2026-07-18_848775b045deffe8b475529e61e44e83_amadey_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_848775b045deffe8b475529e61e44e83_amadey_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader
Size 915KB
Sample260718-m2bcwact7z
SHA256 83c4733bbdd8939695eecfd7e2bdceb3259ac8fc68d967a30ebbd067a909c676
MD5 848775b045deffe8b475529e61e44e83
SHA1 bfc6d9b6bc16fe401b22fa6e19f43375e4d25918
SHA512 252f48f39459bb597c076f306517effe28c13b59635a3803b4ef797780950d5982284c5bc978b1f87a0e729b51167c38b81b65009abecf22c5bbe5a3ae1b4a84
SSDEEP 24576:DuJWJe+kfZwvMyBdyiXscwkgFBT31aoCApqrEH7f:bsm5ZXsHTTFaoCAp9
TLSH
T15A15AE2076C58277E2A202705D7CA76B447DFA240F3159DFE3D84A2D6D389D21E32B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-18_848775b045deffe8b475529e61e44e83_amadey_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-07-18_848775b045deffe8b475529e61e44e83_amadey_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader

.exe 915KB

2026-07-18_848775b045deffe8b475529e61e44e83_amadey_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader

IMPHASH 9140e4748cd82633c4ca4e13eee285f0
SHA256 83c4733bbdd8939695eecfd7e2bdceb3259ac8fc68d967a30ebbd067a909c676
MD5 848775b045deffe8b475529e61e44e83
SHA1 bfc6d9b6bc16fe401b22fa6e19f43375e4d25918
SHA512 252f48f39459bb597c076f306517effe28c13b59635a3803b4ef797780950d5982284c5bc978b1f87a0e729b51167c38b81b65009abecf22c5bbe5a3ae1b4a84
SSDEEP 24576:DuJWJe+kfZwvMyBdyiXscwkgFBT31aoCApqrEH7f:bsm5ZXsHTTFaoCAp9
TLSH
T15A15AE2076C58277E2A202705D7CA76B447DFA240F3159DFE3D84A2D6D389D21E32B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

26:55:73:0e:94:8b:8a:53:88:2a:ec:5c:0b:e4:37:b3:0c:6b:d9:5e:05:6f:0f:2a:af:25:d8:27:07:c7:7e:75

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Chains

Jul 17, 2026

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ea:21:69:1d:ab:eb:c0:e8:1e:25:20:c2:1c:dd:6b:ac:e5:e6:8b:e6

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Chains

Feb 8, 2017

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Serial Number

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 9, 2016 - Feb 13, 2019

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

385128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\src\server\trunk\source\Release\FileZilla Server.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

ntohl WSAStartup setsockopt getsockopt ioctlsocket accept listen shutdown getsockname getpeername inet_ntoa ntohs connect WSAAsyncGetHostByName inet_addr send recv WSACancelAsyncRequest closesocket bind freeaddrinfo getaddrinfo WSAAsyncSelect socket WSASetLastError htons WSAGetLastError WSACleanup WSAIoctl gethostbyname

iphlpapi

GetAdaptersAddresses

kernel32

FindFirstFileExA GetConsoleCP GetProcessHeap SetFilePointerEx ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID FindNextFileA GetFileType GetACP GetStdHandle GetModuleFileNameA GetModuleHandleExW ExitProcess HeapReAlloc HeapFree HeapAlloc RtlUnwind IsValidLocale IsValidCodePage GetLocalTime GetLastError SizeofResource FindResourceW GetModuleHandleW GetCurrentThreadId SetLastError MultiByteToWideChar DeleteFileW GetFileAttributesW SetFileAttributesW RemoveDirectoryW CreateDirectoryW MoveFileW FileTimeToSystemTime SystemTimeToFileTime CreateFileW SetFileTime CloseHandle WideCharToMultiByte WriteFile GetModuleFileNameW SetFilePointer GetSystemTime GetOEMCP FindNextFileW FindClose ReadFile SetEndOfFile CreateThread WaitForSingleObject Sleep LoadLibraryExW FreeLibrary GetProcAddress GetFileAttributesExW GetTickCount64 GetTimeZoneInformation SetThreadPriority GetCurrentThread GetDateFormatW GetTimeFormatW CreateEventW SetEvent ResumeThread FlushFileBuffers RaiseException LoadLibraryW CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualProtect VirtualFree VirtualAlloc GetVersionExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW HeapSize FindFirstFileW QueryPerformanceCounter QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetStringTypeW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount EncodePointer DecodePointer LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SignalObjectAndWait SwitchToThread GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer

user32

PostThreadMessageW SendMessageW FindWindowW DispatchMessageW TranslateMessage GetMessageW EnumWindows GetWindowTextW GetClassNameW MessageBoxW PostQuitMessage LoadStringA RegisterWindowMessageW SetTimer DefWindowProcW KillTimer GetWindowLongW PostMessageW PeekMessageW DestroyWindow SetWindowLongW CreateWindowExW RegisterClassExW LoadStringW

advapi32

OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerW ControlService DeleteService StartServiceW CreateServiceW StartServiceCtrlDispatcherW QueryServiceStatus OpenServiceW CloseServiceHandle

Name

.text

Size

614KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_848775b045deffe8b475529e61e44e83_amadey_elex_floxif_luca-stealer_medusalocker_njrat_remcos_smoke-loader

PE Signature issue

PE Signature issue

version

ws2_32

iphlpapi

kernel32

user32

advapi32

generic