General
- Target 2026-07-31_f9b1054cf5a0dc4cb484864db0b3f5e9_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop
- Size 12.9MB
- Sample260731-hgrf5sec79
- SHA256 044a0ceefbe3d3d217d579211c7e7992714afc1207c98c6abf4c7d6c90f5fd3a
- MD5 f9b1054cf5a0dc4cb484864db0b3f5e9
- SHA1 47d566cb28317a5130d229917b601726517a7a44
- SHA512 b481f83b2c676a994e4d59fcd06405ee3fee4cd4c8d5156f2e6afda6f84f7f949eb4ddcc535cadd0380e606d110d012c429ab1b6afd23db25d250699168e8fe4
- SSDEEP 196608:3GTJJodeGZF6bUpMBF1p/kjRm4OWireGZF6bUpMBF1p/kjRm4OWi2b/oW:2cRIbUwF1VERmjjIbUwF1VERmj2bAW
- TLSH T1C6D61216F9648331D033C075C4E2E6BAEA7134924B3086CB5395DB7D2F676E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_f9b1054cf5a0dc4cb484864db0b3f5e9_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_f9b1054cf5a0dc4cb484864db0b3f5e9_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_f9b1054cf5a0dc4cb484864db0b3f5e9_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop
- Size 12.9MB
- SHA256 044a0ceefbe3d3d217d579211c7e7992714afc1207c98c6abf4c7d6c90f5fd3a
- MD5 f9b1054cf5a0dc4cb484864db0b3f5e9
- SHA1 47d566cb28317a5130d229917b601726517a7a44
- SHA512 b481f83b2c676a994e4d59fcd06405ee3fee4cd4c8d5156f2e6afda6f84f7f949eb4ddcc535cadd0380e606d110d012c429ab1b6afd23db25d250699168e8fe4
- SSDEEP 196608:3GTJJodeGZF6bUpMBF1p/kjRm4OWireGZF6bUpMBF1p/kjRm4OWi2b/oW:2cRIbUwF1VERmjjIbUwF1VERmj2bAW
- TLSH T1C6D61216F9648331D033C075C4E2E6BAEA7134924B3086CB5395DB7D2F676E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory