2026-11-10_b7ccf21f7b837f081718db64cc4d50c4_elex_floxif_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-10_b7ccf21f7b837f081718db64cc4d50c4_elex_floxif_luca-stealer_mespinoza_njrat_remcos
Size 528KB
Sample261111-13xt6acc75
SHA256 fef0f77c75f58aabb94b07f8eb68f74728c9d41fdb0dce6ad1aeb0c2f99997ce
MD5 b7ccf21f7b837f081718db64cc4d50c4
SHA1 93a9da1546d3f3b57ba05edf4c4ab600a9a97056
SHA512 85bed45f0afd1d81e420dce4d7044ac16095d2dd8e9254af409ac29595946bcf0c1d1c27c71fc00c2df1085266701f7c6129684d994acd378150ca61ad197c49
SSDEEP 12288:ZacC1NbWul8lJfecrXVnh0DdNsWm4zf4Y1BjvrEH70V:ZKVGcmnh0RNsx4zf4Y7rEH70V
TLSH
T126B4AE107552C276E4A186712D3DDB2B24A9F9780B6609CBF3D41E2D1EB85C32B32F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-10_b7ccf21f7b837f081718db64cc4d50c4_elex_floxif_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-11-10_b7ccf21f7b837f081718db64cc4d50c4_elex_floxif_luca-stealer_mespinoza_njrat_remcos

.exe 528KB

2026-11-10_b7ccf21f7b837f081718db64cc4d50c4_elex_floxif_luca-stealer_mespinoza_njrat_remcos

IMPHASH fccd19cd985cbe93ccbe9a9931a22e5b
SHA256 fef0f77c75f58aabb94b07f8eb68f74728c9d41fdb0dce6ad1aeb0c2f99997ce
MD5 b7ccf21f7b837f081718db64cc4d50c4
SHA1 93a9da1546d3f3b57ba05edf4c4ab600a9a97056
SHA512 85bed45f0afd1d81e420dce4d7044ac16095d2dd8e9254af409ac29595946bcf0c1d1c27c71fc00c2df1085266701f7c6129684d994acd378150ca61ad197c49
SSDEEP 12288:ZacC1NbWul8lJfecrXVnh0DdNsWm4zf4Y1BjvrEH70V:ZKVGcmnh0RNsx4zf4Y7rEH70V
TLSH
T126B4AE107552C276E4A186712D3DDB2B24A9F9780B6609CBF3D41E2D1EB85C32B32F63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

21:33:1a:50:d0:94:39:91:dc:e0:03:36:65:c3:bb:3d:d3:79:26:c9:2e:7a:70:68:54:f0:82:5e:73:7a:a2:59

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

Chains

Jun 15, 2026

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

Serial Number

01:2e:31:1d:0f:e1:58:42:73:1a:e7:34:d7:aa:49:c1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 17, 2025 - Sep 16, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

223607

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\ESP_src\Win\ijs_win\ESP\vc12\Release\IJPLMSVC.pdb

shlwapi

PathFileExistsW PathQuoteSpacesW PathIsDirectoryW PathAppendW

kernel32

GetLocalTime SetEvent GetSystemDefaultLangID GetModuleFileNameW Sleep GetSystemDefaultLCID CreateEventW GetExitCodeProcess GetSystemTimeAsFileTime GetConsoleCP HeapSize SetStdHandle FindNextFileW FindFirstFileW FindClose WideCharToMultiByte MultiByteToWideChar WritePrivateProfileStringW GetPrivateProfileStringW GetCurrentProcess GetModuleHandleW GetLastError CreateMutexW CloseHandle LoadLibraryW SetCurrentDirectoryW GetCurrentDirectoryW SetLastError LocalFree GetSystemDirectoryW GetVersionExW GetFileAttributesW lstrcmpW lstrcmpiW lstrcpyW FreeLibrary GetProcAddress WaitForSingleObject GlobalFree GlobalAlloc lstrlenW GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW CreateFileW OpenMutexW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetProcessHeap EnumSystemLocalesW GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetCPInfo InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException LoadLibraryExW HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP GetFileType IsValidLocale GetUserDefaultLCID

winspool.drv

ClosePrinter GetPrinterDriverW EnumPrintersW XcvDataW OpenPrinterW GetPrinterW

advapi32

ReportEventW DeregisterEventSource RegisterEventSourceW DuplicateTokenEx CreateProcessAsUserW RegisterServiceCtrlHandlerExW DeleteService QueryServiceStatus ControlService StartServiceW ChangeServiceConfig2W CreateServiceW SetServiceStatus UnlockServiceDatabase CloseServiceHandle ChangeServiceConfigW OpenServiceW LockServiceDatabase OpenSCManagerW StartServiceCtrlDispatcherW RegOpenKeyW RegEnumValueW RegEnumKeyW ImpersonateLoggedOnUser OpenProcessToken RegCreateKeyExW RegOpenCurrentUser RevertToSelf RegSetValueExW RegCloseKey RegQueryValueExW RegOpenKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHCreateDirectoryExW SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitialize

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_b7ccf21f7b837f081718db64cc4d50c4_elex_floxif_luca-stealer_mespinoza_njrat_remcos

PE Signature issue

shlwapi

kernel32

winspool.drv

advapi32

shell32

ole32

userenv

wtsapi32

generic