2026-10-10_1e510fa337ac016dcdd0f84924c162b1_amadey_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_1e510fa337ac016dcdd0f84924c162b1_amadey_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader
Size 543KB
Sample261011-ya4e5afh69
SHA256 16d1171ec2ea6e47cb84409161b39582943c346cd31a31b1e73db0004ea86cd8
MD5 1e510fa337ac016dcdd0f84924c162b1
SHA1 862956b69b2c95ca35c0fa59057f79c4130ec644
SHA512 30b467e5c6bb1c43dfd86eeade76e923b2a3201fb6a123ed697a0c901780fc92ef10dd27e0766106f5fbb21aad21684aad9e8a9c0edf971265cb221521edc889
SSDEEP 6144:fCk/uRjpuh3eboQCjXW+AOVo48kldxB+6eS:ak/6jpuhObYW+L8MW6eS
TLSH
T107C46A2DB6818C71D57E1B3405E8E6734ABAAD3029358D5F93F43B2A3F301D27923696
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-10_1e510fa337ac016dcdd0f84924c162b1_amadey_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

.exe 543KB

2026-10-10_1e510fa337ac016dcdd0f84924c162b1_amadey_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

IMPHASH 78833e27d66c7f7ca8d1d6dece34d2a5
SHA256 16d1171ec2ea6e47cb84409161b39582943c346cd31a31b1e73db0004ea86cd8
MD5 1e510fa337ac016dcdd0f84924c162b1
SHA1 862956b69b2c95ca35c0fa59057f79c4130ec644
SHA512 30b467e5c6bb1c43dfd86eeade76e923b2a3201fb6a123ed697a0c901780fc92ef10dd27e0766106f5fbb21aad21684aad9e8a9c0edf971265cb221521edc889
SSDEEP 6144:fCk/uRjpuh3eboQCjXW+AOVo48kldxB+6eS:ak/6jpuhObYW+L8MW6eS
TLSH
T107C46A2DB6818C71D57E1B3405E8E6734ABAAD3029358D5F93F43B2A3F301D27923696
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

92:b5:c3:61:b0:78:dd:5e:60:5e:05:b1:df:cc:92:54:1e:1b:36:50:e7:a0:49:07:12:7a:16:7b:b1:c7:e2:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=913100006317722856,CN=Shanghai Orient Webcasting Co.\, Ltd.,O=Shanghai Orient Webcasting Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 7, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0c:d7:af:1e:13:3e:af:9a:7e:18:d9:bb:96:c0:12:88

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 17, 2026 - Mar 28, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

61422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

shlwapi

PathFileExistsW PathAppendW PathAddBackslashW

imm32

ImmInstallIMEW ImmGetIMEFileNameW ImmSetHotKey

kernel32

ReadFile FindClose CloseHandle GetTempPathW CreateFileW GetFileAttributesExW DeleteFileW FindNextFileW CopyFileW MoveFileExW GetCurrentProcessId LoadLibraryW FreeLibrary GetProcAddress GetLongPathNameW GetEnvironmentVariableW GetSystemDirectoryW CreateDirectoryW WTSGetActiveConsoleSessionId LocalFree GetCurrentProcess GetCurrentThreadId WaitForSingleObject GetTickCount GetModuleHandleW SetUnhandledExceptionFilter SetErrorMode GlobalAlloc GlobalFree LocalAlloc OpenProcess GetExitCodeProcess lstrcmpiW CreateProcessW GetLastError Process32FirstW Process32NextW LockResource LoadResource WriteFile FindResourceW FindResourceExW GetSystemWow64DirectoryW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage GetTimeZoneInformation SetFilePointerEx FlushFileBuffers GetConsoleCP ReadConsoleW GetConsoleMode GetFileType GetCurrentThread GetACP GetStdHandle GetModuleHandleExW GetFileSize WideCharToMultiByte RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy DecodePointer WritePrivateProfileStringW GetPrivateProfileStringW GetModuleFileNameW lstrlenW MultiByteToWideChar DeleteCriticalSection SizeofResource InitializeCriticalSectionAndSpinCount CreateToolhelp32Snapshot ExitProcess FindFirstFileExW LoadLibraryExW RtlUnwind OutputDebugStringW InitializeSListHead GetStartupInfoW GetThreadTimes IsDebuggerPresent QueryPerformanceCounter EncodePointer SetLastError CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetStringTypeW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent

user32

GetKeyboardLayoutList LoadKeyboardLayoutW UnloadKeyboardLayout MessageBoxW

advapi32

RegCreateKeyW RegQueryInfoKeyW RegEnumKeyExW DuplicateTokenEx LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation OpenProcessToken RegOpenKeyW RegEnumKeyW RegDeleteValueW RegDeleteKeyW ImpersonateLoggedOnUser RevertToSelf RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegEnumValueW

shell32

SHGetFolderPathW SHGetSpecialFolderPathA SHGetSpecialFolderPathW

wtsapi32

WTSQueryUserToken

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

284KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_1e510fa337ac016dcdd0f84924c162b1_amadey_elex_luca-stealer_medusalocker_mespinoza_njrat_remcos_smoke-loader

version

shlwapi

imm32

kernel32

user32

advapi32

shell32

wtsapi32

generic