2026-10-10_b1c5023ed0df64f175e24de4b6a27bc4_amadey_elex_luca-stealer_magniber_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_b1c5023ed0df64f175e24de4b6a27bc4_amadey_elex_luca-stealer_magniber_njrat_remcos
Size 3.8MB
Sample261011-ftvm8afv4z
SHA256 6e03c1611ba8f824dd997a6499f4b7a71e32fe8e3b0985123867a822fb2e129d
MD5 b1c5023ed0df64f175e24de4b6a27bc4
SHA1 30f33e4de4753058a16943f754e35b718049b11f
SHA512 23caa1023b9c72a23024b5acd9860f20ab6fe5340793841de67f16496f9036b871adf91786b12e3fd78e029684a6cd58bbff5b2fc9b66b7d6270158cc690caa8
SSDEEP 98304:xKMDOeAQqbjHCJGk3JI7A9tGAXD6qbBdAgBW:xK6iQqbVyfz6q3t
TLSH
T1D4069E207A46C637DA5201B04A6CDE9F505DBD241F7054C7F3C81F6EA9B4AD31A32EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_b1c5023ed0df64f175e24de4b6a27bc4_amadey_elex_luca-stealer_magniber_njrat_remcos

File Explorer

2026-10-10_b1c5023ed0df64f175e24de4b6a27bc4_amadey_elex_luca-stealer_magniber_njrat_remcos

.exe 3.8MB

2026-10-10_b1c5023ed0df64f175e24de4b6a27bc4_amadey_elex_luca-stealer_magniber_njrat_remcos

IMPHASH 60de0069d19190e7828858c651321c8d
SHA256 6e03c1611ba8f824dd997a6499f4b7a71e32fe8e3b0985123867a822fb2e129d
MD5 b1c5023ed0df64f175e24de4b6a27bc4
SHA1 30f33e4de4753058a16943f754e35b718049b11f
SHA512 23caa1023b9c72a23024b5acd9860f20ab6fe5340793841de67f16496f9036b871adf91786b12e3fd78e029684a6cd58bbff5b2fc9b66b7d6270158cc690caa8
SSDEEP 98304:xKMDOeAQqbjHCJGk3JI7A9tGAXD6qbBdAgBW:xK6iQqbVyfz6q3t
TLSH
T1D4069E207A46C637DA5201B04A6CDE9F505DBD241F7054C7F3C81F6EA9B4AD31A32EAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1506226

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345softmgr-build\SoftMgr\main\bin\Win32\release\pdb\2345SoftMgr.pdb

crypt32

CryptMsgClose CryptDecodeObject CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertCloseStore CryptQueryObject CertFreeCertificateContext

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

GetDriveTypeW GetCurrentThread GetVolumeInformationW GetDiskFreeSpaceW GetLogicalDriveStringsW InterlockedCompareExchange FlushInstructionCache VirtualAlloc VirtualFree VirtualProtect VirtualQuery GetThreadContext SetThreadContext SuspendThread ResumeThread SetLastError WaitForMultipleObjects BeginUpdateResourceW UpdateResourceW EndUpdateResourceW ReadFile SetEndOfFile GetFileSize GetComputerNameW GetTickCount WaitForSingleObject SetEvent GetACP GetVersion InterlockedExchange InterlockedExchangeAdd lstrlenW GetPrivateProfileStringW GetModuleHandleW GetVersionExW GetFileAttributesW ExpandEnvironmentStringsW GetCurrentProcess Sleep GetProcessHeap HeapAlloc GlobalFree GlobalAlloc OpenProcess HeapFree DeleteFileW lstrcpyW LocalFree lstrcmpA EnumResourceNamesW SizeofResource GetUserDefaultLangID WriteConsoleW LocalAlloc CreateFileMappingW FileTimeToLocalFileTime FileTimeToSystemTime GetLocalTime GetCurrentThreadId CreateFileW SetFilePointer GetModuleFileNameW WriteFile GetProcAddress GetWindowsDirectoryW CreateDirectoryW GetEnvironmentVariableW SetEnvironmentVariableW FreeLibrary GetCurrentProcessId DeleteCriticalSection DecodePointer LoadLibraryW RaiseException InitializeCriticalSectionAndSpinCount MoveFileExW CloseHandle GetLastError HeapSize SetStdHandle OutputDebugStringA SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx HeapReAlloc SetConsoleCtrlHandler GetModuleFileNameA ExitProcess GetModuleHandleExW CreateMutexW GlobalMemoryStatusEx FreeLibraryAndExitThread ExitThread InterlockedFlushSList InterlockedPushEntrySList RtlUnwind GetFileType GetStdHandle WaitNamedPipeW TransactNamedPipe DuplicateHandle SetNamedPipeHandleState VirtualQueryEx OpenThread InterlockedIncrement CreateSemaphoreW CreateThread TerminateThread GetProcessId InterlockedDecrement ReleaseSemaphore RtlCaptureContext WritePrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileSectionW GetSystemDirectoryW FindFirstFileW FindNextFileW DeviceIoControl FindClose CreateProcessW QueryInformationJobObject WriteProcessMemory AssignProcessToJobObject CreateJobObjectW IsProcessInJob GetModuleHandleA VirtualAllocEx CreateRemoteThread TerminateJobObject GetExitCodeProcess GetLongPathNameW GetShortPathNameW GetFileAttributesExW SearchPathW MultiByteToWideChar WideCharToMultiByte LoadLibraryA LockResource GetSystemInfo LoadResource FindResourceW lstrcmpiW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ReleaseMutex OpenMutexW QueryDosDeviceW LoadLibraryExW OpenFileMappingW UnmapViewOfFile MapViewOfFile OpenEventW CreateEventW ResetEvent SetFileTime GetFileTime GetComputerNameExW LocalFileTimeToFileTime SystemTimeToFileTime GetSystemTime DosDateTimeToFileTime FileTimeToDosDateTime TerminateProcess GetFullPathNameW RemoveDirectoryW GetTempPathW SetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW CopyFileW GetTempFileNameW MoveFileW lstrcatW GetFileSizeEx FormatMessageW GetStringTypeW EncodePointer GetCPInfo SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead OutputDebugStringW

