2026-07-03_6982464e5e88a363a2aa2eba1bfa89d8_amadey_elex_icedid_luca-stealer_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_6982464e5e88a363a2aa2eba1bfa89d8_amadey_elex_icedid_luca-stealer_njrat_remcos
Size 1.0MB
Sample260703-krdddad18z
SHA256 50eccd315e907c7c1ca4f217ef4836e27887f23ba59ab7ab12262931f304949c
MD5 6982464e5e88a363a2aa2eba1bfa89d8
SHA1 131aa46e88a452fd65386bcc19c053bdd5a30b90
SHA512 2386f50e569422e4df92e3e06ec54febd282f6ad723ecef2ac3829313a6a27619df71d9f09ec4e40f1b8b6d97fdb9d76bcf9f0fa0fa1a67b8d598edb26a72aa2
SSDEEP 12288:OEoEqsbFktfHiyxP5HwAqoip8vggCgRR8EzHswqfcOBi6EL6p4tfVztf+nb0MhHX:OEo3PxwAng1uROB/4tNztf+nYMBv/
TLSH
T128357D203AD18032C36316314EF8E23467AD7DA15F779A9F17D8962D3EB08815B2977B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-03_6982464e5e88a363a2aa2eba1bfa89d8_amadey_elex_icedid_luca-stealer_njrat_remcos

.exe 1.0MB

2026-07-03_6982464e5e88a363a2aa2eba1bfa89d8_amadey_elex_icedid_luca-stealer_njrat_remcos

IMPHASH 9db24e1e2b11c3d152ae276980d407db
SHA256 50eccd315e907c7c1ca4f217ef4836e27887f23ba59ab7ab12262931f304949c
MD5 6982464e5e88a363a2aa2eba1bfa89d8
SHA1 131aa46e88a452fd65386bcc19c053bdd5a30b90
SHA512 2386f50e569422e4df92e3e06ec54febd282f6ad723ecef2ac3829313a6a27619df71d9f09ec4e40f1b8b6d97fdb9d76bcf9f0fa0fa1a67b8d598edb26a72aa2
SSDEEP 12288:OEoEqsbFktfHiyxP5HwAqoip8vggCgRR8EzHswqfcOBi6EL6p4tfVztf+nb0MhHX:OEo3PxwAng1uROB/4tNztf+nYMBv/
TLSH
T128357D203AD18032C36316314EF8E23467AD7DA15F779A9F17D8962D3EB08815B2977B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

7f:5c:d4:5e:1a:fb:d8:76:24:ef:b5:c0:0e:d2:c5:f0:ec:62:0a:cd:30:56:92:62:23:c3:5c:58:f6:9a:48:31

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SIEMENS AG,O=SIEMENS AG,L=Nürnberg,ST=Bayern,C=DE

Chains

Oct 13, 2020

CN=SIEMENS AG,O=SIEMENS AG,L=Nürnberg,ST=Bayern,C=DE

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

03:ed:1c:8e:dd:e9:5c:ee:bf:af:b9:98:81:a6:85:43:00:10:11:7f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=SIEMENS AG,O=SIEMENS AG,L=Nürnberg,ST=Bayern,C=DE

Chains

Oct 13, 2020

CN=SIEMENS AG,O=SIEMENS AG,L=Nürnberg,ST=Bayern,C=DE

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=SIEMENS AG,O=SIEMENS AG,L=Nürnberg,ST=Bayern,C=DE

Serial Number

63:f3:73:c0:2c:5c:51:eb:ef:3b:02:21:a3:6e:c7:5d

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 3, 2020 - May 2, 2022

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

453890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\2078\20836\Binaries\Win32\Release\bin\Intermediate\Setup.pdb

gdi32

SelectObject SetBkMode SetTextColor TextOutW DeleteObject CopyMetaFileW CreateDCW GetDeviceCaps BitBlt CreateBitmap CreateCompatibleDC CreateDIBPatternBrushPt CreateHatchBrush CreatePen CreatePatternBrush CreateRectRgn CreateSolidBrush DeleteDC Escape ExcludeClipRect GetClipBox GetClipRgn GetCurrentPositionEx GetObjectType GetPixel GetStockObject GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo OffsetClipRgn PlayMetaFile PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectPalette SetBkColor SetMapperFlags SetGraphicsMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetStretchBltMode SetTextCharacterExtra SetTextAlign SetTextJustification PlayMetaFileRecord EnumMetaFile SetWorldTransform ModifyWorldTransform SetColorAdjustment StartDocW ArcTo PolyDraw SelectClipPath SetArcDirection ExtCreatePen GetObjectW MoveToEx ExtTextOutW PolyBezierTo PolylineTo SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CombineRgn CreateFontIndirectW CreateRectRgnIndirect GetMapMode PatBlt SetRectRgn DPtoLP GetTextExtentPoint32W CreateEllipticRgn Ellipse CreateDIBSection LPtoDP CreateCompatibleBitmap GetTextMetricsW EnumFontFamiliesExW GetCharWidthW StretchDIBits GetBkColor CreateFontW

