2026-08-20_091344653e069861efde32b32bc073a5_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_091344653e069861efde32b32bc073a5_amadey_elex_luca-stealer_njrat_remcos_smoke-loader
Size 316KB
Sample260821-bd5e9stthy
SHA256 000cbd9f5a7f8d3f5e83bf9461c955a2b4f4f46faaaec990016008e07b4e88c0
MD5 091344653e069861efde32b32bc073a5
SHA1 017d37049c77427e7727321f3ad205f989bf271b
SHA512 bd12a8d8f7d635be474997ee2bb3f89c9c65fbc5e0baf541358ea5a453f0a66200a5bcc474cb616851dee1cbdea69895f3f2c53ef9d104d54ce18b28ae5c7cd2
SSDEEP 6144:6i3cXXfCPHXWrQnygJn467SHHHaCchptgVM8idyZRAOabB4BRPyxUe:6i3cXXfYHXWrQnygJn4603ktMRRkGRP2
TLSH
T113643B1177D1C132E2B346721A789FA6857DBD294F3146DF63D40A2EC9306D2AA31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_091344653e069861efde32b32bc073a5_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-08-20_091344653e069861efde32b32bc073a5_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 316KB

2026-08-20_091344653e069861efde32b32bc073a5_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH efee9af40fbd27be01ec5d9d6eade1c5
SHA256 000cbd9f5a7f8d3f5e83bf9461c955a2b4f4f46faaaec990016008e07b4e88c0
MD5 091344653e069861efde32b32bc073a5
SHA1 017d37049c77427e7727321f3ad205f989bf271b
SHA512 bd12a8d8f7d635be474997ee2bb3f89c9c65fbc5e0baf541358ea5a453f0a66200a5bcc474cb616851dee1cbdea69895f3f2c53ef9d104d54ce18b28ae5c7cd2
SSDEEP 6144:6i3cXXfCPHXWrQnygJn467SHHHaCchptgVM8idyZRAOabB4BRPyxUe:6i3cXXfYHXWrQnygJn4603ktMRRkGRP2
TLSH
T113643B1177D1C132E2B346721A789FA6857DBD294F3146DF63D40A2EC9306D2AA31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106839

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Work\installer\Release\installer_.pdb

kernel32

lstrlenW TerminateProcess GetModuleFileNameW GetTempPathW WaitForSingleObject GetVersionExW OpenProcess CreateToolhelp32Snapshot Process32NextW OutputDebugStringW Process32FirstW GetLocalTime GetFileTime GetModuleHandleW GetTempFileNameW GetSystemTime GetExitCodeProcess GetVersion MultiByteToWideChar CopyFileW WriteConsoleW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SystemTimeToTzSpecificLocalTime CreateProcessW DeleteCriticalSection DecodePointer RaiseException CloseHandle FileTimeToSystemTime GetLastError Sleep CreateFileW InitializeCriticalSectionAndSpinCount GetProcAddress InterlockedDecrement GetCommandLineA GetOEMCP IsValidCodePage HeapSize ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ReadFile HeapReAlloc GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType HeapAlloc HeapFree GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx WideCharToMultiByte FormatMessageW GetStringTypeW EnterCriticalSection LeaveCriticalSection SetLastError SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer GetCPInfo LCMapStringW GetLocaleInfoW IsDebuggerPresent LocalFree UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind FreeLibrary LoadLibraryExW

user32

wvsprintfW EnumChildWindows SendMessageW EnumWindows GetDlgCtrlID GetWindowThreadProcessId

advapi32

GetUserNameW RegCloseKey RegQueryInfoKeyW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegOpenKeyW RegEnumValueW RegQueryValueExW

shell32

SHGetFolderPathW

ole32

CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitialize

oleaut32

SysAllocStringLen GetErrorInfo VariantInit VariantClear SysAllocString SysFreeString

wininet

HttpSendRequestW HttpOpenRequestW InternetCloseHandle InternetOpenW InternetReadFile InternetConnectW

urlmon

URLDownloadToFileW

rpcrt4

UuidCreate UuidToStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_091344653e069861efde32b32bc073a5_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

wininet

urlmon

rpcrt4

generic