2026-07-09_236dd35ec57987ed00c9adddfd40ea0d_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_236dd35ec57987ed00c9adddfd40ea0d_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi
Size 188KB
Sample260709-whvrvae17j
SHA256 eeaa754bd9b5fea93bec1de8067fd955d2dfa05fba5473811c2a63afbc1c9e32
MD5 236dd35ec57987ed00c9adddfd40ea0d
SHA1 f36c847fb099f166c96670783d4372a3298509d4
SHA512 c375b449fd3a0f5f6865b8c471e4a60ad64b92f81b3b8cc439e64120af390abd7ec222f14d938170fd79085fe364a7e327d8d96b282ee83a405a75df8585fadd
SSDEEP 3072:dK8IyX/GVvQhH+xPdeblpcUqzOCx3gTfRgdmlhxTQhCHWqhcOpdGCH:dK83/G6+VylNqzeGa9IC1SOpI
TLSH
T12A14C30276D58125F1F73A30197496710E7BBCA09E38CA9E5398557D0FB3A80DD38BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_236dd35ec57987ed00c9adddfd40ea0d_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi

File Explorer

2026-07-09_236dd35ec57987ed00c9adddfd40ea0d_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi

.exe 188KB

2026-07-09_236dd35ec57987ed00c9adddfd40ea0d_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi

IMPHASH 85b7d4dcb4b574dd1bbe4544947006ed
SHA256 eeaa754bd9b5fea93bec1de8067fd955d2dfa05fba5473811c2a63afbc1c9e32
MD5 236dd35ec57987ed00c9adddfd40ea0d
SHA1 f36c847fb099f166c96670783d4372a3298509d4
SHA512 c375b449fd3a0f5f6865b8c471e4a60ad64b92f81b3b8cc439e64120af390abd7ec222f14d938170fd79085fe364a7e327d8d96b282ee83a405a75df8585fadd
SSDEEP 3072:dK8IyX/GVvQhH+xPdeblpcUqzOCx3gTfRgdmlhxTQhCHWqhcOpdGCH:dK83/G6+VylNqzeGa9IC1SOpI
TLSH
T12A14C30276D58125F1F73A30197496710E7BBCA09E38CA9E5398557D0FB3A80DD38BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

200704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\devcon\Release\devcon_xp.pdb

kernel32

CloseHandle LocalFree FileTimeToSystemTime FormatMessageW CreateFileW WriteConsoleW GetCurrentProcess FreeLibrary GetProcAddress GetWindowsDirectoryW LoadLibraryW GetLastError GetFileAttributesW FindClose FindNextFileW GetFullPathNameW GetDateFormatW FindFirstFileW SetFilePointerEx HeapReAlloc HeapSize GetConsoleMode GetConsoleCP FlushFileBuffers GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle GetStringTypeW GetFileType LCMapStringW CompareStringW HeapAlloc HeapFree GetACP GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess WideCharToMultiByte MultiByteToWideChar GetModuleFileNameW WriteFile GetStdHandle LoadLibraryExW DecodePointer TlsFree TlsSetValue UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue

user32

CharNextW LoadStringW

advapi32

AdjustTokenPrivileges OpenProcessToken InitiateSystemShutdownExW RegQueryValueExW RegCloseKey CloseServiceHandle OpenSCManagerW RegSetValueExW RegDeleteValueW OpenServiceW LookupPrivilegeValueW

ole32

CLSIDFromString

setupapi

SetupDiGetDriverInstallParamsW SetupFindFirstLineW SetupDiSetDeviceInstallParamsW CM_Free_Res_Des_Handle SetupOpenInfFileW SetupGetStringFieldW SetupDiBuildDriverInfoList CM_Get_Res_Des_Data_Size_Ex SetupDiGetDriverInfoDetailW CM_Get_First_Log_Conf_Ex SetupDiSetSelectedDriverW SetupDiEnumDriverInfoW SetupCloseFileQueue SetupDiDestroyDriverInfoList SetupDiOpenDevRegKey CM_Get_Res_Des_Data_Ex SetupCloseInfFile CM_Get_Next_Res_Des_Ex SetupOpenFileQueue SetupScanFileQueueW SetupDiOpenDeviceInfoW SetupDiGetDeviceRegistryPropertyW SetupDiCreateDeviceInfoListExW SetupDiClassNameFromGuidExW SetupCopyOEMInfW SetupDiOpenClassRegKeyExW SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoList SetupDiGetINFClassW CM_Connect_MachineW SetupDiCallClassInstaller SetupDiGetDeviceInfoListDetailW SetupDiSetClassInstallParamsW SetupDiGetClassDevsExW SetupDiGetDeviceInstallParamsW CM_Locate_DevNode_ExW CM_Disconnect_Machine CM_Get_Device_ID_ExW CM_Reenumerate_DevNode_Ex SetupDiSetDeviceRegistryPropertyW SetupDiClassGuidsFromNameExW CM_Get_DevNode_Status_Ex SetupDiBuildClassInfoListExW SetupDiGetClassDescriptionExW SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList CM_Free_Log_Conf_Handle

Name

.text

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

220B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

w5��u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_236dd35ec57987ed00c9adddfd40ea0d_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi

kernel32

user32

advapi32

ole32

setupapi

generic