2026-11-12_5675752d4a564bc812e1afc8911bd918_amadey_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_5675752d4a564bc812e1afc8911bd918_amadey_elex_luca-stealer_medusalocker_njrat_remcos
Size 2.2MB
Sample261113-c8rnbsfv2l
SHA256 88d8c7c3c7079e703df9df96dfee4a42f0c5eef5792f19876c0990c0cb1ba7bc
MD5 5675752d4a564bc812e1afc8911bd918
SHA1 85632a9fb32994cfb5540f2de62dfe1efe53ecd1
SHA512 dbfbf17b5b0710900e053751f34b7f0512048e7a4aabd467383e77a31df58270ee3d440f5c90f5ff9d6f7937880bb318c9954ad74824bb94010be0d36be66eb6
SSDEEP 49152:p/wOoIekWqbJIqdHN44jz3J+3S9OSLOLbr7Lbr7Lbr7LbrJ32d:pYOosb+qg4UxS3
TLSH
T1C2B55B52F41B9CA7E6650CF1293DB62523D8E969776444CB63E02B6A04712C3393FE3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-12_5675752d4a564bc812e1afc8911bd918_amadey_elex_luca-stealer_medusalocker_njrat_remcos

.exe 2.2MB

2026-11-12_5675752d4a564bc812e1afc8911bd918_amadey_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH c445f121416ee02c6825d7c4b720e045
SHA256 88d8c7c3c7079e703df9df96dfee4a42f0c5eef5792f19876c0990c0cb1ba7bc
MD5 5675752d4a564bc812e1afc8911bd918
SHA1 85632a9fb32994cfb5540f2de62dfe1efe53ecd1
SHA512 dbfbf17b5b0710900e053751f34b7f0512048e7a4aabd467383e77a31df58270ee3d440f5c90f5ff9d6f7937880bb318c9954ad74824bb94010be0d36be66eb6
SSDEEP 49152:p/wOoIekWqbJIqdHN44jz3J+3S9OSLOLbr7Lbr7Lbr7LbrJ32d:pYOosb+qg4UxS3
TLSH
T1C2B55B52F41B9CA7E6650CF1293DB62523D8E969776444CB63E02B6A04712C3393FE3E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

e8:99:7f:2c:f2:2c:a6:da:a5:43:1f:11:73:a3:88:b2:95:dc:fe:bf:15:fe:63:59:65:10:b7:da:bb:ba:7b:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100MA6A4X3AX6,CN=成都鲁易科技有限公司,O=成都鲁易科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c12e59b9be5b79de5a4a9e5ba9ce696b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Nov 2, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

02:4c:2f:ae:66:07:1a:97:26:36:be:e7:0c:e9:e5:1d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 31, 2025 - Oct 29, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

739774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\pay_group\start_menu_pro\start_menu_pro_client\start_menu_pro_client\out\Release\start_menu_pro.pdb

kernel32

Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetProcessImageFileNameW K32GetModuleFileNameExW lstrlenW GetSystemWindowsDirectoryW FreeResource LoadLibraryExW DeviceIoControl QueryDosDeviceW GetVolumeInformationW GetLongPathNameW GetLogicalDriveStringsW GetFileAttributesExW GetDriveTypeW CreateFileW GetWindowsDirectoryW GetSystemDirectoryW IsBadReadPtr VirtualProtect CreateMutexW SetUnhandledExceptionFilter GetCurrentProcess CopyFileW FindResourceW SizeofResource LockResource LoadResource FindResourceExW DeleteFileW SetLastError GetFileAttributesW GetCurrentThreadId GetExitCodeProcess GetCurrentProcessId ReleaseSemaphore MultiByteToWideChar FindNextFileW FindFirstFileW FindClose GetModuleHandleW GetTickCount64 OpenProcess Sleep OpenMutexW WaitForSingleObject CloseHandle GetModuleFileNameW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW LoadLibraryW GetProcAddress FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW WriteConsoleW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleCP GetFileType ExitThread RtlUnwind CreateFileA lstrcmpiA lstrcmpA QueryDepthSList InterlockedFlushSList FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait CreateTimerQueue OpenFileMappingW AssignProcessToJobObject GetVersionExW UnregisterWaitEx RegisterWaitForSingleObject OutputDebugStringA GetCommandLineW GetModuleHandleExW GetModuleHandleExA RaiseException DecodePointer WideCharToMultiByte GetStringTypeW FormatMessageW TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter QueryPerformanceFrequency DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetNativeSystemInfo CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA ReleaseMutex LocalFree ReadFile WriteFile WaitNamedPipeW SetEvent WaitForMultipleObjectsEx CreateSemaphoreW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateProcessW GetStartupInfoW WaitForMultipleObjects GetFileSizeEx CreateFileMappingW MapViewOfFile UnmapViewOfFile UnhandledExceptionFilter TerminateProcess InterlockedExchange InterlockedCompareExchange CreateThread SetThreadPriority ResumeThread GetStdHandle FlushFileBuffers SetEndOfFile SetFilePointer SetFilePointerEx GetModuleHandleA

user32

CallWindowProcW UnregisterClassW RegisterWindowMessageW RegisterClassExW GetClassInfoExW ShowWindow SetForegroundWindow MonitorFromWindow SendMessageTimeoutW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW IsWindow DestroyWindow SetTimer GetWindowRect LoadCursorW GetMonitorInfoW KillTimer wsprintfW WaitForInputIdle PostThreadMessageW WaitMessage CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx GetWindowLongW SetWindowLongW FindWindowW GetWindowThreadProcessId ChangeWindowMessageFilterEx IsWindowVisible IsIconic GetClassNameW GetAncestor SendMessageW SetWinEventHook FindWindowExW GetIconInfo DestroyIcon GetSystemMetrics PeekMessageW DispatchMessageW TranslateMessage GetMessageW UnhookWindowsHookEx SetWindowsHookExW UnhookWinEvent

gdi32

DeleteObject GetObjectW

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl OpenProcessToken GetTokenInformation RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegGetValueW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA CreateProcessAsUserW RegCreateKeyExW RegSetValueExW

shell32

ShellExecuteExW SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetFileInfoW SHParseDisplayName SHGetKnownFolderPath ShellExecuteW SHGetDesktopFolder

ole32

CoCreateGuid CoInitialize CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance

shlwapi

PathCombineW SHGetValueW SHSetValueW PathIsDirectoryW StrStrIA SHGetValueA SHSetValueA StrTrimA StrCmpIW StrCmpNIW StrStrIW PathFileExistsW PathFindFileNameW PathMatchSpecW PathIsUNCW PathAppendW PathRemoveFileSpecW PathRenameExtensionW StrRetToBufW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

dwmapi

DwmGetWindowAttribute

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

gdiplus

GdiplusShutdown GdiplusStartup GdipAlloc GdipFree GdipCloneImage GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromHICON GdipBitmapLockBits GdipBitmapUnlockBits GdipDisposeImage GdipSaveImageToFile GdipGetImagePixelFormat GdipGetImageEncodersSize GdipGetImageEncoders GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromScan0

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

crypt32

CertGetNameStringW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

generic

count=3, id=261, version=27031,

count=26, id=241, version=40116,

count=178, id=243, version=40116,

count=34, id=242, version=40116,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=25, id=259, version=26706,

count=7, id=261, version=27032,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=12, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=135, id=261, version=26706,

count=38, id=260, version=26706,

count=3, id=206, version=65501,

count=2, id=208, version=65501,

count=39, id=203, version=65501,

count=431, id=1, productName=Unmarked objects,

count=58, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,