2026-08-20_785f01aecceaae998fb293bacdf310ed_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

General

Target
2026-08-20_785f01aecceaae998fb293bacdf310ed_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 1.4MB
Sample260820-pl6vysxane
SHA256 c70056472bc6a98c176f978de22865d8016b26592b317db30471bbf5583931eb
MD5 785f01aecceaae998fb293bacdf310ed
SHA1 d1778f1bb2e41e44c053ef7699937107ee9a4153
SHA512 a46682d2b4c7a69b35b2d346a1e46e6ddbdfafd07ae063c794f00f89a81457d9291169a9178ac4a1521340c48d607c5b95259e921b5d27b16b12f42b85d90df1
SSDEEP 12288:zmZkIPpHJasoxK8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:zmZNpH2xK8LwsXYHU9MPxMu
TLSH
T14265022079D18873D5B2253589E4DB76193D7D300BA5DAEFB3D40B6E0E781C0AB31AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_785f01aecceaae998fb293bacdf310ed_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-08-20_785f01aecceaae998fb293bacdf310ed_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 1.4MB

2026-08-20_785f01aecceaae998fb293bacdf310ed_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH f867b0a50d19d3b8bb73c089094d5916
SHA256 c70056472bc6a98c176f978de22865d8016b26592b317db30471bbf5583931eb
MD5 785f01aecceaae998fb293bacdf310ed
SHA1 d1778f1bb2e41e44c053ef7699937107ee9a4153
SHA512 a46682d2b4c7a69b35b2d346a1e46e6ddbdfafd07ae063c794f00f89a81457d9291169a9178ac4a1521340c48d607c5b95259e921b5d27b16b12f42b85d90df1
SSDEEP 12288:zmZkIPpHJasoxK8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:zmZNpH2xK8LwsXYHU9MPxMu
TLSH
T14265022079D18873D5B2253589E4DB76193D7D300BA5DAEFB3D40B6E0E781C0AB31AB6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

31536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AdobeIPCBrokerCustomHook.pdb

shlwapi

PathAppendW PathRemoveFileSpecW

kernel32

GetCurrentProcessId HeapSize CreateFileW TerminateProcess GetModuleFileNameW GetTempPathW WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW Process32FirstW CloseHandle CreateProcessW ReadConsoleW WriteConsoleW SetStdHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter SetEndOfFile GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetModuleFileNameA GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetProcessHeap FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA

user32

FindWindowExW PostMessageW

shell32

SHGetFolderPathW

Name

.text

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_785f01aecceaae998fb293bacdf310ed_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

shlwapi

kernel32

user32

shell32

generic