gdiplus

GdipLoadImageFromFileICM GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipCreateSolidFill GdipCreateFromHWND GdipCreateFromHWNDICM GdipLoadImageFromFile GdipDeleteBrush GdipCloneBrush GdiplusShutdown GdiplusStartup GdipFree GdipDeleteGraphics GdipGetDC GdipAlloc GdipReleaseDC GdipFillRectangleI GdipDrawImageRectI GdipCreateBitmapFromScan0 GdipCreateFontFamilyFromName GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily

psapi

EnumProcessModules GetModuleBaseNameW EnumProcesses

kernel32

LockFile ReadFile SetEndOfFile SetFilePointer UnlockFile WriteFile DuplicateHandle LoadLibraryExW lstrcmpiW MoveFileW GetStringTypeExW GetThreadLocale GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime LocalFileTimeToFileTime SetFileAttributesW SetFileTime SystemTimeToFileTime GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GlobalDeleteAtom lstrcmpA lstrcmpW CompareStringA GetPrivateProfileIntW GlobalAddAtomW GetShortPathNameW GetSystemDirectoryW FreeResource GlobalFindAtomW CompareStringW InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc GlobalGetAtomNameW GetAtomNameW GlobalFlags SetErrorMode GetCurrentDirectoryW GetSystemDefaultUILanguage GetUserDefaultUILanguage VirtualProtect FindResourceExW GetDiskFreeSpaceW ReplaceFileW GetUserDefaultLCID ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind GetFullPathNameW GetFileSize FlushFileBuffers FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindNextFileW FindFirstFileW FindClose FileTimeToLocalFileTime MulDiv GlobalFree GlobalUnlock GlobalLock GlobalSize GlobalAlloc GetModuleHandleA SetLastError OutputDebugStringA GetACP WideCharToMultiByte LoadLibraryW OpenMutexW CreateMutexW lstrcpynW GetCurrentThread LocalAlloc GetLocaleInfoW ProcessIdToSessionId GetComputerNameW MoveFileExW GetDiskFreeSpaceExW GetTempFileNameW FormatMessageW GetTickCount GetCurrentProcessId LocalFree GlobalMemoryStatus GetVersionExW CreateProcessW LoadLibraryA GetExitCodeProcess GetCurrentProcess GetProcAddress FreeLibrary LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy DecodePointer GetSystemDefaultLCID MultiByteToWideChar CopyFileW DeleteFileW CreateFileW RemoveDirectoryW SetCurrentDirectoryW GetTempPathW WritePrivateProfileStringW GetPrivateProfileStringW GetEnvironmentVariableW GetModuleFileNameW FindResourceW OutputDebugStringW GetModuleHandleW CreateEventW CloseHandle SizeofResource LoadResource Sleep WaitForSingleObject SetEvent GetLastError TerminateThread CreateThread OpenProcess LockResource InterlockedPushEntrySList InterlockedFlushSList GetFullPathNameA ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA GetCommandLineW SetStdHandle GetFileType HeapQueryInformation GetStdHandle GetModuleFileNameA ExitProcess GetStringTypeW GetDateFormatW GetTimeFormatW LCMapStringW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetDriveTypeW GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetConsoleCtrlHandler GetVolumeInformationW EncodePointer WriteConsoleW