user32

GetClassNameW GetDesktopWindow GetForegroundWindow SetFocus AttachThreadInput WindowFromPoint GetShellWindow GetSystemMetrics SetWindowPos GetFocus CreateIconFromResourceEx PrivateExtractIconsW UnregisterClassW GetWindowThreadProcessId DestroyIcon LookupIconIdFromDirectoryEx LoadImageW MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetWindowTextLengthW GetDC IsWindowVisible EnumChildWindows IsWindow EnumDesktopWindows ReleaseDC GetActiveWindow GetParent GetWindowRect FindWindowW SendMessageW GetIconInfo OpenDesktopW CloseDesktop GetWindowTextW

advapi32

RegOpenKeyExW IsValidSid OpenServiceW StartServiceW OpenSCManagerW CloseServiceHandle GetTokenInformation GetLengthSid ConvertSidToStringSidW ReportEventW RegisterEventSourceW DeregisterEventSource SetEntriesInAclW FreeSid OpenProcessToken SystemFunction036 CheckTokenMembership RegCloseKey RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegDeleteValueW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges SetNamedSecurityInfoW RegQueryValueExW EqualSid AllocateAndInitializeSid

shell32

SHGetFileInfoW SHFileOperationW ShellExecuteExW SHGetMalloc SHGetDesktopFolder SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteW SHChangeNotify SHGetSpecialFolderLocation ExtractIconExW SHGetPathFromIDListW DuplicateIcon ord727

ole32

OleInitialize CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree OleUninitialize CreateStreamOnHGlobal

oleaut32

SysFreeString VariantClear SysAllocString

shlwapi

SHDeleteKeyW PathRemoveFileSpecW PathFileExistsW

wininet

InternetGetConnectedState InternetCheckConnectionW

iphlpapi

GetAdaptersInfo

imagehlp

ImageEnumerateCertificates ImageRemoveCertificate

gdiplus

GdipGetImageHeight GdipGetImageEncoders GdipLoadImageFromFileICM GdipCloneImage GdipLoadImageFromFile GdipDisposeImage GdipCreateHICONFromBitmap GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipFree GdipGetImageRawFormat GdipGetImageEncodersSize GdipGetImageWidth GdiplusShutdown GdiplusStartup GdipAlloc GdipSaveImageToFile

gdi32

DeleteDC DeleteObject CreateCompatibleDC CreateFontIndirectW GetObjectW GetStockObject GetTextExtentPointW GetTextExtentExPointW SelectObject GetDIBits

generic

count=15, id=241, version=40116,

count=167, id=243, version=40116,

count=30, id=242, version=40116,

count=2, productName=Unmarked objects (old),

count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=26, id=259, version=26706,

count=71, id=261, version=26706,

count=35, id=260, version=26706,

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=261, version=27032,

count=2, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=353, id=1, productName=Unmarked objects,

count=192, id=265, version=27050,

count=1, id=256, version=27050,

count=1, id=255, version=27050,

count=2, id=151,

count=1, id=258, version=27050,