2026-09-28_8419ed858606fb90e426dd485300968f_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_8419ed858606fb90e426dd485300968f_elex_mespinoza
Size 2.4MB
Sample260928-rm44vsbb74
SHA256 c5258f4c6e466027d5d9d516664dc0e04afbd31420d39c26d2dbd0cbca7155fc
MD5 8419ed858606fb90e426dd485300968f
SHA1 5a921b47f5a8e69e3072b735f516b7b04c7bb1d9
SHA512 4555070b03dd07d0283ed6610e0a0dcc118497f5cc25358236a380a44b6618d55d032710b3a7a6c167fd8b7656ee7beaff02510115f3495c3c1a86be8db0c558
SSDEEP 24576:WrkvtY//8XDnUeA9n/TM4NZYeNm+9MhUwdIUTDWG6goHD2LwyKTPxEDev7uvx7S7:Wrk4IbA9n/TDbXNKdRslFyKTmCDu+
TLSH
T1F3C5221129A818F1D8463576B84CE73DDA71461B2F1387CBDBA87D846FA8ED018362CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_8419ed858606fb90e426dd485300968f_elex_mespinoza

File Explorer

2026-09-28_8419ed858606fb90e426dd485300968f_elex_mespinoza

.exe 2.4MB

2026-09-28_8419ed858606fb90e426dd485300968f_elex_mespinoza

IMPHASH 18e1470b9c6a8cfc144e6a0da63202cb
SHA256 c5258f4c6e466027d5d9d516664dc0e04afbd31420d39c26d2dbd0cbca7155fc
MD5 8419ed858606fb90e426dd485300968f
SHA1 5a921b47f5a8e69e3072b735f516b7b04c7bb1d9
SHA512 4555070b03dd07d0283ed6610e0a0dcc118497f5cc25358236a380a44b6618d55d032710b3a7a6c167fd8b7656ee7beaff02510115f3495c3c1a86be8db0c558
SSDEEP 24576:WrkvtY//8XDnUeA9n/TM4NZYeNm+9MhUwdIUTDWG6goHD2LwyKTPxEDev7uvx7S7:Wrk4IbA9n/TDbXNKdRslFyKTmCDu+
TLSH
T1F3C5221129A818F1D8463576B84CE73DDA71461B2F1387CBDBA87D846FA8ED018362CF
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

plugin-container.pdb

mozglue

??2@YAPAXI@Z ??3@YAXPAX@Z ??3@YAXPAXI@Z ??_U@YAPAXI@Z ??_V@YAXPAX@Z ?DllBlocklist_Initialize@@YAXI@Z ?IsWin32kLockedDown@mozilla@@YA_NXZ ?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?SetGeckoProcessType@mozilla@@YAXPBD@Z ?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A _wcsdup free malloc moz_xmalloc mozalloc_abort realloc

usp10

ScriptBreak ScriptItemize

advapi32

AccessCheck ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DuplicateToken DuplicateTokenEx EqualSid FreeSid GetAce GetKernelObjectSecurity GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorSacl GetSecurityInfo GetSidSubAuthority GetTokenInformation ImpersonateLoggedOnUser InitializeSid IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken RegCloseKey RegCreateKeyExW RegDisablePredefinedCache RegOpenKeyExW RegQueryValueExW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036

ntdll

NtQueryVirtualMemory RtlNtStatusToDosError RtlSetLastWin32Error

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0ios_base@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1ios_base@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?good@ios_base@std@@QBE_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread DebugBreak DeleteCriticalSection DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx ExpandEnvironmentStringsW FlushInstructionCache FreeEnvironmentStringsW FreeLibrary GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileType GetLastError GetLongPathNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProcessId GetProductInfo GetQueuedCompletionStatus GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTickCount GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsWow64Process LeaveCriticalSection LoadLibraryExA LoadLibraryW LocalFree MapViewOfFile PostQueuedCompletionStatus ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ResetEvent SearchPathW SetDllDirectoryW SetEnvironmentVariableW SetEvent SetHandleInformation SetInformationJobObject SetLastError SetProcessDEPPolicy SetThreadAffinityMask SetUnhandledExceptionFilter SignalObjectAndWait Sleep SleepConditionVariableSRW TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile UnregisterWait UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteProcessMemory lstrlenW

vcruntime140

__current_exception __current_exception_context _except_handler3 _except_handler4_common memcmp memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _controlfp_s _crt_atexit _errno _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _invoke_watson _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsnwprintf_s __stdio_common_vswprintf _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

_wcsnicmp strlen wcscmp wcslen wcsncmp wcstok_s

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode

GetHandleVerifier IsSandboxedProcess _TargetConfigureOPMProtectedOutput@20 _TargetCreateNamedPipeW@36 _TargetCreateOPMProtectedOutputs@24 _TargetCreateProcessA@44 _TargetCreateProcessW@44 _TargetCreateThread@28 _TargetDestroyOPMProtectedOutput@8 _TargetEnumDisplayDevicesA@20 _TargetEnumDisplayMonitors@20 _TargetGdiDllInitialize@12 _TargetGetCertificate@20 _TargetGetCertificateByHandle@20 _TargetGetCertificateSize@16 _TargetGetCertificateSizeByHandle@16 _TargetGetMonitorInfoA@12 _TargetGetMonitorInfoW@12 _TargetGetOPMInformation@16 _TargetGetOPMRandomNumber@12 _TargetGetStockObject@8 _TargetGetSuggestedOPMProtectedOutputArraySize@12 _TargetNtCreateEvent@24 _TargetNtCreateFile@48 _TargetNtCreateKey@32 _TargetNtCreateSection@32 _TargetNtImpersonateAnonymousToken@8 _TargetNtMapViewOfSection@44 _TargetNtOpenEvent@16 _TargetNtOpenFile@28 _TargetNtOpenKey@16 _TargetNtOpenKeyEx@20 _TargetNtOpenProcess@20 _TargetNtOpenProcessToken@16 _TargetNtOpenProcessTokenEx@20 _TargetNtOpenThread@20 _TargetNtOpenThreadToken@20 _TargetNtOpenThreadTokenEx@24 _TargetNtQueryAttributesFile@12 _TargetNtQueryFullAttributesFile@12 _TargetNtSetInformationFile@24 _TargetNtSetInformationThread@20 _TargetNtUnmapViewOfSection@12 _TargetRegisterClassW@8 _TargetSetOPMSigningKeyAndSequenceNumbers@12 g_handles_to_close g_interceptions g_nt g_originals g_shared_IPC_size g_shared_delayed_integrity_level g_shared_delayed_mitigations g_shared_policy_size g_shared_section

Name

.text

Size

191KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_8419ed858606fb90e426dd485300968f_elex_mespinoza

mozglue

usp10

advapi32

ntdll

msvcp140

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic