2026-11-12_55bdf0eb83853b91167b5033215b9421_adposhel_amadey_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_55bdf0eb83853b91167b5033215b9421_adposhel_amadey_elex_luca-stealer_medusalocker_njrat_remcos
Size 2.5MB
Sample261113-da81dsfv3m
SHA256 506066b0c4fe0b91c25472c9a045424bc697ad59d29360b7a41e06e633b6ec1f
MD5 55bdf0eb83853b91167b5033215b9421
SHA1 98873997258a82684355349a6b0098623c6a3386
SHA512 d2087e6670934b2be5dccf3e9fe2494a4e98549b141797f81d1a7e9030076e380d8ddb225848384ba8fc11098afc36a1b483b5d7c8c81b471607e76fb1f57b09
SSDEEP 49152:o0Jjd3XUd+YEf4spdUByJf6l5/+ng93oIkiuFSYAJ+9YxksCq:o0JR3kd64spzJikyeSYA89Nq
TLSH
T11DC59E51B215C036F16A11709938AFB58458BE371F76E4CB73842F296A726C3B932F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_55bdf0eb83853b91167b5033215b9421_adposhel_amadey_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-11-12_55bdf0eb83853b91167b5033215b9421_adposhel_amadey_elex_luca-stealer_medusalocker_njrat_remcos

.exe 2.5MB

2026-11-12_55bdf0eb83853b91167b5033215b9421_adposhel_amadey_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 06eae171c5c145f1dda432abe95a1b75
SHA256 506066b0c4fe0b91c25472c9a045424bc697ad59d29360b7a41e06e633b6ec1f
MD5 55bdf0eb83853b91167b5033215b9421
SHA1 98873997258a82684355349a6b0098623c6a3386
SHA512 d2087e6670934b2be5dccf3e9fe2494a4e98549b141797f81d1a7e9030076e380d8ddb225848384ba8fc11098afc36a1b483b5d7c8c81b471607e76fb1f57b09
SSDEEP 49152:o0Jjd3XUd+YEf4spdUByJf6l5/+ng93oIkiuFSYAJ+9YxksCq:o0JR3kd64spzJikyeSYA89Nq
TLSH
T11DC59E51B215C036F16A11709938AFB58458BE371F76E4CB73842F296A726C3B932F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

811350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\pay_group\c_expand\client\client\out\Release\c_expand.pdb

kernel32

Process32FirstW Process32NextW GetFileType GetFinalPathNameByHandleW GetLogicalDriveStringsW QueryDosDeviceW DuplicateHandle GetCurrentProcessId OpenProcess QueryFullProcessImageNameW CreateDirectoryW DeleteFileW GetFileSize SetLastError GetCurrentThreadId SetUnhandledExceptionFilter VirtualProtect IsBadReadPtr WritePrivateProfileStringW CopyFileW CreateProcessW GetExitCodeProcess TerminateProcess Sleep WaitForSingleObject CloseHandle GetVolumePathNamesForVolumeNameW GetTempPathW GetVolumeInformationW GetFileAttributesW GetFileAttributesA GetDiskFreeSpaceExW GetDiskFreeSpaceW FlushFileBuffers FindVolumeClose FindNextVolumeW FindFirstVolumeW DeleteVolumeMountPointW CreateFileW DeviceIoControl WriteFile SetFilePointerEx ReadFile FindResourceW CreateToolhelp32Snapshot SizeofResource LockResource LoadResource FreeLibrary FindResourceExW FindNextFileW FindFirstFileW FindClose MultiByteToWideChar GetPrivateProfileStringW GetProcAddress GetModuleHandleW GetModuleFileNameW GetSystemDirectoryW GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW WriteConsoleW SetEndOfFile SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale WideCharToMultiByte VirtualFree VirtualAlloc GetSystemWindowsDirectoryW LoadLibraryW GetTickCount HeapDestroy GetLastError RaiseException DecodePointer GetFullPathNameW GetACP GetStdHandle GetStringTypeW FormatMessageW QueryPerformanceCounter QueryPerformanceFrequency TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent LoadLibraryExA LocalFree ReleaseMutex CreateMutexW ReleaseSemaphore GetFileSizeEx GetStartupInfoW SetEvent GetCommandLineW CreateFileMappingW MapViewOfFileEx UnmapViewOfFile LoadLibraryExW lstrcmpiW WaitForMultipleObjects UnhandledExceptionFilter WaitForSingleObjectEx OpenFileMappingW MapViewOfFile WaitNamedPipeW WaitForMultipleObjectsEx CreateSemaphoreW InterlockedCompareExchange FreeResource GetVersionExW lstrcmpA SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue lstrcmpiA CreateFileA RtlUnwind ExitThread GetModuleHandleExW GetFileAttributesExW GetConsoleCP GetConsoleMode GetTimeZoneInformation ExitProcess

user32

CharNextW KillTimer SetTimer PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadCursorW FindWindowW SetWindowLongW GetWindowLongW ShowWindow DestroyWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW ExitWindowsEx RegisterWindowMessageW SendMessageTimeoutW PostThreadMessageW SendMessageW WaitForInputIdle wsprintfW UnregisterClassW

advapi32

RegSetValueExW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA SetSecurityDescriptorDacl GetTokenInformation RegQueryInfoKeyW InitializeSecurityDescriptor QueryServiceStatus RegDeleteValueW StartServiceW OpenServiceW OpenSCManagerW ControlService CloseServiceHandle LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegGetValueW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW ShellExecuteExW SHChangeNotify SHCreateDirectoryExW ord680

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateGuid CoCreateInstance StringFromGUID2 CoUninitialize CoInitialize CoSetProxyBlanket

oleaut32

VarUI4FromStr SysFreeString VariantClear SysAllocString

shlwapi

PathRemoveFileSpecW SHSetValueA SHGetValueA PathIsDirectoryW PathCombineW StrStrIA StrCmpIW SHSetValueW SHGetValueW PathRenameExtensionW PathFindFileNameW PathAppendW PathFileExistsW StrCmpNIW StrTrimA StrStrIW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

fltlib

FilterVolumeInstanceFindNext FilterVolumeInstanceFindClose FilterVolumeInstanceFindFirst

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_55bdf0eb83853b91167b5033215b9421_adposhel_amadey_elex_luca-stealer_medusalocker_njrat_remcos

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

fltlib

wininet

iphlpapi

crypt32

wintrust

urlmon

generic