2026-07-31_920c61828374b1f99ea8a9984dbb169a_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_920c61828374b1f99ea8a9984dbb169a_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader
Size 1.1MB
Sample260731-rdtlrsvake
SHA256 d05c3d92e48fd4766f373701c9bd198f8bcdbebb8a143b4134ebad7b34df74c3
MD5 920c61828374b1f99ea8a9984dbb169a
SHA1 146282229735c35e370f107f1804b389062886b4
SHA512 43615285ad1dad93e7bbc90a0a820e4100cb5709d0ddd28f147e0d75901691b0fac1640a9ebdb895949016741963bb84cb5f1577fb08c9381ba796ddc1e11c15
SSDEEP 24576:E8GMdRg1fOl2PvZ3ftg82uyS0dvb5cwdrEH7g:Er1ftZhRyTZ1f
TLSH
T14345AE403502E7B5DDA483B0142DDBEA1AA87F310B3618DBA7D83B2B6D771D22739536
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-31_920c61828374b1f99ea8a9984dbb169a_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-07-31_920c61828374b1f99ea8a9984dbb169a_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

.exe 1.1MB

2026-07-31_920c61828374b1f99ea8a9984dbb169a_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 7a85e1fb5515f23ee9bf7cc685d3951d
SHA256 d05c3d92e48fd4766f373701c9bd198f8bcdbebb8a143b4134ebad7b34df74c3
MD5 920c61828374b1f99ea8a9984dbb169a
SHA1 146282229735c35e370f107f1804b389062886b4
SHA512 43615285ad1dad93e7bbc90a0a820e4100cb5709d0ddd28f147e0d75901691b0fac1640a9ebdb895949016741963bb84cb5f1577fb08c9381ba796ddc1e11c15
SSDEEP 24576:E8GMdRg1fOl2PvZ3ftg82uyS0dvb5cwdrEH7g:Er1ftZhRyTZ1f
TLSH
T14345AE403502E7B5DDA483B0142DDBEA1AA87F310B3618DBA7D83B2B6D771D22739536
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

79:f9:5c:bc:ba:ff:c6:47:cc:e4:0f:28:2b:76:40:9b:d3:b6:a3:52:59:15:65:20:70:bf:ff:d7:4b:2e:26:6a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Pintosoft,O=Pintosoft,ST=Gyeonggi-do,C=KR

Chains

Aug 9, 2023

CN=Pintosoft,O=Pintosoft,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Pintosoft,O=Pintosoft,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

2b:c0:fd:74:97:ad:6d:87:08:8c:9b:68:8f:2f:d9:a7:8b:a3:4b:fc

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Pintosoft,O=Pintosoft,ST=Gyeonggi-do,C=KR

Chains

Aug 9, 2023

CN=Pintosoft,O=Pintosoft,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Pintosoft,O=Pintosoft,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Pintosoft,O=Pintosoft,ST=Gyeonggi-do,C=KR

Serial Number

0c:87:e6:62:10:ec:17:00:27:64:4b:f6:94:70:bf:ba

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 24, 2023 - Feb 24, 2024

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 3, 2023 - Aug 2, 2034

Minor OS version

Major OS version

Entry point

289083

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\p\AutoOff\Release\AutoOff.pdb

psapi

EnumProcesses GetProcessImageFileNameW

winmm

mciSendCommandW

kernel32

SetThreadUILanguage OpenProcess TerminateProcess Sleep QueryDosDeviceW GetTickCount GetLocalTime GetThreadLocale GetDateFormatW GlobalAlloc GlobalLock GlobalUnlock MulDiv lstrcmpW GetModuleHandleA DeleteFileW GetLocaleInfoW GetTimeFormatW VirtualQuery GetCurrentProcessId WideCharToMultiByte SetThreadLocale SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetTimeZoneInformation SetFilePointerEx ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers GetOEMCP FindNextFileW GetFileType EnumSystemLocalesW IsValidLocale GetStdHandle ExitProcess GetACP GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread VirtualProtect GetCommandLineW GetCommandLineA RtlUnwind QueryPerformanceCounter GetStartupInfoW WaitForSingleObjectEx SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringW CompareStringW GetSystemTimeAsFileTime SwitchToThread GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent FindFirstFileW GetFullPathNameW GetSystemTime FindClose GetShortPathNameW CreateEventW TlsFree TlsSetValue TlsGetValue TlsAlloc GetSystemInfo WaitForSingleObject ResetEvent SetEvent InitializeCriticalSection GetFileAttributesW GetTempPathW CreateFileW FindResourceExW WriteFile LockResource LoadLibraryW MultiByteToWideChar GetVersionExW FindResourceW GetModuleHandleW GetModuleFileNameW LoadLibraryExW CreateMutexW lstrlenW lstrcmpiW CloseHandle SizeofResource LoadResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection SetLastError GetLastError GetCurrentThreadId RaiseException GetCurrentProcess GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy LocalFree GetProcAddress FreeLibrary InterlockedExchange InterlockedDecrement GetUserDefaultLCID InterlockedIncrement DecodePointer SetStdHandle WriteConsoleW IsValidCodePage SetEndOfFile

