2026-08-07_db39b3670746e8f852d0a36b02095977_akira_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_db39b3670746e8f852d0a36b02095977_akira_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader
Size 4.2MB
Sample260807-pywkraysax
SHA256 f92f6c3ae49c4cfed1cb0549069747768d0a3ca27277e05cc429b6ebc16e31d7
MD5 db39b3670746e8f852d0a36b02095977
SHA1 bd6b592dae147475f40b9e5d52e725b77f8c90a1
SHA512 91695543e2a5d6e351d33375fa6712ec226a36208c71a5d99d13f0328bbe28ccebd7fc08fb8c0c09358d8767c6188e0a5a53fa46ffc0fbc653f12cd4a2c83d26
SSDEEP 49152:VMPCAZtVzOS+GzoxWsrVTfeooigNA2Oat3knc/Nra6Gw6NbO2eCBY4lvcM8scwan:VlytVzOnMEJhy3knM1a6AdcM8scn
TLSH
T15E26B11226D1DFE5D05F61B0EC29B6F8462B9C20DF120FCB6E407F5939B1691A931A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-07_db39b3670746e8f852d0a36b02095977_akira_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-08-07_db39b3670746e8f852d0a36b02095977_akira_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

.exe 4.2MB

2026-08-07_db39b3670746e8f852d0a36b02095977_akira_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 793d260c3fe240fe40642c90acfa874d
SHA256 f92f6c3ae49c4cfed1cb0549069747768d0a3ca27277e05cc429b6ebc16e31d7
MD5 db39b3670746e8f852d0a36b02095977
SHA1 bd6b592dae147475f40b9e5d52e725b77f8c90a1
SHA512 91695543e2a5d6e351d33375fa6712ec226a36208c71a5d99d13f0328bbe28ccebd7fc08fb8c0c09358d8767c6188e0a5a53fa46ffc0fbc653f12cd4a2c83d26
SSDEEP 49152:VMPCAZtVzOS+GzoxWsrVTfeooigNA2Oat3knc/Nra6Gw6NbO2eCBY4lvcM8scwan:VlytVzOnMEJhy3knM1a6AdcM8scn
TLSH
T15E26B11226D1DFE5D05F61B0EC29B6F8462B9C20DF120FCB6E407F5939B1691A931A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

bc:33:5c:90:26:e3:c0:76:83:01:35:2e:16:3d:2e:6c:d8:98:ef:ac:1f:b7:b2:47:92:13:c1:c7:1d:ca:e0:cf

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 13, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:84:8e:a3:9b:36:d7:bb:53:3c:f4:3d:96:d6:e1:3e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 6, 2025 - Oct 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2014352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\T\M\BuildResults\bin\Release\AcroRd32Exe.pdb

