2026-09-30_97e839c0f91c98c8d1acfd084d7cfb3d_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_97e839c0f91c98c8d1acfd084d7cfb3d_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos
Size 387KB
Sample261001-ln55nawsft
SHA256 63ec7ab8ef479366d3bfe21da168635279af1712f5fd783badde6e546ce60f6d
MD5 97e839c0f91c98c8d1acfd084d7cfb3d
SHA1 dbdd6f0fd571c33c2d33556b8b2b9715eacad54b
SHA512 1d27a9a2e8a6b8c1a6dc38c9dfd53546ff350a27d4fcd1445194fdf34f65df1ae9997f3c0c1bba5655dac85118d0e580e116499df5fc92cd7b724e4822ccc34f
SSDEEP 12288:VQ4UfIadkwRVroC1YiMmd0+Lc+Bwp3vvi:V1hadkwRrldzwb3Hi
TLSH
T192849E207646E136D96201714F6CEBAB283CB6600B6545DBF3DC1EAE0EB46D13732B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-30_97e839c0f91c98c8d1acfd084d7cfb3d_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

.exe 387KB

2026-09-30_97e839c0f91c98c8d1acfd084d7cfb3d_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

IMPHASH 3e0c97ed0f589f9fe9d2b94c07915385
SHA256 63ec7ab8ef479366d3bfe21da168635279af1712f5fd783badde6e546ce60f6d
MD5 97e839c0f91c98c8d1acfd084d7cfb3d
SHA1 dbdd6f0fd571c33c2d33556b8b2b9715eacad54b
SHA512 1d27a9a2e8a6b8c1a6dc38c9dfd53546ff350a27d4fcd1445194fdf34f65df1ae9997f3c0c1bba5655dac85118d0e580e116499df5fc92cd7b724e4822ccc34f
SSDEEP 12288:VQ4UfIadkwRVroC1YiMmd0+Lc+Bwp3vvi:V1hadkwRrldzwb3Hi
TLSH
T192849E207646E136D96201714F6CEBAB283CB6600B6545DBF3DC1EAE0EB46D13732B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

4c:1d:91:d7:f9:9f:6a:99:e3:e1:f3:69:da:34:3a:95:a7:04:5e:65:9f:eb:fa:ea:6d:1b:e1:78:a1:f5:6e:d8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Chains

Feb 8, 2018

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

af:0e:a8:5c:5c:42:b3:ef:cd:8a:e0:f6:1a:50:4e:17:6e:4e:15:3f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Chains

Feb 8, 2018

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Serial Number

0c:f3:53:69:a9:71:07:62:c3:6f:68:05:fc:9e:45:d6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 18, 2016 - Oct 12, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

21:d1:26:fb:73:17:8c:40:00:00:00:00:55:91:c3:e9

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 8, 2017 - Feb 8, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jun 22, 2029

Minor OS version

Major OS version

Entry point

144681

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Y:\jenkins-workspace\workspace\client-builder-remoteieframe\ut_win\Build\Win32\Release\RemoteIEFrame.pdb

kernel32

GetTickCount MultiByteToWideChar WideCharToMultiByte InterlockedDecrement InterlockedIncrement ReadFile GetModuleFileNameA VirtualAlloc CreateFileW GetCurrentProcessId SetUnhandledExceptionFilter GetSystemTimeAsFileTime DebugBreak CreateDirectoryW TerminateProcess WaitForSingleObject GetVersion CreateEventW Sleep SetEvent TerminateThread GlobalAlloc LoadLibraryW CreateThread LocalFree ExitProcess VerSetConditionMask VerifyVersionInfoW GetLocaleInfoW WriteFile CreateNamedPipeW DisconnectNamedPipe GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetLastError GetCommandLineW HeapSize WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetProcessHeap SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleMode CloseHandle GetModuleHandleA GetCurrentThreadId GetDriveTypeW GetLastError GetModuleFileNameW GetProcAddress LoadLibraryA GetCurrentProcess GetVolumeInformationA GetModuleHandleW GetConsoleCP GetFileType GetACP GetStdHandle GetModuleHandleExW HeapFree HeapReAlloc HeapAlloc LoadLibraryExW FreeLibrary RtlUnwind RaiseException InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetCPInfo LCMapStringW TlsFree TlsSetValue TlsGetValue GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount TlsAlloc

user32

SetWindowPos EndPaint BeginPaint InvalidateRect PostQuitMessage GetClientRect SetWindowLongW GetWindowLongW GetMessageW FindWindowW GetKeyState PostMessageW LoadCursorA DestroyWindow DefWindowProcW CreateWindowExW RegisterClassExW ShowWindow DispatchMessageW TrackMouseEvent MoveWindow TranslateMessage

shell32

DragQueryFileW CommandLineToArgvW DragFinish SHGetSpecialFolderPathW

ole32

StgCreateStorageEx OleInitialize CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance OleCreate OleSetContainedObject OleUninitialize ReleaseStgMedium

oleaut32

DispGetParam SysFreeString VariantClear SysAllocString VariantInit SysStringLen

shlwapi

PathFindFileNameW PathRemoveFileSpecW PathCombineW PathFileExistsW

Name

.text

Size

267KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

740B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_97e839c0f91c98c8d1acfd084d7cfb3d_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

shell32

ole32

oleaut32

shlwapi

generic