2026-11-01_d462c5447b3376ed424102e7ac151d8e_elex_luca-stealer_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_d462c5447b3376ed424102e7ac151d8e_elex_luca-stealer_njrat_remcos
Size 1021KB
Sample261102-jfz8bsed97
SHA256 e91fa5b66ede40f2b424d15f16864599076028a7ebaa703aee3c14355abacf15
MD5 d462c5447b3376ed424102e7ac151d8e
SHA1 d42430daac5b7557eb9afd80e58733e70f81f92f
SHA512 78a24276c3b58e5bc4f6469abe7457c67f9d6b5b230831d2171ef9b53dd6c15aac3d9bf070f498d5d2e3ea1d389918743275ca24bb279fba604aa84856849595
SSDEEP 24576:zijRb9rlzk4qdIiVf3Ym8RKYrzp5wHjcE4Uw8El:zob9rlzkndIR4Szp5QcE4wE
TLSH
T114251210B9E2C432D1B3093509F9E6F65A7EB9701B745B5FA3D81B3E4FB01816620EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_d462c5447b3376ed424102e7ac151d8e_elex_luca-stealer_njrat_remcos

File Explorer

2026-11-01_d462c5447b3376ed424102e7ac151d8e_elex_luca-stealer_njrat_remcos

.exe 1021KB

2026-11-01_d462c5447b3376ed424102e7ac151d8e_elex_luca-stealer_njrat_remcos

IMPHASH 95a40134eadf1da63f0c5b8c889eee5d
SHA256 e91fa5b66ede40f2b424d15f16864599076028a7ebaa703aee3c14355abacf15
MD5 d462c5447b3376ed424102e7ac151d8e
SHA1 d42430daac5b7557eb9afd80e58733e70f81f92f
SHA512 78a24276c3b58e5bc4f6469abe7457c67f9d6b5b230831d2171ef9b53dd6c15aac3d9bf070f498d5d2e3ea1d389918743275ca24bb279fba604aa84856849595
SSDEEP 24576:zijRb9rlzk4qdIiVf3Ym8RKYrzp5wHjcE4Uw8El:zob9rlzkndIR4Szp5QcE4wE
TLSH
T114251210B9E2C432D1B3093509F9E6F65A7EB9701B745B5FA3D81B3E4FB01816620EA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\jnks\workspace\K24_CXP_Production_Build\build2768\SxS\src\Release\hpUrlLauncher.pdb

user32

OpenDesktopW GetKeyState SendMessageCallbackW GetMessageW SetTimer RegisterWindowMessageW DestroyIcon MsgWaitForMultipleObjectsEx WaitForInputIdle GetAsyncKeyState OpenWindowStationW CloseWindowStation GetProcessWindowStation SetProcessWindowStation GetThreadDesktop SetThreadDesktop wsprintfW CloseDesktop ExitWindowsEx AllowSetForegroundWindow PeekMessageW MsgWaitForMultipleObjects GetSystemMetrics SystemParametersInfoW LoadIconW

shlwapi

PathRemoveFileSpecW PathFindFileNameW PathIsFileSpecW PathFindExtensionW

psapi

GetModuleFileNameExW EnumProcesses GetModuleBaseNameW EnumProcessModules

kernel32

MultiByteToWideChar EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetTickCount CreateFileW Sleep SetFilePointer WriteFile CloseHandle OutputDebugStringW GetCurrentThreadId QueryPerformanceCounter OpenProcess GetFileAttributesExW GetCommandLineW GetTempFileNameW GetLongPathNameW SearchPathW FormatMessageW LocalFree CreateMutexW WaitForSingleObject CreateFileMappingW MapViewOfFile ReleaseMutex UnmapViewOfFile SetLastError LoadLibraryW GetProcAddress FreeLibrary QueryPerformanceFrequency WideCharToMultiByte GetStringTypeW EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter GetCurrentProcessId GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RaiseException RtlUnwind LoadLibraryExW HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetStdHandle GetACP GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetProcessHeap FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CreateThread SetStdHandle ReadConsoleW WriteConsoleW HeapSize InitializeCriticalSection ExpandEnvironmentStringsW GetModuleFileNameW GetLastError CopyFileW SetFileAttributesW VerifyVersionInfoW ExitThread FreeLibraryAndExitThread SetUnhandledExceptionFilter MoveFileExW GetSystemDirectoryW DeviceIoControl GetFileTime SizeofResource LockResource LoadResource FindResourceExW FindResourceW GlobalFree GlobalUnlock GlobalLock ProcessIdToSessionId GlobalAlloc LocalAlloc GetUserDefaultLangID SetCurrentDirectoryW GetCurrentDirectoryW GetComputerNameExW DeleteFileW FindFirstFileW GetUserDefaultUILanguage GetSystemDefaultUILanguage GetVersionExW CreateProcessW GetTempPathW GetDiskFreeSpaceExW GetExitCodeThread GetExitCodeProcess TerminateThread OpenEventW ResetEvent SetEvent GetLocalTime GetSystemTime GetFileAttributesW OpenMutexW CreateDirectoryW GetShortPathNameW GetFileSizeEx CreateNamedPipeW ConnectNamedPipe DisconnectNamedPipe WaitNamedPipeW PeekNamedPipe GetEnvironmentVariableW TryEnterCriticalSection WaitForMultipleObjects CreatePipe GlobalMemoryStatusEx OpenFileMappingW FlushViewOfFile GetSystemDefaultLCID

advapi32

GetUserNameW CheckTokenMembership OpenProcessToken RegQueryInfoKeyW RegEnumValueW RegDeleteValueW RegSetValueExW RegDeleteKeyW RegQueryValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW RegEnumKeyExW

shell32

ShellExecuteW ExtractIconW SHGetSpecialFolderPathW ShellExecuteExW SHGetFolderPathW

ole32

CoInitialize CoUninitialize CLSIDFromString CoCreateInstance

oleaut32

SysAllocString SysFreeString

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

secur32

GetUserNameExW

Name

.text

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

804B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

769KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_d462c5447b3376ed424102e7ac151d8e_elex_luca-stealer_njrat_remcos

user32

shlwapi

psapi

kernel32

advapi32

shell32

ole32

oleaut32

version

secur32

generic