kernel32

LoadResource SizeofResource FindResourceW LoadLibraryA SetDllDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW QueryDosDeviceW lstrcmpA lstrcmpW CreateEventA GetCurrentThread SetThreadPriority TerminateThread GetSystemPowerStatus CreateFileA FindFirstFileA FindNextFileA GetFinalPathNameByHandleW SetFilePointer GetSystemInfo VirtualQueryEx CreateFileMappingW LoadLibraryExA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA FindResourceExW LockResource SetErrorMode QueryPerformanceCounter HeapSetInformation WaitForMultipleObjects CreateSemaphoreW CreateProcessW GetSystemTime GetSystemTimeAsFileTime AddAtomW SystemTimeToFileTime GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv IsProcessorFeaturePresent LoadLibraryExW UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteProcThreadAttributeList GetExitCodeProcess InitializeCriticalSectionEx HeapSize HeapReAlloc HeapDestroy RaiseException DecodePointer GetLongPathNameW GetCurrentDirectoryW SetCurrentDirectoryW GetTickCount OpenMutexW GetVolumeInformationW CreateThread CreateEventW CreateMutexW ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WaitNamedPipeW CreateNamedPipeW TransactNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ConnectNamedPipe ReadFile GetFileType GetStartupInfoW lstrlenW GetCurrentProcess GetTempPathW CreateFileW CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot VerifyVersionInfoW lstrcmpiW LocalFree LocalAlloc VerSetConditionMask MultiByteToWideChar WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc ExitProcess SetStdHandle GetConsoleOutputCP FreeLibraryAndExitThread RtlUnwind VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx FormatMessageW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc DebugBreak IsDebuggerPresent GetModuleHandleExW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode WideCharToMultiByte GetDynamicTimeZoneInformation LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameW FreeLibrary GetSystemDirectoryW OpenProcess GetCurrentThreadId GetCurrentProcessId Sleep SetLastError GetLastError CloseHandle OutputDebugStringW OutputDebugStringA WriteFile GetFileAttributesA GetCommandLineW GetVersionExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable QueryFullProcessImageNameW GlobalHandle GlobalSize GetComputerNameExW OpenEventW CreateDirectoryExW CompareFileTime GetFileTime GetFullPathNameW GetExitCodeThread GetTempFileNameW GetModuleHandleExA InitializeCriticalSectionAndSpinCount GetStdHandle ExitThread SearchPathW VirtualFree CreateJobObjectW CreateRemoteThread SignalObjectAndWait VirtualProtect VirtualQuery GetProcessId TerminateProcess DuplicateHandle GetProcessTimes ExpandEnvironmentStringsW ProcessIdToSessionId IsWow64Process GetProductInfo GetNativeSystemInfo DeleteFileW GetFileSizeEx GetLocalTime TryAcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryThreadCycleTime GetThreadPriority UnregisterWaitEx RegisterWaitForSingleObject GetUserDefaultLangID GetThreadId TlsGetValue AcquireSRWLockExclusive MoveFileExW GetFileAttributesExW TlsAlloc TlsFree TlsSetValue SetFilePointerEx SetEndOfFile GetFileInformationByHandle FlushFileBuffers FindFirstFileExW GetWindowsDirectoryW lstrcmpiA SetEnvironmentVariableW GetEnvironmentVariableW GetLocaleInfoW GetDriveTypeW DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GetFileSize VirtualProtectEx WriteProcessMemory VirtualAllocEx VirtualFreeEx GetVolumeInformationByHandleW GetProfileStringW ReadProcessMemory CreateIoCompletionPort TerminateJobObject GetQueuedCompletionStatus UnregisterWait PostQueuedCompletionStatus SetInformationJobObject IsProcessInJob QueryInformationJobObject ResumeThread GetUserDefaultLCID GetUserDefaultLocaleName SetHandleInformation SetProcessDEPPolicy AssignProcessToJobObject

