2026-10-26_8ec3412eef178fd790d4cb5b1236cfc5_elex_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_8ec3412eef178fd790d4cb5b1236cfc5_elex_luca-stealer_mespinoza_njrat_remcos
Size 1.2MB
Sample261027-n8pphs1v2r
SHA256 26e5e0d1753a17c9b74c40343826ccfe620ed6959e4e5c5de511dafa089c8e47
MD5 8ec3412eef178fd790d4cb5b1236cfc5
SHA1 48c00c9069b870d58a1f3f650e27e113d5b42933
SHA512 63bec18cadc92f832ae3bdac367fdf142c4ea51f5b53593794cff2af2377e5b14e5c486bc0396ed38e76217f2353d671d9c0aec763890ee892cd709fa80eee13
SSDEEP 24576:tId9wGmPdsfkP3zQa/JSUIAGjAXTF3PLNiil4E74rQY9e4:tfWI3zpJSTAG8h3PLNxL4rQr
TLSH
T15C45F1207742C432DAB209721E788A5A047DFF300F76A6CF67C8766ED9B01D15A35F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_8ec3412eef178fd790d4cb5b1236cfc5_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-26_8ec3412eef178fd790d4cb5b1236cfc5_elex_luca-stealer_mespinoza_njrat_remcos

.exe 1.2MB

2026-10-26_8ec3412eef178fd790d4cb5b1236cfc5_elex_luca-stealer_mespinoza_njrat_remcos

IMPHASH 2f0381ca527366dde0bbef4148ecb54a
SHA256 26e5e0d1753a17c9b74c40343826ccfe620ed6959e4e5c5de511dafa089c8e47
MD5 8ec3412eef178fd790d4cb5b1236cfc5
SHA1 48c00c9069b870d58a1f3f650e27e113d5b42933
SHA512 63bec18cadc92f832ae3bdac367fdf142c4ea51f5b53593794cff2af2377e5b14e5c486bc0396ed38e76217f2353d671d9c0aec763890ee892cd709fa80eee13
SSDEEP 24576:tId9wGmPdsfkP3zQa/JSUIAGjAXTF3PLNiil4E74rQY9e4:tfWI3zpJSTAG8h3PLNxL4rQr
TLSH
T15C45F1207742C432DAB209721E788A5A047DFF300F76A6CF67C8766ED9B01D15A35F6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

134561

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\Lightshot_exe.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

FreeLibrary FindFirstFileW SetLastError FindNextFileW GetCurrentProcess GetModuleFileNameW FindClose MultiByteToWideChar GetTickCount CompareStringW lstrlenW GetVersionExW GetLocalTime lstrcmpiW MulDiv InterlockedDecrement InterlockedIncrement LoadLibraryExW GetComputerNameW LCMapStringW GetStringTypeW GetFileType GetACP GetStdHandle GetModuleHandleExW ExitProcess QueryPerformanceFrequency LoadLibraryW RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GlobalFree ResetEvent SetEvent CreateEventW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetConsoleCP LeaveCriticalSection EnterCriticalSection WideCharToMultiByte GetModuleHandleW GetFileSize GetProcAddress FindResourceW LoadResource FindResourceExW LockResource ReleaseMutex GetCurrentThreadId CreateFileW CreateMutexW WriteFile SizeofResource ReadFile GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc CreateThread RaiseException CloseHandle HeapReAlloc TerminateThread GetLastError HeapSize WaitForSingleObject InitializeCriticalSectionAndSpinCount HeapFree GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW

user32

PostQuitMessage DialogBoxParamW SetTimer MoveWindow PostMessageW RegisterWindowMessageW GetMessageW DispatchMessageW TranslateMessage KillTimer MapVirtualKeyW RemoveMenu LoadIconW DestroyMenu GetKeyNameTextW EnableWindow GetAsyncKeyState GetWindowLongW GetWindowTextLengthW DefWindowProcW CallWindowProcW GetWindow GetWindowRect RegisterHotKey DestroyIcon GetActiveWindow GetSubMenu TrackPopupMenu MonitorFromPoint LoadMenuW UnregisterHotKey GetClassInfoExW RegisterWindowMessageA RegisterClassExW MessageBoxW GetFocus DestroyWindow GetDC SetWindowPos MonitorFromWindow FillRect CreateWindowExW ScreenToClient EndDialog SetWindowTextW IsWindow OffsetRect GetCapture GetMonitorInfoW GetDlgCtrlID MapWindowPoints DrawFocusRect GetSysColor IsWindowEnabled SetFocus CharNextW LoadCursorW GetClassNameW SetCapture SetCursor SetRectEmpty SetWindowLongW GetClientRect GetDlgItem DrawTextW SystemParametersInfoW GetParent PtInRect UpdateWindow ReleaseCapture InvalidateRect GetCursorPos BeginPaint EndPaint GetWindowTextW InsertMenuItemW SetMenuItemInfoW TrackMouseEvent ReleaseDC GetSystemMetrics GetWindowDC SendMessageW UnregisterClassW SetForegroundWindow

gdi32

SelectObject CreateFontW GetDeviceCaps DeleteObject GetObjectW CreateFontIndirectW CreateSolidBrush SetBkColor SetBkMode GetStockObject SetTextColor

advapi32

RegQueryValueExW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW CryptDestroyKey CryptEncrypt CryptDecrypt CryptSetKeyParam CryptImportKey CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegDeleteValueW RegEnumValueW RegCloseKey

shell32

ShellExecuteW Shell_NotifyIconW

ole32

CoTaskMemRealloc CoTaskMemFree CoUninitialize CoTaskMemAlloc CoInitialize StringFromGUID2 CoCreateGuid CoCreateInstance

oleaut32

VarUI4FromStr SysFreeString SysAllocString

shlwapi

PathFileExistsW PathCanonicalizeW PathAppendW PathRemoveFileSpecW PathAddBackslashW PathIsDirectoryW

comctl32

DestroyPropertySheetPage PropertySheetW CreatePropertySheetPageW

wininet

InternetQueryOptionW

Name

.text

Size

226KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

308B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

774KB

Virtual Size

776KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_8ec3412eef178fd790d4cb5b1236cfc5_elex_luca-stealer_mespinoza_njrat_remcos

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wininet

generic