2026-10-01_84150326653cac687646cd193822d90e_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_84150326653cac687646cd193822d90e_elex_luca-stealer_mespinoza_njrat_remcos
Size 1.2MB
Sample261002-l5wmjsfd89
SHA256 8270d9b9e6a3739835928f171a79756d6cb8de4e6a8441ce4859ac52d58dce99
MD5 84150326653cac687646cd193822d90e
SHA1 c302b522107c53e586f758fe900e77c4afbf5725
SHA512 f452f768b1223a31cdec6210aa140407a91e48aca0ee8cc1afacf02a9eeacf89b825e1918167be533e52d11f6e24d8ebda17d61e3e5bfa5537cd857ecf2f92f5
SSDEEP 24576:eldowGmPdsfkP3zQa/JS3kMjqNbvrPOX9Ogs6pfIJU6w1H+vIVjc1pBnwf6:eDWI3zpJSLUrmXpfzbwAcN+6
TLSH
T14F45F1203753C431DAB205321B6C9A2A14BDBF210F7295EF57D876AEDDB09D24634F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_84150326653cac687646cd193822d90e_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-01_84150326653cac687646cd193822d90e_elex_luca-stealer_mespinoza_njrat_remcos

.exe 1.2MB

2026-10-01_84150326653cac687646cd193822d90e_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 2f0381ca527366dde0bbef4148ecb54a
SHA256 8270d9b9e6a3739835928f171a79756d6cb8de4e6a8441ce4859ac52d58dce99
MD5 84150326653cac687646cd193822d90e
SHA1 c302b522107c53e586f758fe900e77c4afbf5725
SHA512 f452f768b1223a31cdec6210aa140407a91e48aca0ee8cc1afacf02a9eeacf89b825e1918167be533e52d11f6e24d8ebda17d61e3e5bfa5537cd857ecf2f92f5
SSDEEP 24576:eldowGmPdsfkP3zQa/JS3kMjqNbvrPOX9Ogs6pfIJU6w1H+vIVjc1pBnwf6:eDWI3zpJSLUrmXpfzbwAcN+6
TLSH
T14F45F1203753C431DAB205321B6C9A2A14BDBF210F7295EF57D876AEDDB09D24634F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

134561

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\Lightshot_exe.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

FreeLibrary FindFirstFileW SetLastError FindNextFileW GetCurrentProcess GetModuleFileNameW FindClose MultiByteToWideChar GetTickCount CompareStringW lstrlenW GetVersionExW GetLocalTime lstrcmpiW MulDiv InterlockedDecrement InterlockedIncrement LoadLibraryExW GetComputerNameW LCMapStringW GetStringTypeW GetFileType GetACP GetStdHandle GetModuleHandleExW ExitProcess QueryPerformanceFrequency LoadLibraryW RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GlobalFree ResetEvent SetEvent CreateEventW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetConsoleCP LeaveCriticalSection EnterCriticalSection WideCharToMultiByte GetModuleHandleW GetFileSize GetProcAddress FindResourceW LoadResource FindResourceExW LockResource ReleaseMutex GetCurrentThreadId CreateFileW CreateMutexW WriteFile SizeofResource ReadFile GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc CreateThread RaiseException CloseHandle HeapReAlloc TerminateThread GetLastError HeapSize WaitForSingleObject InitializeCriticalSectionAndSpinCount HeapFree GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW

user32

PostQuitMessage DialogBoxParamW SetTimer MoveWindow PostMessageW RegisterWindowMessageW GetMessageW DispatchMessageW TranslateMessage KillTimer MapVirtualKeyW RemoveMenu LoadIconW DestroyMenu GetKeyNameTextW EnableWindow GetAsyncKeyState GetWindowLongW GetWindowTextLengthW DefWindowProcW CallWindowProcW GetWindow GetWindowRect RegisterHotKey DestroyIcon GetActiveWindow GetSubMenu TrackPopupMenu MonitorFromPoint LoadMenuW UnregisterHotKey GetClassInfoExW RegisterWindowMessageA RegisterClassExW MessageBoxW GetFocus DestroyWindow GetDC SetWindowPos MonitorFromWindow FillRect CreateWindowExW ScreenToClient EndDialog SetWindowTextW IsWindow OffsetRect GetCapture GetMonitorInfoW GetDlgCtrlID MapWindowPoints DrawFocusRect GetSysColor IsWindowEnabled SetFocus CharNextW LoadCursorW GetClassNameW SetCapture SetCursor SetRectEmpty SetWindowLongW GetClientRect GetDlgItem DrawTextW SystemParametersInfoW GetParent PtInRect UpdateWindow ReleaseCapture InvalidateRect GetCursorPos BeginPaint EndPaint GetWindowTextW InsertMenuItemW SetMenuItemInfoW TrackMouseEvent ReleaseDC GetSystemMetrics GetWindowDC SendMessageW UnregisterClassW SetForegroundWindow

gdi32

SelectObject CreateFontW GetDeviceCaps DeleteObject GetObjectW CreateFontIndirectW CreateSolidBrush SetBkColor SetBkMode GetStockObject SetTextColor

advapi32

RegQueryValueExW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW CryptDestroyKey CryptEncrypt CryptDecrypt CryptSetKeyParam CryptImportKey CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegDeleteValueW RegEnumValueW RegCloseKey

shell32

ShellExecuteW Shell_NotifyIconW

ole32

CoTaskMemRealloc CoTaskMemFree CoUninitialize CoTaskMemAlloc CoInitialize StringFromGUID2 CoCreateGuid CoCreateInstance

oleaut32

VarUI4FromStr SysFreeString SysAllocString

shlwapi

PathFileExistsW PathCanonicalizeW PathAppendW PathRemoveFileSpecW PathAddBackslashW PathIsDirectoryW

comctl32

DestroyPropertySheetPage PropertySheetW CreatePropertySheetPageW

wininet

InternetQueryOptionW

Name

.text

Size

226KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

308B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

774KB

Virtual Size

776KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_84150326653cac687646cd193822d90e_elex_luca-stealer_mespinoza_njrat_remcos

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wininet

generic