2026-10-22_70485cd76600de927e78b8bfc3bddd6c_elex_luca-stealer_mespinoza_njrat_remcos

General

Target
2026-10-22_70485cd76600de927e78b8bfc3bddd6c_elex_luca-stealer_mespinoza_njrat_remcos
Size 2.7MB
Sample261024-k3a3dsay2n
SHA256 60406247ec5b68dda7dbc0823d155958d55a47cb41d5fa177c0ec5e58dfdc27a
MD5 70485cd76600de927e78b8bfc3bddd6c
SHA1 5c794a80e1ed5a26ed3e4203284cce49e18e9fab
SHA512 d65928747c31c64cc343134a5e16667e113cda58319e0bdb9ccf391e312864a560c9aa94adce327a45fef6fbdfc3814a024c500f00d4ac9d6780be7ca0fbf2b1
SSDEEP 49152:QmY2F8kU1HYQ0n2X3coeZTh37+tgauhwbR3P8wT82sOH8VuOJdJqC4If:QmAcBWgaPJYOH88OJdJLf
TLSH
T16AD502213AE1D136C53351710DAEA25D51ADFDB00E36889BA3CC275D6FB4892BB33276
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_70485cd76600de927e78b8bfc3bddd6c_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-22_70485cd76600de927e78b8bfc3bddd6c_elex_luca-stealer_mespinoza_njrat_remcos

.exe 2.7MB

2026-10-22_70485cd76600de927e78b8bfc3bddd6c_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH c6e978600e6511afa560b2aa432e6a85
SHA256 60406247ec5b68dda7dbc0823d155958d55a47cb41d5fa177c0ec5e58dfdc27a
MD5 70485cd76600de927e78b8bfc3bddd6c
SHA1 5c794a80e1ed5a26ed3e4203284cce49e18e9fab
SHA512 d65928747c31c64cc343134a5e16667e113cda58319e0bdb9ccf391e312864a560c9aa94adce327a45fef6fbdfc3814a024c500f00d4ac9d6780be7ca0fbf2b1
SSDEEP 49152:QmY2F8kU1HYQ0n2X3coeZTh37+tgauhwbR3P8wT82sOH8VuOJdJqC4If:QmAcBWgaPJYOH88OJdJLf
TLSH
T16AD502213AE1D136C53351710DAEA25D51ADFDB00E36889BA3CC275D6FB4892BB33276
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

200368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\CR Log Transport\public\CRLogTransport\2.0\public\binary\Win\x86\Release\CRLogTransport.pdb

shlwapi

PathIsDirectoryW PathFileExistsW

wininet

InternetConnectW InternetCloseHandle InternetCrackUrlW HttpQueryInfoW InternetSetOptionW InternetOpenW InternetSetStatusCallbackW InternetQueryDataAvailable InternetQueryOptionW HttpOpenRequestW InternetSetOptionA InternetReadFile HttpSendRequestW

kernel32

GetACP MultiByteToWideChar WideCharToMultiByte CompareFileTime FindFirstFileW FindNextFileW FindClose CreateFileW FreeEnvironmentStringsW DeleteFileW CloseHandle GetProcAddress MoveFileExW FreeLibrary GetEnvironmentStringsW GetFileTime GetTimeFormatW ReadFile GetModuleFileNameW HeapFree InitializeCriticalSectionEx HeapSize Sleep HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap GetSystemTimeAsFileTime GetDateFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW SetStdHandle GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP SetEnvironmentVariableA SetEnvironmentVariableW GetLastError EnterCriticalSection GetConsoleMode GetConsoleCP FlushFileBuffers GetCommandLineW GetStringTypeW WriteConsoleW LeaveCriticalSection EncodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead SetEndOfFile SetFilePointerEx GetModuleHandleA AreFileApisANSI LocalFree FormatMessageA OutputDebugStringW RtlUnwind LoadLibraryExW GetFileType SetConsoleCtrlHandler ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA

shell32

SHGetFolderPathW SHCreateDirectoryExW

Name

.text

Size

391KB

Virtual Size

390KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_70485cd76600de927e78b8bfc3bddd6c_elex_luca-stealer_mespinoza_njrat_remcos

shlwapi

wininet

kernel32

shell32

generic