2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader
Size 1.1MB
Sample260531-pz318agy21
SHA256 44f1b9d9fd19b9d69f0ae72e8d7f2917690643d4f60e6d9e695d5544dc8bc231
MD5 23009bd4e83ddcc245b65b9e0c157e96
SHA1 deb022b9a6fcd91297d9633f6bc6775fc3818ac8
SHA512 8b6e712581a4254875f0b5aab0b106bee49f392006630f3f86c916657d16dfe79d768c51e517ab3fa05318ec0b05cd72a9c8d839c3f6f159673d2fc2a004022b
SSDEEP 24576:so7w8UvNrKztqlxo8J8a3v1x37MFifLYCw:N79MlxRJ8yWFi0
TLSH
T15E45AE93FD49D061D5E615F0C8E792E2473B7D600D38809B725A332EE8386DC9E1AF99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 1.1MB

2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 2a6ded2ad9f9496479a3075981c1d9d8
SHA256 44f1b9d9fd19b9d69f0ae72e8d7f2917690643d4f60e6d9e695d5544dc8bc231
MD5 23009bd4e83ddcc245b65b9e0c157e96
SHA1 deb022b9a6fcd91297d9633f6bc6775fc3818ac8
SHA512 8b6e712581a4254875f0b5aab0b106bee49f392006630f3f86c916657d16dfe79d768c51e517ab3fa05318ec0b05cd72a9c8d839c3f6f159673d2fc2a004022b
SSDEEP 24576:so7w8UvNrKztqlxo8J8a3v1x37MFifLYCw:N79MlxRJ8yWFi0
TLSH
T15E45AE93FD49D061D5E615F0C8E792E2473B7D600D38809B725A332EE8386DC9E1AF99
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\changcal\Desktop\source\SystemEventUtility\Release\HPWMISVC.pdb

kernel32

SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx GetCommandLineW OpenProcess Process32NextW ProcessIdToSessionId Process32FirstW CreateToolhelp32Snapshot WTSGetActiveConsoleSessionId WriteFile GetLocalTime GetSystemTime CreateDirectoryW Sleep GetCurrentThread GetCurrentProcess GetCurrentThreadId lstrcmpiW GetModuleFileNameW CreateFileW CloseHandle DecodePointer DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW WriteConsoleW FindFirstFileExW FindClose HeapReAlloc HeapSize IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead EncodePointer RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetACP HeapFree HeapAlloc GetFileType LCMapStringW

user32

GetMessageW PostThreadMessageW CharNextW DispatchMessageW

advapi32

RegQueryValueExW RevertToSelf ImpersonateLoggedOnUser GetUserNameW RegDisablePredefinedCacheEx CreateProcessAsUserW SetTokenInformation DuplicateTokenEx RegCreateKeyW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW DeleteService QueryServiceStatus ControlService CreateServiceW CloseServiceHandle OpenServiceW OpenSCManagerW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation OpenThreadToken OpenProcessToken SetSecurityDescriptorGroup SetSecurityDescriptorOwner InitializeSecurityDescriptor CopySid GetLengthSid IsValidSid RegSetValueExW RegOpenKeyExW RegCloseKey

shell32

ShellExecuteW SHGetSpecialFolderPathW

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity

oleaut32

VariantClear SafeArrayCreateVector SafeArrayPutElement VariantInit SafeArrayDestroy SafeArrayGetElement

shlwapi

PathAppendW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

Name

.text

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

426KB

Virtual Size

426KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

userenv

generic