2026-10-02_70d441a84961ba533d22117e99926067_amadey_elex_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_70d441a84961ba533d22117e99926067_amadey_elex_luca-stealer_magniber_njrat_remcos
Size 2.1MB
Sample261003-me4e5sweqb
SHA256 78e8ed0bda521f87be690bbce84b2a10e41f47e04d35d7b12d7975077355e39d
MD5 70d441a84961ba533d22117e99926067
SHA1 c5d0a5d6bad5dc6d838275c7413c051a5b865077
SHA512 efabe9e9f9ebeece357a614beedd4d27cf749e6ed1579e12877c96700dba9b9657cf148d06e417830e0187267876423d99164adfe35c4d02a73ff1c52efc8f37
SSDEEP 24576:ECk1xB6B9YNgqe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+UPiQnDJGaz9:UK0eqkSR7Xgo4TiRPnLWvJvnDJJh
TLSH
T15DA502127CE18431C17375305A7EE766197DBC301EE16A2F27DC2A3A6E74181BB25A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_70d441a84961ba533d22117e99926067_amadey_elex_luca-stealer_magniber_njrat_remcos

File Explorer

2026-10-02_70d441a84961ba533d22117e99926067_amadey_elex_luca-stealer_magniber_njrat_remcos

.exe 2.1MB

2026-10-02_70d441a84961ba533d22117e99926067_amadey_elex_luca-stealer_magniber_njrat_remcos

IMPHASH 4b83772a0b9225dc561d3a4bc21e9bbd
SHA256 78e8ed0bda521f87be690bbce84b2a10e41f47e04d35d7b12d7975077355e39d
MD5 70d441a84961ba533d22117e99926067
SHA1 c5d0a5d6bad5dc6d838275c7413c051a5b865077
SHA512 efabe9e9f9ebeece357a614beedd4d27cf749e6ed1579e12877c96700dba9b9657cf148d06e417830e0187267876423d99164adfe35c4d02a73ff1c52efc8f37
SSDEEP 24576:ECk1xB6B9YNgqe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+UPiQnDJGaz9:UK0eqkSR7Xgo4TiRPnLWvJvnDJJh
TLSH
T15DA502127CE18431C17375305A7EE766197DBC301EE16A2F27DC2A3A6E74181BB25A3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb

comctl32

CreateStatusWindowW InitCommonControlsEx

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

wsock32

gethostname WSAStartup gethostbyname inet_addr WSACleanup

winmm

mciSendStringW timeGetTime

kernel32

GetTempPathW GetTempFileNameW DeleteFileW CopyFileW CreateFileW SetFileTime CloseHandle LoadLibraryA GetProcAddress CreateFileMappingW MapViewOfFile UnmapViewOfFile GetSystemTimeAsFileTime SystemTimeToFileTime GetFileSize InterlockedIncrement InterlockedDecrement GetModuleHandleW GetModuleFileNameW InitializeCriticalSection IsDebuggerPresent lstrcmpiW GetCurrentDirectoryW SetCurrentDirectoryW GetFullPathNameW lstrlenW ReadFile CreateProcessW GetExitCodeProcess Sleep WideCharToMultiByte CompareStringW CompareStringA GetCommandLineW FindResourceW EnumResourceNamesW BeginUpdateResourceW SetFilePointer UpdateResourceW EndUpdateResourceW GetVersionExW IsWow64Process GetCurrentProcess GetSystemInfo DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount WriteFile DuplicateHandle GetStdHandle CreatePipe CreateThread InterlockedExchange TerminateThread WaitForSingleObject SetFilePointerEx SetEndOfFile FlushFileBuffers GetLastError GetCurrentThread OpenProcess TerminateProcess CreateToolhelp32Snapshot SizeofResource Process32NextW GetFileAttributesW FindFirstFileW FindClose GetLongPathNameW GetShortPathNameW FindNextFileW CopyFileExW MoveFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceCounter QueryPerformanceFrequency OutputDebugStringW DeviceIoControl LoadLibraryW GetLocalTime GetFileTime IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetTimeFormatW GetDateFormatW GetStringTypeW GetFileType GetConsoleCP HeapAlloc ReadConsoleW GetConsoleMode HeapFree GetACP GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer HeapReAlloc SetLastError InterlockedFlushSList InterlockedPushEntrySList RaiseException RtlUnwind InitializeSListHead GetCurrentProcessId GetStartupInfoW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter LoadResource FindResourceExW FreeLibrary LoadLibraryExW MultiByteToWideChar GetCurrentThreadId GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetProcessHeap SetConsoleCtrlHandler OutputDebugStringA WriteConsoleW LockResource DecodePointer HeapSize Process32FirstW

user32

DialogBoxParamW EnableMenuItem GetClassNameW EndDialog GetSystemMenu SetActiveWindow CharLowerBuffW EnumThreadWindows FindWindowExW IsWindow EnumChildWindows ExitWindowsEx mouse_event CreateIconFromResourceEx MonitorFromRect MonitorFromPoint GetDC ReleaseDC LoadCursorW MessageBeep GetDlgItemTextW ChildWindowFromPointEx DefWindowProcW SetCursor PostQuitMessage RegisterClassExW LoadIconW LoadImageW GetDlgItem DispatchMessageW TranslateMessage IsDialogMessageW TranslateAcceleratorW GetMessageW SetFocus UpdateWindow SendDlgItemMessageW CheckMenuItem GetMenu CheckMenuRadioItem SetDlgItemTextW CreateDialogParamW LoadAcceleratorsW MessageBoxA DestroyIcon LoadStringW MessageBoxW CharUpperBuffW IsWindowEnabled IsWindowVisible PostMessageW ShowWindow EnableWindow MoveWindow ScreenToClient GetWindowRect InvalidateRect SendMessageW GetParent GetWindowLongW GetWindowThreadProcessId AttachThreadInput SendMessageTimeoutW

gdi32

GetTextExtentPoint32W GetStockObject GetDeviceCaps

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegCreateKeyExW FreeSid CheckTokenMembership AllocateAndInitializeSid InitiateSystemShutdownExW LookupPrivilegeValueW OpenProcessToken OpenThreadToken RegOpenKeyExW RegCloseKey RegQueryValueExW RegSetValueExW AdjustTokenPrivileges

shell32

SHFileOperationW SHGetFolderPathW DragQueryPoint DragQueryFileW DragFinish

ole32

CreateStreamOnHGlobal

oleaut32

SafeArrayGetVartype SysFreeString VarR8FromDec VariantTimeToSystemTime SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptorEx SafeArrayCreateVector SysAllocString VariantCopy VariantClear VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_70d441a84961ba533d22117e99926067_amadey_elex_luca-stealer_magniber_njrat_remcos

comctl32

version

wsock32

winmm

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic