2026-10-02_0196599c57b2c965dc4cc5efc5e2eed1_amadey_elex_luca-stealer_medusalocker_njrat_remcos

General

Target
2026-10-02_0196599c57b2c965dc4cc5efc5e2eed1_amadey_elex_luca-stealer_medusalocker_njrat_remcos
Size 3.9MB
Sample261003-wwzmyswtft
SHA256 52f59d5aabec991a52c67350988400af07d39148e8cc50cedc063730c4a1001e
MD5 0196599c57b2c965dc4cc5efc5e2eed1
SHA1 5aad0af87b1ef441150be64b46ecc88a2f97a762
SHA512 1c740b89b19a1d6bc820aad1d2da99f593113945b83822e78c75527b1e8d7d52c42cb1391e10b507ce6d46546de740607943521217480050154a94496d0bc26e
SSDEEP 98304:RppSB2jHmzYcz4VTyysUz7iPjCYnI1UbjTdUfhDVwIy4K3YD:joBUHmOiPFnI1UbfqhB1y4HD
TLSH
T1C116BF10BDD1C873D2231F30499AF2F971ADFDA4172E41972F843B1D2E3829EAA35566
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_0196599c57b2c965dc4cc5efc5e2eed1_amadey_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-10-02_0196599c57b2c965dc4cc5efc5e2eed1_amadey_elex_luca-stealer_medusalocker_njrat_remcos

.exe 3.9MB

2026-10-02_0196599c57b2c965dc4cc5efc5e2eed1_amadey_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 3cbc95d570560e9ee34e0c58190744cb
SHA256 52f59d5aabec991a52c67350988400af07d39148e8cc50cedc063730c4a1001e
MD5 0196599c57b2c965dc4cc5efc5e2eed1
SHA1 5aad0af87b1ef441150be64b46ecc88a2f97a762
SHA512 1c740b89b19a1d6bc820aad1d2da99f593113945b83822e78c75527b1e8d7d52c42cb1391e10b507ce6d46546de740607943521217480050154a94496d0bc26e
SSDEEP 98304:RppSB2jHmzYcz4VTyysUz7iPjCYnI1UbjTdUfhDVwIy4K3YD:joBUHmOiPFnI1UbfqhB1y4HD
TLSH
T1C116BF10BDD1C873D2231F30499AF2F971ADFDA4172E41972F843B1D2E3829EAA35566
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43943

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\build\gitlab\build_dir\mCWGnw_b\0\cloudpc\desktop-src.cloud.mail.ru\disko\installer_wrapper\bin\DiskORelease\installer_wrapper.pdb

kernel32

GetFileAttributesW MultiByteToWideChar DeleteFileW WideCharToMultiByte CreateDirectoryW ReadFile SizeofResource GetFileSizeEx SetFilePointer WaitForSingleObject CreateFileW UnmapViewOfFile LockResource CloseHandle LoadResource FindResourceW CreateProcessW CreateFileMappingW MapViewOfFile GetExitCodeProcess FindFirstFileW FindNextFileW RemoveDirectoryW GetModuleFileNameW GetTempPathW FindClose InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId EncodePointer DecodePointer QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SetEndOfFile RtlUnwind RaiseException GetLastError SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP HeapAlloc HeapFree GetFileType GetConsoleCP GetConsoleMode CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapReAlloc FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap SetStdHandle FlushFileBuffers SetFilePointerEx WriteConsoleW HeapSize ReadConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_0196599c57b2c965dc4cc5efc5e2eed1_amadey_elex_luca-stealer_medusalocker_njrat_remcos

kernel32

generic