2026-07-24_70e83db6135a4d790dfa2f3108b3264b_elex_luca-stealer_njrat_remcos_smoke-loader

General

Target
2026-07-24_70e83db6135a4d790dfa2f3108b3264b_elex_luca-stealer_njrat_remcos_smoke-loader
Size 848KB
Sample260724-lb278sbm41
SHA256 988facd67259b70fa3ead1b43aa3944248e1b93f74d9e37c59c0a487f31960f5
MD5 70e83db6135a4d790dfa2f3108b3264b
SHA1 348dd8029595b95c0bf1971922b82f87a74cf6bc
SHA512 a3cb944ac7038593135808f3abf8442e63e4aaf542425b830bc563a072a68a8a825aadd5d106a1ab17cabdde6f6eaa1e31de6a461e3ad9ad6531d76b84483807
SSDEEP 24576:5uw0C1wf/Pne87HtO/DF1+9codjeWyZxeCE7:5D0C1wf/R2TPod5
TLSH
T14F05E08176D104A6D1E20533396382B0F7EA9CFB3A6E974FD2C5371D8A3B2D0D6245B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_70e83db6135a4d790dfa2f3108b3264b_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-07-24_70e83db6135a4d790dfa2f3108b3264b_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 848KB

2026-07-24_70e83db6135a4d790dfa2f3108b3264b_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 21a44b7b732a3c332927ddae75ee8378
SHA256 988facd67259b70fa3ead1b43aa3944248e1b93f74d9e37c59c0a487f31960f5
MD5 70e83db6135a4d790dfa2f3108b3264b
SHA1 348dd8029595b95c0bf1971922b82f87a74cf6bc
SHA512 a3cb944ac7038593135808f3abf8442e63e4aaf542425b830bc563a072a68a8a825aadd5d106a1ab17cabdde6f6eaa1e31de6a461e3ad9ad6531d76b84483807
SSDEEP 24576:5uw0C1wf/Pne87HtO/DF1+9codjeWyZxeCE7:5D0C1wf/R2TPod5
TLSH
T14F05E08176D104A6D1E20533396382B0F7EA9CFB3A6E974FD2C5371D8A3B2D0D6245B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11747

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\TestPC\Desktop\QuickAccess_V2\Bin\Release\SetAPM.pdb

kernel32

CreateMutexW GetSystemPowerStatus DecodePointer CreateFileW DeviceIoControl GetLastError CreateFileA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW EncodePointer GetModuleFileNameW RaiseException SetLastError RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle WriteFile MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc CompareStringW LCMapStringW GetFileType GetStringTypeW SetStdHandle GetConsoleCP GetConsoleMode FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap FlushFileBuffers SetFilePointerEx WriteConsoleW HeapSize HeapReAlloc CloseHandle

user32

wsprintfW

advapi32

SystemFunction036 RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_70e83db6135a4d790dfa2f3108b3264b_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

advapi32

generic