2026-09-30_b603cb82aa5cc1c2a3106f9303370a4d_elex_luca-stealer_mespinoza_njrat_remcos

General

Target
2026-09-30_b603cb82aa5cc1c2a3106f9303370a4d_elex_luca-stealer_mespinoza_njrat_remcos
Size 4.4MB
Sample260930-j84ffsx13p
SHA256 4e6f653c19e9aaac11791f58dd3f2f47d57ecbbf2aa0586fdfb64244bf61ec52
MD5 b603cb82aa5cc1c2a3106f9303370a4d
SHA1 560154c46f936a2b62045a347973af935cc22e08
SHA512 b3163103a6ff202aae927b5e7d056492481c9621e0f2f65af759d81ed4f15f09c7e4ff350849656cc6ded77d778b9d492ffa0c1311644edc592aa0da52c9d792
SSDEEP 49152:vQ11SJIBluXw52pvarnTq4voctSIrtOiKco0pPBsTdB/AMVB4AG8KOGRiO4hemA4:ITSwIiOiKwAG8KOsi/hvGw4Wd5
TLSH
T163263C22F7520DF2C99340B0CD7A6B66CB5AEC780BF107B3677246DEA4792C13525B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_b603cb82aa5cc1c2a3106f9303370a4d_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-09-30_b603cb82aa5cc1c2a3106f9303370a4d_elex_luca-stealer_mespinoza_njrat_remcos

.exe 4.4MB

2026-09-30_b603cb82aa5cc1c2a3106f9303370a4d_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH d2c4e9c5955a02724ff373839c3e8c73
SHA256 4e6f653c19e9aaac11791f58dd3f2f47d57ecbbf2aa0586fdfb64244bf61ec52
MD5 b603cb82aa5cc1c2a3106f9303370a4d
SHA1 560154c46f936a2b62045a347973af935cc22e08
SHA512 b3163103a6ff202aae927b5e7d056492481c9621e0f2f65af759d81ed4f15f09c7e4ff350849656cc6ded77d778b9d492ffa0c1311644edc592aa0da52c9d792
SSDEEP 49152:vQ11SJIBluXw52pvarnTq4voctSIrtOiKco0pPBsTdB/AMVB4AG8KOGRiO4hemA4:ITSwIiOiKwAG8KOsi/hvGw4Wd5
TLSH
T163263C22F7520DF2C99340B0CD7A6B66CB5AEC780BF107B3677246DEA4792C13525B4A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

308064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\3edc94783d8e5112\Tools\NvImageConvert\Release\NvImageConvert.pdb

shlwapi

PathFindExtensionA

windowscodecs

WICConvertBitmapSource

kernel32

CreateSemaphoreA FormatMessageA LocalFree InitializeCriticalSection DebugBreak IsProcessorFeaturePresent GetModuleFileNameW CreateFileW UnmapViewOfFile CreateFileA CloseHandle GetFileSize CreateFileMappingW MapViewOfFile WideCharToMultiByte DuplicateHandle WaitForSingleObjectEx Sleep GetCurrentProcess GetCurrentThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection MultiByteToWideChar EncodePointer DecodePointer QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess GetCurrentProcessId InitializeSListHead CreateTimerQueue GetLastError SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW WaitForSingleObject RaiseException RtlUnwind HeapAlloc HeapFree ExitThread GetModuleHandleExW HeapReAlloc ExitProcess GetModuleFileNameA GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile SetFilePointerEx HeapSize GetProcessHeap GetTimeZoneInformation FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle WriteConsoleW ReadConsoleW SetEndOfFile

ole32

CoCreateInstance CoUninitialize CoInitialize

generic

count=23, id=241, version=40116,

count=161, id=243, version=40116,

count=32, id=242, version=40116,

count=1, id=207, version=65501,

count=1, id=199, version=41118,

count=26, id=259, version=24123,

count=120, id=261, version=24123,

count=67, id=260, version=24123,

count=10, id=265, version=24215,

count=1, id=206, version=65501,

count=9, id=203, version=65501,

count=152, id=1, productName=Unmarked objects,

count=34, productName=Unmarked objects (old),

count=72, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=67, id=260, productName=VS2015 UPD1 build 23506, version=23506,

count=1, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_b603cb82aa5cc1c2a3106f9303370a4d_elex_luca-stealer_mespinoza_njrat_remcos

shlwapi

windowscodecs

kernel32

ole32

generic