user32

CreateWindowStationW CreateDesktopW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW GetParent MessageBoxW RemovePropW GetPropW SetPropW GetActiveWindow GetDlgItem SendMessageW PostMessageW LoadIconW SetProcessWindowStation ReleaseDC GetDC MsgWaitForMultipleObjects RegisterClipboardFormatW PeekMessageW DispatchMessageW DdeDisconnect DdeConnect DdeAddData DdeCreateDataHandle DdeGetData EnumThreadWindows IsWindowVisible DdeFreeStringHandle DdeCreateStringHandleW DdeNameService DdeUninitialize DdeInitializeW SetWindowLongW ShowWindow SendNotifyMessageW RegisterWindowMessageA CloseDesktop SetThreadDesktop OpenInputDesktop CreateWindowExW RegisterClassExW DefWindowProcW RegisterWindowMessageW LoadIconA LoadCursorA FindWindowA KillTimer SetTimer DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA GetThreadDesktop PostThreadMessageW IsWindowEnabled CloseWindowStation GetFocus MonitorFromWindow GetMonitorInfoW GetAsyncKeyState EnumChildWindows EnableWindow GetRawInputDeviceInfoW SetActiveWindow PtInRect SetCursorPos CreateIconFromResourceEx GetWindowTextLengthW RegisterClassW GetWindowInfo SetDlgItemTextW GetRawInputDeviceList DdeClientTransaction GetProcessWindowStation SendDlgItemMessageW CloseWindow LoadCursorW GetClipboardData OpenClipboard CloseClipboard IsClipboardFormatAvailable EnumClipboardFormats CountClipboardFormats EmptyClipboard SetClipboardData GetClipboardFormatNameW GetClipboardFormatNameA GetClipboardSequenceNumber GetClipboardOwner GetPriorityClipboardFormat GetOpenClipboardWindow GetClipboardViewer GetWindowDC GetMessageW SystemParametersInfoW BeginPaint EndPaint ScreenToClient GetClientRect MapWindowPoints SetCursor IsChild IsDialogMessageW FillRect LoadBitmapW MapDialogRect SetWindowContextHelpId GetClassInfoExW GetSysColor CallWindowProcW RedrawWindow CreateAcceleratorTableW ClientToScreen MoveWindow SetCapture ReleaseCapture InvalidateRect InvalidateRgn SetFocus DestroyAcceleratorTable CreateDialogIndirectParamW UpdateWindow SetRect IsRectEmpty PostQuitMessage DefWindowProcA DispatchMessageA TranslateMessage GetMessageA UserHandleGrantAccess GetWindow EnumWindows SetParent GetWindowLongW GetWindowTextW GetAncestor FindWindowW GetDesktopWindow GetWindowRect SetForegroundWindow GetSystemMetrics keybd_event BringWindowToTop SetWindowPos WaitForInputIdle EnumDesktopWindows GetGUIThreadInfo SetWindowTextW AllowSetForegroundWindow GetForegroundWindow CharNextW EndDialog DialogBoxParamW UnregisterClassW GetWindowThreadProcessId FindWindowExW IsWindow SendMessageTimeoutW GetUserObjectInformationW GetPropA

advapi32

CryptGenKey RegGetValueW RegOpenKeyExA RegQueryValueA RegOpenKeyA EqualSid AllocateAndInitializeSid RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegCreateKeyW ReportEventW RegisterEventSourceW CloseEventLog ConvertSidToStringSidW LookupPrivilegeValueW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetSecurityInfo GetSecurityInfo SetEntriesInAclW SetTokenInformation GetSecurityDescriptorSacl GetLengthSid FreeSid DuplicateTokenEx CreateWellKnownSid CopySid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken CredFree CredReadW RegQueryValueExA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey RegNotifyChangeKeyValue RegEnumValueW RegDeleteKeyExW SystemFunction036 GetNamedSecurityInfoW MapGenericMask AccessCheck OpenThreadToken InitializeSecurityDescriptor InitializeAcl SetSecurityDescriptorDacl GetAce SetKernelObjectSecurity GetKernelObjectSecurity InitializeSid GetAclInformation AddAce RevertToSelf RegDisablePredefinedCache CreateRestrictedToken DuplicateToken CreateProcessAsUserW SetThreadToken CheckTokenMembership RegDeleteTreeW SaferiIsExecutableFileType CryptAcquireContextA CryptAcquireContextW CryptReleaseContext CryptImportKey CryptDestroyKey CryptGetProvParam CryptSetProvParam CryptGenRandom CryptGetUserKey CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSignHashA CryptSignHashW CryptGetHashParam CryptSetHashParam CryptSetKeyParam CryptContextAddRef GetUserNameW ImpersonateAnonymousToken

shlwapi

UrlUnescapeW PathFindFileNameW PathRemoveFileSpecW PathIsURLW UrlIsW PathCanonicalizeW PathFileExistsW PathRemoveBackslashW PathAppendW PathFindExtensionA PathCombineW PathIsRelativeW AssocQueryStringW UrlGetPartW PathIsDirectoryW PathIsUNCW PathIsUNCServerShareW ord219 PathFindExtensionW UrlCanonicalizeW PathCreateFromUrlW PathAddBackslashW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSetTimeouts WinHttpSetCredentials WinHttpWriteData

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

621KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

726KB

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

131KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_db39b3670746e8f852d0a36b02095977_akira_amadey_elex_floxif_luca-stealer_njrat_remcos_smoke-loader

PE Signature issue

kernel32

user32

advapi32

shlwapi

version

winhttp

generic