcess CreateThread OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetCurrentProcessId GetFileAttributesW UnmapViewOfFile FlushViewOfFile CreateFileMappingW MapViewOfFile CopyFileW lstrlenA GetCurrentProcess TerminateProcess GetEnvironmentVariableW GetLongPathNameW GetVersion WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW EncodePointer InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache LoadLibraryExA GetConsoleCP GetConsoleMode SetFilePointerEx GetLocalTime ExitProcess GetACP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ResetEvent GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlUnwind FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle WriteConsoleW ReadConsoleW SizeofResource

user32

EnableWindow SetLayeredWindowAttributes SetMenuDefaultItem SetMenuItemInfoW CheckMenuRadioItem GetMenuItemInfoW ShowWindow IsWindow InvalidateRgn DispatchMessageW SetTimer RedrawWindow IsDialogMessageW ClientToScreen DestroyAcceleratorTable PeekMessageW IsChild SetDlgItemTextW GetSysColor MoveWindow UnhookWindowsHookEx CreateAcceleratorTableW SetFocus EndDialog GetWindowLongW LoadCursorW GetClassNameW SetCapture SetWindowsHookExW SetWindowLongW GetClientRect GetDlgItem KillTimer PostQuitMessage SendDlgItemMessageW SetWindowContextHelpId MapDialogRect GetWindowRect RegisterClassW ValidateRect LoadIconW UpdateLayeredWindow UpdateWindow GetWindowThreadProcessId GetWindowTextLengthW GetMessageW DefWindowProcW CallWindowProcW GetWindow GetFocus DestroyWindow GetDC SetWindowPos MessageBoxW FillRect CreateWindowExW ScreenToClient SendMessageW PostMessageW SwitchToThisWindow CharNextW EnumWindows GetDesktopWindow CreateDialogIndirectParamW SystemParametersInfoW GetClassInfoExW GetParent RegisterWindowMessageW ReleaseCapture InvalidateRect ReleaseDC BeginPaint EndPaint GetWindowTextW UnregisterClassW CharUpperW CallNextHookEx SetWindowTextW TranslateMessage RegisterClassExW

advapi32

RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegCloseKey RegQueryValueExW GetTokenInformation RegSetValueW LookupAccountSidW

ole32

CoGetClassObject OleUninitialize CoTaskMemAlloc CoCreateGuid StringFromGUID2 CoCreateInstance CLSIDFromProgID CoTaskMemFree CreateStreamOnHGlobal OleInitialize CoTaskMemRealloc CLSIDFromString OleLockRunning

shell32

ShellExecuteExW SHGetDesktopFolder SHGetPathFromIDListW SHBrowseForFolderW SHFileOperationW SHCreateDirectoryExW ShellExecuteW

oleaut32

DispCallFunc LoadRegTypeLi VariantInit LoadTypeLi OleCreateFontIndirect SysStringLen SysAllocStringLen VarUI4FromStr VariantCopy VariantClear SysFreeString SysAllocString

shlwapi

UrlEscapeW PathIsDirectoryEmptyW ord176

gdi32

CreateSolidBrush GetObjectW DeleteDC GetDeviceCaps GetStockObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt CreateDIBSection DeleteObject

crypt32

CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CryptQueryObject CertCloseStore

psapi

GetModuleFileNameExW

Name

.text

Size

556KB

Virtual Size

555KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_ebbfa057213d11ac9ad695fda52b5dad_elex_luca-stealer_mespinoza_njrat_remcos

gdiplus

wininet

version

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

crypt32

psapi

generic