user32

FrameRect MessageBoxIndirectW GetForegroundWindow TrackPopupMenuEx RemoveMenu ModifyMenuW GetSubMenu LoadMenuW IsWindowEnabled CharLowerW BringWindowToTop PostQuitMessage GetMessagePos DrawFrameControl DrawEdge IsDialogMessageW GetKeyState GetClassNameW SetRectEmpty InvalidateRgn DestroyAcceleratorTable CreateAcceleratorTableW RegisterWindowMessageW MonitorFromRect LoadImageW DestroyIcon GetWindowDC DrawTextW DrawIcon MoveWindow SetLayeredWindowAttributes EnumChildWindows SetMenuItemInfoW GetMenuStringW GetLastInputInfo LockWorkStation GetWindowThreadProcessId SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx LoadBitmapW MonitorFromPoint FillRect GetParent TrackMouseEvent GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW SendMessageTimeoutW PostMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW SendInput ExitWindowsEx GetDlgItemInt SetDlgItemInt UnregisterHotKey RegisterHotKey CreatePopupMenu LoadIconW MapWindowPoints MessageBeep GetWindowTextLengthW GetWindowTextW EnableWindow GetActiveWindow SetDlgItemTextW GetDlgItem EndDialog DialogBoxParamW GetMonitorInfoW MonitorFromWindow EnumWindows IsWindowVisible SystemParametersInfoW LoadCursorW CheckMenuRadioItem GetWindow FindWindowW IsMenu GetDesktopWindow IsWindow IsChild DestroyWindow ShowWindow SetWindowPos CreateDialogParamW GetDlgCtrlID CharNextW SetFocus GetFocus GetCapture SetCapture ReleaseCapture SetTimer KillTimer GetSystemMetrics DestroyMenu EnableMenuItem GetMenuItemID GetMenuItemCount AppendMenuW DeleteMenu GetMenuItemInfoW SetWindowLongW GetWindowLongW PtInRect OffsetRect InflateRect SetRect GetSysColorBrush GetSysColor WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor MessageBoxW AdjustWindowRectEx GetWindowRect GetClientRect SetWindowTextW RedrawWindow InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow UpdateWindow SetMenuDefaultItem

gdi32

SelectObject GetStockObject SetBkMode GetObjectW Polygon BitBlt SetBkColor SetTextColor GetDeviceCaps MoveToEx EnumFontFamiliesExW SetViewportOrgEx SetBrushOrgEx CreateBitmap CreateDIBSection PatBlt GetCurrentObject DeleteObject LineTo Rectangle CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreatePen CreateSolidBrush CreatePatternBrush DeleteDC

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

SetEntriesInAclW CredFree CredWriteW CredReadW InitiateSystemShutdownW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegQueryValueExW BuildExplicitAccessWithNameW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW CredDeleteW SetSecurityInfo

shell32

SHBindToParent ord190 ShellExecuteW SHGetSpecialFolderPathW Shell_NotifyIconW

ole32

OleUninitialize OleInitialize StringFromGUID2 CLSIDFromProgID CLSIDFromString OleLockRunning CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize CoGetClassObject CoTaskMemFree CoInitialize

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VarUI4FromStr VariantClear LoadTypeLi LoadRegTypeLi DispCallFunc OleCreateFontIndirect VariantInit

comctl32

ImageList_DragMove ImageList_DragShowNolock ImageList_Draw ImageList_DrawEx ImageList_LoadImageW _TrackMouseEvent ImageList_GetImageCount ImageList_DrawIndirect ord8 InitCommonControlsEx ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_AddMasked ImageList_Destroy ImageList_Create

uxtheme

IsAppThemed IsThemeActive

wininet

HttpQueryInfoW HttpEndRequestW HttpSendRequestExW HttpSendRequestW HttpOpenRequestW InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW InternetCanonicalizeUrlW InternetCrackUrlW InternetSetCookieExW InternetGetConnectedState

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

powrprof

SetSuspendState CallNtPowerInformation IsPwrHibernateAllowed IsPwrSuspendAllowed

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_920c61828374b1f99ea8a9984dbb169a_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

PE Signature issue

PE Signature issue

psapi

winmm

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

uxtheme

wininet

version

powrprof

generic