2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader
Size 1.5MB
Sample260930-b4k5bastcs
SHA256 1b8fdc546ebd8e2e667014ced9e23d9f3499adbb5c17f0880dee9956e543c911
MD5 4b6a2c67e1ab4a98faf61d3192f6b21c
SHA1 b2fb4eebdbc4b8f3e68ce9d2751a63c355fc4780
SHA512 a41f2bfed8b9c12bcace5d095418ec654098b1dc8695db38de34823b22637a8f3ec782fd09e57843bbefabab535417c1314bb9ee329f57f0bd216bbe37dd50bc
SSDEEP 24576:6Sx8FXpSBhvn/+r1fGG7uTeqGybWZJKSMCxVbT5o8P:nKXEBh3qr7uatQSLxDD
TLSH
T14975126179C1C831D6B71A3458F4DB79AA3CBCA85E34C65F63583A6F5E305C2A920F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 1.5MB

2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH f4fdb2aaa6137c6e04a3216b2c2e53c9
SHA256 1b8fdc546ebd8e2e667014ced9e23d9f3499adbb5c17f0880dee9956e543c911
MD5 4b6a2c67e1ab4a98faf61d3192f6b21c
SHA1 b2fb4eebdbc4b8f3e68ce9d2751a63c355fc4780
SHA512 a41f2bfed8b9c12bcace5d095418ec654098b1dc8695db38de34823b22637a8f3ec782fd09e57843bbefabab535417c1314bb9ee329f57f0bd216bbe37dd50bc
SSDEEP 24576:6Sx8FXpSBhvn/+r1fGG7uTeqGybWZJKSMCxVbT5o8P:nKXEBh3qr7uatQSLxDD
TLSH
T14975126179C1C831D6B71A3458F4DB79AA3CBCA85E34C65F63583A6F5E305C2A920F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\WinRAR\uninstall\build\uninstall32\Release\uninstall.pdb

kernel32

ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW GetVersionExW GetCurrentDirectoryW FindResourceW FreeLibrary LoadLibraryW LoadLibraryExW GetCurrentProcessId GetSystemDirectoryW GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte CompareStringW GetModuleHandleExW GetShortPathNameW Sleep GetTempPathW SetCurrentDirectoryW CreateProcessW GetCommandLineW GetEnvironmentVariableW RemoveDirectoryW CopyFileW MoveFileExW MoveFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA LCMapStringW SetFilePointerEx HeapReAlloc GetConsoleMode GetConsoleCP HeapAlloc HeapFree GetACP GetModuleFileNameA ExitProcess QueryPerformanceFrequency TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection TerminateProcess EnterCriticalSection EncodePointer SetFileAttributesW GetDiskFreeSpaceExW CreateFileW CloseHandle SetFileTime SetFilePointer SetEndOfFile FlushFileBuffers ReadFile WriteFile GetStdHandle GetFileType GetLastError SetLastError DeleteFileW GetFileAttributesW CreateDirectoryW GetModuleHandleW GetModuleFileNameW GetCurrentProcess GetProcAddress WriteConsoleW ReadConsoleW HeapSize SetUnhandledExceptionFilter GetStringTypeW DecodePointer IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException UnhandledExceptionFilter

user32

SendMessageW ShowWindow GetDlgItem EnableWindow InvalidateRect SetWindowTextW GetParent DialogBoxParamW EndDialog SetDlgItemTextW GetDlgItemTextW CheckDlgButton IsDlgButtonChecked OemToCharA LoadIconW GetSysColor SetForegroundWindow MessageBoxW GetDesktopWindow ReleaseDC GetDC IsWindowVisible IsWindow CharUpperW SendDlgItemMessageW LoadStringW GetWindow GetClassNameW SetProcessDefaultLayout SetWindowLongW GetWindowLongW GetWindowRect GetClientRect GetSystemMetrics SetWindowPos

gdi32

GetDeviceCaps DeleteObject CreateFontW

advapi32

RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc SHChangeNotify SHGetFolderPathW SHFileOperationW

ole32

OleUninitialize OleInitialize CoCreateInstance

Name

.text

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

180KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

generic