2026-08-27_fad4ff520765648d286bf5406aba6b10_amadey_elex_luca-stealer_manuscrypt_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_fad4ff520765648d286bf5406aba6b10_amadey_elex_luca-stealer_manuscrypt_mespinoza_njrat_remcos_smoke-loader
Size 1.3MB
Sample260828-awrrfsbd85
SHA256 6165cd563e3f96037b82459df76aba764923b505f087c7389b9146c74b0d222a
MD5 fad4ff520765648d286bf5406aba6b10
SHA1 ce97eb8a7f6138218fdf1e279e5306d35358d0ab
SHA512 23cb5d592b1031a16f0270e08c8800af2caab6522a913f5df178c36226a302c68e098182f720eb3589922bb0e2db098a57dd1199eebcab861cf585b567085944
SSDEEP 12288:eICc8kAnxgTVPX/1bgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:AaJPXCBe5uO3WaufwThsZ
TLSH
T1F05512017CC0C4B2D5A61A3258E9DAB41A3DFD305F620AEB73C8367D4E706D1593BAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_fad4ff520765648d286bf5406aba6b10_amadey_elex_luca-stealer_manuscrypt_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-08-27_fad4ff520765648d286bf5406aba6b10_amadey_elex_luca-stealer_manuscrypt_mespinoza_njrat_remcos_smoke-loader

.exe 1.3MB

2026-08-27_fad4ff520765648d286bf5406aba6b10_amadey_elex_luca-stealer_manuscrypt_mespinoza_njrat_remcos_smoke-loader

IMPHASH df7b6bb9e95780614d60c7a9f997651f
SHA256 6165cd563e3f96037b82459df76aba764923b505f087c7389b9146c74b0d222a
MD5 fad4ff520765648d286bf5406aba6b10
SHA1 ce97eb8a7f6138218fdf1e279e5306d35358d0ab
SHA512 23cb5d592b1031a16f0270e08c8800af2caab6522a913f5df178c36226a302c68e098182f720eb3589922bb0e2db098a57dd1199eebcab861cf585b567085944
SSDEEP 12288:eICc8kAnxgTVPX/1bgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:AaJPXCBe5uO3WaufwThsZ
TLSH
T1F05512017CC0C4B2D5A61A3258E9DAB41A3DFD305F620AEB73C8367D4E706D1593BAA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21057

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\realplayer_loc_25_0_2\rnudlp\rel32s\rnudlp.pdb

kernel32

CloseHandle GetCurrentProcess GetModuleFileNameW WriteConsoleW GetConsoleCP FlushFileBuffers GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW FindNextFileW FindClose CreateFileW WideCharToMultiByte MultiByteToWideChar SetThreadUILanguage SetDllDirectoryA LocalFree LoadLibraryW FindResourceW SizeofResource LockResource LoadResource GetProcAddress FreeLibrary FindResourceExW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer LCMapStringW SetStdHandle IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetLastError EncodePointer GetFileType ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP GetConsoleMode SetFilePointerEx GetCommandLineW

user32

LoadIconA LoadBitmapA SetClassLongA FillRect MapWindowPoints GetWindowRect GetWindowTextW DrawTextW SendDlgItemMessageA GetDlgItem EndDialog DialogBoxParamA CreateWindowExW RegisterClassW DefWindowProcA PostMessageA GetWindowTextLengthW

advapi32

SystemFunction036 RegOpenKeyExA RegQueryValueExA RegCloseKey

gdi32

DeleteObject GetStockObject RoundRect SelectObject SetDCBrushColor SetDCPenColor SetBkMode SetTextColor CreateFontA

shell32

CommandLineToArgvW

shlwapi

PathAppendW PathRemoveFileSpecW

Name

.text

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_fad4ff520765648d286bf5406aba6b10_amadey_elex_luca-stealer_manuscrypt_mespinoza_njrat_remcos_smoke-loader

kernel32

user32

advapi32

gdi32

shell32

shlwapi

generic