2026-07-13_5ab455c55237ff0a11ed6e4db5b4df09_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-13_5ab455c55237ff0a11ed6e4db5b4df09_elex_luca-stealer_njrat_remcos_smoke-loader
Size 1.6MB
Sample260713-2b96vabz21
SHA256 e5e5eb89d32322e32be2f7b4ab34ea68b12e070082fcb7acf16d80f90a162b6c
MD5 5ab455c55237ff0a11ed6e4db5b4df09
SHA1 dbc8f1b4bb6f8c57654acaab8355b2f3d149a807
SHA512 f3e974d89bbd0f95533a1577f150d42682b84c0e55bd1cb59650a6a080cef34a774353d86c7680eb02f243a55c31fc34aca4ae23db620c0030e8a475c782b6bd
SSDEEP 24576:n9o8q8qz/6LHnxLPj8N0zCZMcoxC2SbeTf6s95kHH:1Bqz/EHxLj3CZMFxC2+ees4HH
TLSH
T18C753B97FD08D461C6A906F0D8A7A6D2073B7D201D78418FB14B732DEB386DC9D0AE99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-13_5ab455c55237ff0a11ed6e4db5b4df09_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-07-13_5ab455c55237ff0a11ed6e4db5b4df09_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 1.6MB

2026-07-13_5ab455c55237ff0a11ed6e4db5b4df09_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 46e2eecd7236034b5abc4ab48d65dac0
SHA256 e5e5eb89d32322e32be2f7b4ab34ea68b12e070082fcb7acf16d80f90a162b6c
MD5 5ab455c55237ff0a11ed6e4db5b4df09
SHA1 dbc8f1b4bb6f8c57654acaab8355b2f3d149a807
SHA512 f3e974d89bbd0f95533a1577f150d42682b84c0e55bd1cb59650a6a080cef34a774353d86c7680eb02f243a55c31fc34aca4ae23db620c0030e8a475c782b6bd
SSDEEP 24576:n9o8q8qz/6LHnxLPj8N0zCZMcoxC2SbeTf6s95kHH:1Bqz/EHxLj3CZMFxC2+ees4HH
TLSH
T18C753B97FD08D461C6A906F0D8A7A6D2073B7D201D78418FB14B732DEB386DC9D0AE99
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21503

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\nyasui\Documents\Visual Studio 2013\Projects\HPSystemEventUtility\Release\SysInfo.pdb

kernel32

DeleteCriticalSection WriteConsoleW ReadConsoleW ReadFile SetEndOfFile SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA DecodePointer GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW HeapReAlloc HeapSize CloseHandle GetStringTypeW GetFileType HeapAlloc HeapFree GetACP RaiseException GetLastError InitializeCriticalSectionEx OutputDebugStringW LoadLibraryW GetUserDefaultLCID GetUserDefaultLocaleName GetFileAttributesW GetModuleFileNameW lstrcmpW GetUserDefaultUILanguage LCIDToLocaleName GetCurrentThreadId GetSystemFirmwareTable GetCPInfo WriteFile GetStdHandle WideCharToMultiByte MultiByteToWideChar EnumSystemFirmwareTables GetModuleHandleExW ExitProcess IsDebuggerPresent EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead EncodePointer SetLastError RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW

user32

FindWindowW LoadStringW EndDialog PostQuitMessage EndPaint DrawIconEx DrawTextW BeginPaint MoveWindow ReleaseCapture SetCapture DefWindowProcW DestroyWindow DialogBoxParamW DrawStateW FillRect SendMessageW GetWindowLongW GetClientRect LoadImageW UpdateWindow ShowWindow SetLayeredWindowAttributes CreateWindowExW GetDC GetWindowRect GetDesktopWindow RegisterClassExW LoadCursorW LoadIconW DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW CharUpperW SetForegroundWindow AttachThreadInput GetWindowThreadProcessId GetWindowTextW PostMessageW GetForegroundWindow

gdi32

SelectObject CreatePen DeleteObject TextOutW SetBkMode GetTextExtentPoint32W SetBkColor SetTextColor CreateFontIndirectW CreateSolidBrush Rectangle

advapi32

SystemFunction036 RegGetValueW RegOpenKeyExW

shell32

ShellExecuteW SHGetFolderPathW

ole32

CoUninitialize CoInitialize

Name

.text

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

913KB

Virtual Size

913KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-13_5ab455c55237ff0a11ed6e4db5b4df09_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

generic