2025-04-04_0ed51730528e3b03175a489f8fe02ec2_amadey_black-basta_luca-stealer_remcos_smoke-loader

Sharing

Copy URL

Twitter E-mail

General

Target

2025-04-04_0ed51730528e3b03175a489f8fe02ec2_amadey_black-basta_luca-stealer_remcos_smoke-loader
Size

3.0MB
MD5

0ed51730528e3b03175a489f8fe02ec2
SHA1

dde2b78fe9dd1a6635ff2ac4b9c98b2b5017dd02
SHA256

617b523ec51b9b4b6ca362ee07706d652c1c4d938a9946053bab553a7998e0a9
SHA512

a320805505457c4716678b00854bbc6832b98e6d5db37b50018047a0110b6b3e192b8175ac39dcb5c731cd520bae4e441c24153f6fc39c35875c9eb57eaddd82
SSDEEP

49152:R0/3Zm9HFwLWo9XiMNZTbOMT5mFbO8H8zE8DTGZf7rNl:RMelGWGyMzOMtUOY8w5F7rD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-04-04_0ed51730528e3b03175a489f8fe02ec2_amadey_black-basta_luca-stealer_remcos_smoke-loader

Files

2025-04-04_0ed51730528e3b03175a489f8fe02ec2_amadey_black-basta_luca-stealer_remcos_smoke-loader
.exe windows:5 windows x86 arch:x86

a6fdbbe6728ed974485421ff706620a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
TrackMouseEvent
GetMonitorInfoW
MonitorFromWindow
SetRect
ClientToScreen
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadImageW
CreateIconFromResource
LoadBitmapW
GetCapture
GetSystemMetrics
CallNextHookEx
GetWindow
GetParent
UnhookWindowsHookEx
MapWindowPoints
GetWindowRect
GetClientRect
GetActiveWindow
GetDlgItem
SetWindowPos
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetFocus
SetFocus
DestroyIcon
CharNextW
PtInRect
EqualRect
IsRectEmpty
UnionRect
IntersectRect
CopyRect
SetCursor
KillTimer
SetTimer
DestroyWindow
IsWindow
DestroyCursor
LoadCursorW
SetForegroundWindow
UnregisterClassW
GetKeyState
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
GetClassNameW
SystemParametersInfoW
ScreenToClient
GetCursorPos
InvalidateRect
EndPaint
BeginPaint
SetWindowsHookExW
GetSysColor
SetWindowLongW
UpdateWindow
ReleaseCapture
SetCapture
EnableMenuItem
SendMessageW
SetWindowTextW
ShowWindow
PostQuitMessage
GetWindowLongW
PostMessageW

ole32

CreateBindCtx
OleLockRunning
CoCreateGuid
CoInitialize
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoUninitialize

shlwapi

PathFileExistsW
StrToIntExW

gdiplus

GdipImageGetFrameDimensionsList
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipSaveImageToFile
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdiplusStartup
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdiplusShutdown
GdipCloneImage
GdipAlloc

gdi32

CreateSolidBrush
CreateFontIndirectW
GetDeviceCaps
CreateBitmap
EnumFontsW
BitBlt
SetTextAlign
GetTextMetricsW
ExtTextOutW
GetTextFaceW
GdiFlush
GetStockObject
Rectangle
SetBkMode
SetTextColor
StretchBlt
GetCurrentObject
GetViewportOrgEx
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
CreateCompatibleDC
DeleteDC
DeleteObject
ExtCreateRegion
IntersectClipRect
SelectClipRgn
SelectObject
SetGraphicsMode
SetWorldTransform
CreateDIBSection
GetObjectW
SetViewportOrgEx
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx

kernel32

Sleep
GetFileSize
ReadFile
CloseHandle
GetTempPathW
CreateFileW
DeleteFileW
GetLastError
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
ReleaseMutex
CreateMutexW
CreateDirectoryW
FindFirstFileW
WriteFile
FindClose
lstrcpyW
FindNextFileW
CopyFileW
MoveFileExW
FreeLibrary
GetProcAddress
GlobalFree
LocalAlloc
LocalFree
OpenProcess
WaitForSingleObject
LoadLibraryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetTickCount
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FileTimeToSystemTime
GetLongPathNameW
GetSystemInfo
FormatMessageW
GetVersionExW
FlushInstructionCache
HeapCreate
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeResource
LockResource
SetLastError
LoadResource
SizeofResource
FindResourceW
GetFullPathNameW
GetLocalTime
GetVersionExA
GetSystemTime
LoadLibraryA
GetModuleHandleA
CreateThread
SetCurrentDirectoryW
GetModuleHandleW
GetModuleFileNameW
WideCharToMultiByte
OutputDebugStringA
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
InterlockedDecrement
InterlockedIncrement
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
GetCurrentDirectoryW
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExpandEnvironmentStringsW
WriteConsoleW
SetEndOfFile
CreateEventW
InterlockedCompareExchange
GetFileInformationByHandle
GetFileSizeEx
PeekNamedPipe
WaitForMultipleObjects
GetSystemDirectoryA
SleepEx
ResetEvent
SetEvent
VirtualAlloc
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
ExitProcess
GetModuleHandleExW
GetACP
GetStringTypeW
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
OutputDebugStringW
WaitForSingleObjectEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA

advapi32

RegOpenKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
DuplicateTokenEx
RevertToSelf
ImpersonateLoggedOnUser
RegEnumKeyW
RegOpenKeyW
OpenProcessToken
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
GetTokenInformation

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetFolderPathW
ShellExecuteExW

imm32

ImmGetContext
ImmAssociateContext
ImmReleaseContext
ImmDestroyContext
ImmCreateContext

oleaut32

SysFreeString
SysAllocString

ws2_32

gethostbyaddr
inet_ntoa
inet_addr
htonl
WSASetLastError
setsockopt
ntohs
htons
getsockopt
gethostbyname
getpeername
connect
bind
send
recv
WSAGetLastError
socket
closesocket
WSACleanup
WSAStartup
getservbyport
getservbyname
select
__WSAFDIsSet
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
getsockname

usp10

ScriptShape
ScriptItemize
ScriptFreeCache

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 485KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 60KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 530KB - Virtual size: 532KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a6fdbbe6728ed974485421ff706620a2

Headers

DLL Characteristics

File Characteristics

Imports

user32

ole32

shlwapi

gdiplus

gdi32

kernel32

advapi32

shell32

imm32

oleaut32

ws2_32

usp10

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 485KB - Virtual size: 484KB

.data Size: 60KB - Virtual size: 158KB

.gfids Size: 512B - Virtual size: 444B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 530KB - Virtual size: 532KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 485KB - Virtual size: 484KB

.data
Size: 60KB - Virtual size: 158KB

.gfids
Size: 512B - Virtual size: 444B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 530KB - Virtual size: 532KB