2026-10-18_37c4c6916e7f5d308cd8d95c718c18e0_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-18_37c4c6916e7f5d308cd8d95c718c18e0_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos
Size 1.3MB
Sample261018-taepjsbf59
SHA256 342c631d3711b368e030a1c0e2eca936632c22c6ec73fd50d9c66c3eb102fb76
MD5 37c4c6916e7f5d308cd8d95c718c18e0
SHA1 fd8229fbc1e6538e85dc4ab0d3173a700a100e45
SHA512 adb2ae6e91637c143a0cb2f54162728ec45fbe97aaf9b5ec0cb996d02408d5477f83b5d521e22876a34759da81df7f95d6186a99425b33aa9d68086c5a8e22b8
SSDEEP 24576:Rlb9VyLis6mlnTlIGwRWKKCCZhGkMyWskloDcWifgRVUy70r3kf+rl4GXKX:Rlb9VRPGTmBKCCdErKcWiCUQ0r30+pI
TLSH
T146550232BB41D077E0B206350DA9C6B425ECE8714A234A9FB3D85B7D2E750D16B36B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_37c4c6916e7f5d308cd8d95c718c18e0_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-18_37c4c6916e7f5d308cd8d95c718c18e0_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

.exe 1.3MB

2026-10-18_37c4c6916e7f5d308cd8d95c718c18e0_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

IMPHASH 963df8e0bf221c69c62f01b494729e46
SHA256 342c631d3711b368e030a1c0e2eca936632c22c6ec73fd50d9c66c3eb102fb76
MD5 37c4c6916e7f5d308cd8d95c718c18e0
SHA1 fd8229fbc1e6538e85dc4ab0d3173a700a100e45
SHA512 adb2ae6e91637c143a0cb2f54162728ec45fbe97aaf9b5ec0cb996d02408d5477f83b5d521e22876a34759da81df7f95d6186a99425b33aa9d68086c5a8e22b8
SSDEEP 24576:Rlb9VyLis6mlnTlIGwRWKKCCZhGkMyWskloDcWifgRVUy70r3kf+rl4GXKX:Rlb9VRPGTmBKCCdErKcWiCUQ0r30+pI
TLSH
T146550232BB41D077E0B206350DA9C6B425ECE8714A234A9FB3D85B7D2E750D16B36B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

153392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\639649\out\Release\sesvcr.pdb

kernel32

OutputDebugStringW GetSystemTime SystemTimeToFileTime LoadLibraryW GetTempPathW GetFileType SetFilePointer WriteFile GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateFileA LocalFileTimeToFileTime ProcessIdToSessionId LocalFree InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError SetThreadAffinityMask GetCurrentThread QueryPerformanceCounter OpenFileMappingW Sleep SetEvent InterlockedCompareExchange ExitProcess GetSystemTimeAsFileTime CreateEventW CreateMutexW VirtualFreeEx ReadFile InterlockedDecrement InterlockedIncrement DecodePointer GetFileSizeEx SetFilePointerEx FormatMessageW TlsSetValue HeapLock ReleaseMutex HeapWalk TlsAlloc TlsGetValue TlsFree HeapUnlock OpenThread FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetACP GetStdHandle GetCommandLineW GetCommandLineA FreeLibraryAndExitThread ExitThread GetModuleHandleExW RtlUnwind LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetCPInfo GetStringTypeW LCMapStringW EncodePointer GetCurrentProcess OpenProcess Process32NextW TerminateProcess lstrcmpiW Process32FirstW CreateToolhelp32Snapshot WaitForSingleObject CreateThread HeapDestroy FindClose FindNextFileW FindFirstFileW SetFileAttributesW GetLastError CreateDirectoryW EnterCriticalSection LeaveCriticalSection CreateProcessW InitializeCriticalSection DeleteCriticalSection FreeLibrary LoadLibraryExW GetProcAddress GetModuleFileNameW GetModuleHandleW GetCurrentProcessId CloseHandle DeviceIoControl CreateFileW DeleteFileW WideCharToMultiByte FindResourceExW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize WriteConsoleW

user32

SetWindowPos GetParent GetWindowThreadProcessId PostMessageW GetMessageW DefWindowProcW DestroyWindow IsWindow UnregisterClassW GetWindowLongW CallWindowProcW RegisterWindowMessageW SendMessageW PostQuitMessage RegisterClassExW FindWindowW GetClassInfoExW LoadCursorW CreateWindowExW GetKeyState SetFocus SetParent KillTimer SetTimer CharNextW PeekMessageW TranslateMessage DispatchMessageW ShowWindow SetWindowLongW

advapi32

OpenProcessToken RegQueryValueExA RegDeleteValueW RegCreateKeyExW RegSetValueExW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW GetTokenInformation RegCloseKey RegQueryValueExW RegOpenKeyExW ConvertSidToStringSidW GetUserNameW

shell32

SHFileOperationW CommandLineToArgvW SHGetFolderPathW

ole32

CoTaskMemFree CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc

oleaut32

VarUI4FromStr SysFreeString SysAllocStringLen SysAllocString

shlwapi

PathIsRootW PathRemoveFileSpecW PathAddBackslashW PathIsDirectoryW PathFileExistsW SHGetValueW PathAppendW PathFindFileNameW ord158 SHDeleteKeyW PathCombineW SHSetValueW StrStrIA

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetProcessImageFileNameW

Name

.text

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

356B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

773KB

Virtual Size

776KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_37c4c6916e7f5d308cd8d95c718c18e0_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

psapi

generic