2026-09-30_f2e279293671f87a9f6a969c71286978_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

General

Target
2026-09-30_f2e279293671f87a9f6a969c71286978_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos
Size 4.5MB
Sample260930-hhetqshb82
SHA256 ebe5a50b63566eee9e01e329e3c2a9814395151b4b66b20ac39df3da66b6d5fb
MD5 f2e279293671f87a9f6a969c71286978
SHA1 05a51f88e22b972a80d955dd741896d16565b65e
SHA512 a0ac95e821fe54cd4b3fd5d9c93d70f301cbc6f1e0278a1344327fe7567968def6420c29776ed6be4e69bf8032485f61445bb37337124ea010811ffb61f2188c
SSDEEP 49152:A5K0PB/mu3kxVhdF0p0M523VniJr1eIfuiwDB/AQ3ET1fbMKmGRsMgf3O4hemAmj:iKdzFniJr1eulbMKmsU3/hvGw4Wd5
TLSH
T157264D22F7520DF2C99380B0CD7A6B66CB5AEC780BF107B3673245DEA4752D13525B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_f2e279293671f87a9f6a969c71286978_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

File Explorer

2026-09-30_f2e279293671f87a9f6a969c71286978_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

.exe 4.5MB

2026-09-30_f2e279293671f87a9f6a969c71286978_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

IMPHASH f237adc22b939eb89ae06c907382dc98
SHA256 ebe5a50b63566eee9e01e329e3c2a9814395151b4b66b20ac39df3da66b6d5fb
MD5 f2e279293671f87a9f6a969c71286978
SHA1 05a51f88e22b972a80d955dd741896d16565b65e
SHA512 a0ac95e821fe54cd4b3fd5d9c93d70f301cbc6f1e0278a1344327fe7567968def6420c29776ed6be4e69bf8032485f61445bb37337124ea010811ffb61f2188c
SSDEEP 49152:A5K0PB/mu3kxVhdF0p0M523VniJr1eIfuiwDB/AQ3ET1fbMKmGRsMgf3O4hemAmj:iKdzFniJr1eulbMKmsU3/hvGw4Wd5
TLSH
T157264D22F7520DF2C99380B0CD7A6B66CB5AEC780BF107B3673245DEA4752D13525B8A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

289266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\3edc94783d8e5112\Tools\FreqTransfer\bin\Release\FreqTransfer32.pdb

kernel32

EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection QueryPerformanceFrequency QueryPerformanceCounter CreateSemaphoreA FormatMessageA LocalFree TryEnterCriticalSection GetCurrentThreadId CloseHandle DuplicateHandle WaitForSingleObjectEx Sleep GetCurrentProcess GetCurrentThread GetExitCodeThread GetNativeSystemInfo WideCharToMultiByte MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue GetLastError SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW WaitForSingleObject RtlUnwind RaiseException ExitProcess GetModuleHandleExW HeapAlloc HeapFree ExitThread HeapReAlloc GetModuleFileNameA GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetProcessHeap GetTimeZoneInformation FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle WriteConsoleW ReadConsoleW CreateFileW HeapSize SetEndOfFile DebugBreak

windowscodecs

WICConvertBitmapSource

ole32

CoInitialize CoUninitialize CoCreateInstance

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

815KB

Virtual Size

816KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_f2e279293671f87a9f6a969c71286978_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos

kernel32

windowscodecs

ole32

generic