2026-10-15_f8799bded765545adbad0e4084ba139e_amadey_elex_luca-stealer_medusalocker_njrat_remcos

General

Target
2026-10-15_f8799bded765545adbad0e4084ba139e_amadey_elex_luca-stealer_medusalocker_njrat_remcos
Size 2.6MB
Sample261015-2datrsee78
SHA256 4cbadd8e32722f2b10e385efb504c5bf545c0d5368bc063cff2ba648fd2d9d8f
MD5 f8799bded765545adbad0e4084ba139e
SHA1 0a048e632ad48988112be2850303596fec86ca50
SHA512 7e377c40c4811bd81df67061e6e72d7391b44f7a94a6fa83e4d6c965a311238faffabc3ebf09ce6a7e1f12f70e7be6249a10ff7cb4ac51be000b00cdf6e25db3
SSDEEP 49152:RpGqG4/xkYNwa3WinHmq8vYkZz4oOTyysluz7iPjIXQ7nI1UOeMav:RppSB2jHmzYcz4VTyysUz7iPjCYnI1UX
TLSH
T162C57D21BDD1C873C2631F31499EF2F971ADEDA4172E41872F843B1C2E342A6AA35567
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-15_f8799bded765545adbad0e4084ba139e_amadey_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-10-15_f8799bded765545adbad0e4084ba139e_amadey_elex_luca-stealer_medusalocker_njrat_remcos

.exe 2.6MB

2026-10-15_f8799bded765545adbad0e4084ba139e_amadey_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 3cbc95d570560e9ee34e0c58190744cb
SHA256 4cbadd8e32722f2b10e385efb504c5bf545c0d5368bc063cff2ba648fd2d9d8f
MD5 f8799bded765545adbad0e4084ba139e
SHA1 0a048e632ad48988112be2850303596fec86ca50
SHA512 7e377c40c4811bd81df67061e6e72d7391b44f7a94a6fa83e4d6c965a311238faffabc3ebf09ce6a7e1f12f70e7be6249a10ff7cb4ac51be000b00cdf6e25db3
SSDEEP 49152:RpGqG4/xkYNwa3WinHmq8vYkZz4oOTyysluz7iPjIXQ7nI1UOeMav:RppSB2jHmzYcz4VTyysUz7iPjCYnI1UX
TLSH
T162C57D21BDD1C873C2631F31499EF2F971ADEDA4172E41872F843B1C2E342A6AA35567
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43943

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\build\gitlab\build_dir\mCWGnw_b\0\cloudpc\desktop-src.cloud.mail.ru\disko\installer_wrapper\bin\DiskORelease\installer_wrapper.pdb

kernel32

GetFileAttributesW MultiByteToWideChar DeleteFileW WideCharToMultiByte CreateDirectoryW ReadFile SizeofResource GetFileSizeEx SetFilePointer WaitForSingleObject CreateFileW UnmapViewOfFile LockResource CloseHandle LoadResource FindResourceW CreateProcessW CreateFileMappingW MapViewOfFile GetExitCodeProcess FindFirstFileW FindNextFileW RemoveDirectoryW GetModuleFileNameW GetTempPathW FindClose InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId EncodePointer DecodePointer QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SetEndOfFile RtlUnwind RaiseException GetLastError SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP HeapAlloc HeapFree GetFileType GetConsoleCP GetConsoleMode CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapReAlloc FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap SetStdHandle FlushFileBuffers SetFilePointerEx WriteConsoleW HeapSize ReadConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-15_f8799bded765545adbad0e4084ba139e_amadey_elex_luca-stealer_medusalocker_njrat_remcos

kernel32

generic