b41d902515ca5a7f909d5001d6a29e8eb1cb77690a399e416b14857fcc76b3f1

General

Target
2026-07-06_2fa00cb2160ae8200596bca794482fc3_amadey_elex_luca-stealer_njrat_remcos_smoke-loader
Size 21.1MB
Sample260707-e8byzshy8x
SHA256 b41d902515ca5a7f909d5001d6a29e8eb1cb77690a399e416b14857fcc76b3f1
MD5 2fa00cb2160ae8200596bca794482fc3
SHA1 a9dee7c8b7ec7dd9a2a08f0c993f938f78dd4d22
SHA512 167b919b0d61379bc0b67acdd1a859d378368fc33b7bd2d8437a242419c92ee7d2eae40ce278724c41ba3bd3cc1406fc3ba462f0f1a52f6bcc7c4b22527ac9af
SSDEEP 393216:DbDDCgvsCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrW:DjLsCpQpbQ1tBj1gR0SP53tRvlLpM2K
TLSH
T1BD273322B5B45136E2B21633AD79D230BA3CBB6417908A4F93D86C693D759C0A7F3317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-06_2fa00cb2160ae8200596bca794482fc3_amadey_elex_luca-stealer_njrat_remcos_smoke-loader
- Size 21.1MB
- SHA256 b41d902515ca5a7f909d5001d6a29e8eb1cb77690a399e416b14857fcc76b3f1
- MD5 2fa00cb2160ae8200596bca794482fc3
- SHA1 a9dee7c8b7ec7dd9a2a08f0c993f938f78dd4d22
- SHA512 167b919b0d61379bc0b67acdd1a859d378368fc33b7bd2d8437a242419c92ee7d2eae40ce278724c41ba3bd3cc1406fc3ba462f0f1a52f6bcc7c4b22527ac9af
- SSDEEP 393216:DbDDCgvsCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrW:DjLsCpQpbQ1tBj1gR0SP53tRvlLpM2K
- TLSH
  T1BD273322B5B45136E2B21633AD79D230BA3CBB6417908A4F93D86C693D759C0A7F3317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation ransomware revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2