2026-09-29_53da079b792bb34d4b38bcac0b73b924_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_53da079b792bb34d4b38bcac0b73b924_amadey_elex_luca-stealer_njrat_remcos_smoke-loader
Size 1.5MB
Sample260930-bcdadszw2k
SHA256 ddf338aca506d404ec64fd22272d908a7e5ec4fcd71901d31e37c8703066ea21
MD5 53da079b792bb34d4b38bcac0b73b924
SHA1 7f220c18ed19d3fc5c8e2770130d88a6a60f168f
SHA512 a1e649f36e4955773738da74caec121ce7a8913544b26c39616346b399c216a6fa8761c0abb77f62001f51ffbc79f5aca01caccdd7028c3f572ec779759d6406
SSDEEP 24576:06iR2aKngL2jdshRTdG1YxITqvfPkbIcbjLbfJ4yL/tNCJPXUQrPq:5ikarSj8RoTCCrfJ4klKXnC
TLSH
T19F652326B9C1C071D5770A301AE8D6642E7D7FB00B1B8ADFCBD01A796FB85D2523C662
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_53da079b792bb34d4b38bcac0b73b924_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-09-29_53da079b792bb34d4b38bcac0b73b924_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 1.5MB

2026-09-29_53da079b792bb34d4b38bcac0b73b924_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 059b33fd4d5cd64b760068294be04d72
SHA256 ddf338aca506d404ec64fd22272d908a7e5ec4fcd71901d31e37c8703066ea21
MD5 53da079b792bb34d4b38bcac0b73b924
SHA1 7f220c18ed19d3fc5c8e2770130d88a6a60f168f
SHA512 a1e649f36e4955773738da74caec121ce7a8913544b26c39616346b399c216a6fa8761c0abb77f62001f51ffbc79f5aca01caccdd7028c3f572ec779759d6406
SSDEEP 24576:06iR2aKngL2jdshRTdG1YxITqvfPkbIcbjLbfJ4yL/tNCJPXUQrPq:5ikarSj8RoTCCrfJ4klKXnC
TLSH
T19F652326B9C1C071D5770A301AE8D6642E7D7FB00B1B8ADFCBD01A796FB85D2523C662
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\FixedTrayIcon\Release\NetmProxy.pdb

kernel32

CreateFileW GetLastError OutputDebugStringW RaiseException DecodePointer DeleteCriticalSection GetCurrentProcessId GetModuleHandleW LoadLibraryExW FreeResource LockResource LoadResource SizeofResource FindResourceW GetSystemWindowsDirectoryW GetVersionExW Sleep InterlockedCompareExchange EnterCriticalSection FreeLibrary LeaveCriticalSection CopyFileW WriteConsoleW FlushFileBuffers InitializeCriticalSection GetTempPathW GetModuleFileNameW GetProcAddress LoadLibraryW OpenProcess CloseHandle GetCurrentProcess InterlockedIncrement lstrlenW InitializeCriticalSectionAndSpinCount GetConsoleCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW GetConsoleMode DeviceIoControl IsDebuggerPresent SetLastError GetSystemTimeAsFileTime SystemTimeToFileTime LocalFileTimeToFileTime CreateFileA GetFileSizeEx WriteFile ReadFile SetFilePointerEx HeapAlloc HeapFree GetProcessHeap HeapLock HeapUnlock HeapWalk GetCurrentThreadId OpenThread ReleaseMutex WaitForSingleObject TlsAlloc TlsGetValue TlsSetValue TlsFree CreateMutexW SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind EncodePointer ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetACP GetStringTypeW GetFileType HeapSize HeapReAlloc LCMapStringW FindClose InterlockedDecrement

user32

FindWindowW GetWindowThreadProcessId CharNextW LoadStringW CharLowerW

advapi32

RegQueryValueExW DuplicateTokenEx AdjustTokenPrivileges FreeSid GetLengthSid SetTokenInformation AllocateAndInitializeSid CreateRestrictedToken OpenProcessToken LookupPrivilegeValueW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExA

ole32

CoCreateInstance CoUninitialize CoInitialize

shlwapi

PathAppendW PathCombineW StrStrIW PathFileExistsW PathRemoveFileSpecW

version

VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_53da079b792bb34d4b38bcac0b73b924_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

advapi32

ole32

shlwapi

version

generic