user32

SetPropW ShowScrollBar GetScrollRange SetScrollRange ScrollWindow RedrawWindow SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow TrackPopupMenuEx TrackPopupMenu SetMenu GetMenu GetCapture GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos RemovePropW GetWindowRect AdjustWindowRectEx MapWindowPoints LoadMenuW LockWindowUpdate GetDCEx SetRect SetParent GetSystemMenu UnionRect MapVirtualKeyW GetKeyNameTextW TranslateAcceleratorW GetDialogBaseUnits ReuseDDElParam UnpackDDElParam GetMenuBarInfo GetPropW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW InsertMenuItemW DefWindowProcW RegisterClassW CreateWindowExW IsWindow DestroyWindow ShowWindow SetTimer KillTimer ValidateRect GetWindowTextW GetCursorPos GetWindowLongW SetWindowLongW GetTopWindow GetWindowThreadProcessId GetWindow LoadCursorW LoadIconW LoadImageW LoadStringW SystemParametersInfoW MonitorFromPoint GetMonitorInfoW MessageBoxW UnregisterClassW MsgWaitForMultipleObjects GetShellWindow LoadAcceleratorsW BringWindowToTop IsRectEmpty SetWindowRgn DrawIcon MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamW GetMenuItemInfoW DestroyMenu WindowFromPoint ReleaseCapture SetCapture WaitMessage DestroyIcon InvalidateRect DeleteMenu CopyImage RealChildWindowFromPoint GetDesktopWindow IntersectRect InflateRect GetSysColorBrush EqualRect IsDialogMessageW SetWindowTextW ScrollWindowEx SendDlgItemMessageW IsDlgButtonChecked CheckRadioButton CheckDlgButton GetDlgItemTextW SetDlgItemTextW GetDlgItemInt CopyRect MoveWindow MonitorFromWindow WinHelpW GetScrollInfo PostThreadMessageW SetScrollInfo UnhookWindowsHookEx GetSystemMetrics SendDlgItemMessageA GetClientRect SetWindowPlacement GetWindowPlacement SetWindowPos IsChild IsMenu GetClassInfoExW GetClassInfoW CallWindowProcW SetRectEmpty OffsetRect GetParent UnregisterClassA GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount GetClassNameW GetClassLongW PtInRect CreatePopupMenu GetMessageTime GetMessagePos RegisterWindowMessageW GetWindowTextLengthW GetScrollPos SetScrollPos SetFocus SetCursor ShowOwnedPopups PostQuitMessage PostMessageW CallNextHookEx SetWindowsHookExW GetKeyState GetActiveWindow IsWindowVisible LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetFocus CharUpperW GetLastActivePopup IsWindowEnabled EnableWindow FillRect GetSysColor ScreenToClient ClientToScreen EndPaint BeginPaint ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW RemoveMenu AppendMenuW InsertMenuW SetDlgItemInt

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegCloseKey SetFileSecurityW GetFileSecurityW RegEnumKeyExW RegEnumValueW RegQueryValueW RegOpenKeyExW RegQueryValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW DuplicateTokenEx RegCreateKeyExW RegDeleteKeyW RegSetValueExW GetUserNameW OpenThreadToken InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetValueW RegDeleteValueW RegEnumKeyW

shell32

SHGetFolderPathW SHCreateDirectoryExW SHGetFileInfoW ShellExecuteExW DragFinish DragQueryFileW ShellExecuteW ExtractIconW SHAddToRecentDocs ord165

shlwapi

PathFindExtensionW PathFileExistsW PathRemoveExtensionW PathRemoveFileSpecW PathStripToRootW PathFindFileNameW PathIsUNCW

uxtheme

DrawThemeText DrawThemeBackground IsThemeBackgroundPartiallyTransparent DrawThemeParentBackground OpenThemeData CloseThemeData GetThemePartSize IsAppThemed

ole32

CoInitialize CreateStreamOnHGlobal PropVariantCopy CoInitializeEx CLSIDFromString CoDisconnectObject StringFromCLSID CoTaskMemAlloc CoTaskMemFree ReadClassStg WriteClassStg CoTreatAsClass CreateBindCtx WriteFmtUserTypeStg ReadFmtUserTypeStg OleDuplicateData ReleaseStgMedium OleRegGetUserType SetConvertStg CoUninitialize CoCreateGuid CoCreateInstance StringFromGUID2

oleaut32

VarBstrFromDec VarBstrFromDate VarBstrFromCy VarCyFromStr VarDateFromStr VariantCopy SafeArrayPtrOfIndex SafeArrayCopy SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayUnlock SafeArrayLock SafeArrayGetUBound SafeArrayGetElemsize SafeArrayGetDim VarDecFromStr SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor SafeArrayCreate SafeArrayAllocData SafeArrayAllocDescriptor VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysReAllocStringLen RegisterTypeLi LoadRegTypeLi LoadTypeLi VariantChangeType VariantClear VariantInit SysAllocStringLen SysAllocString SysAllocStringByteLen SysStringByteLen SysFreeString SafeArrayGetLBound SafeArrayRedim

mpr

WNetAddConnection3W

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

crypt32

CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CryptQueryObject CryptMsgGetParam CryptMsgClose CertCloseStore

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_6982464e5e88a363a2aa2eba1bfa89d8_amadey_elex_icedid_luca-stealer_njrat_remcos

gdi32

gdiplus

psapi

kernel32

user32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

mpr

wtsapi32

crypt32

wintrust

version

oleacc

generic