2026-10-15_05eeb52a8a73c84860f32d7887989bd0_amadey_blankgrabber_elex_helldown_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-15_05eeb52a8a73c84860f32d7887989bd0_amadey_blankgrabber_elex_helldown_luca-stealer_njrat_remcos_smoke-loader
Size 1.2MB
Sample261017-ae26vsft4x
SHA256 6f8e0fd84a7ed447d44968341a9fd68ce0481cf296eb8e82750a5782ce6c4b4f
MD5 05eeb52a8a73c84860f32d7887989bd0
SHA1 357492a7e66a808bd37321257719b69f04c41660
SHA512 272b2f3a4e59301ec2e226904251b62e31349c80feef694cc274d7b8ae445b062badbb257bf2dd1ba8029aca00daa28307e4c1a467ae8975e38d6858cd1721f7
SSDEEP 24576:w8XxtryeKKG9txye6bOQpgIEQWNVyrunbaj478nvGaWp4:nxtXu7+FUpVyrunWj4QnvGaWp4
TLSH
T1D3559D22B605C032D56101F0662DEFF1929C69301BAB64C7B3E86E7A67715C3A739F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-15_05eeb52a8a73c84860f32d7887989bd0_amadey_blankgrabber_elex_helldown_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-10-15_05eeb52a8a73c84860f32d7887989bd0_amadey_blankgrabber_elex_helldown_luca-stealer_njrat_remcos_smoke-loader

.exe 1.2MB

2026-10-15_05eeb52a8a73c84860f32d7887989bd0_amadey_blankgrabber_elex_helldown_luca-stealer_njrat_remcos_smoke-loader

IMPHASH d7b78475baf72571994afb74cee8fb98
SHA256 6f8e0fd84a7ed447d44968341a9fd68ce0481cf296eb8e82750a5782ce6c4b4f
MD5 05eeb52a8a73c84860f32d7887989bd0
SHA1 357492a7e66a808bd37321257719b69f04c41660
SHA512 272b2f3a4e59301ec2e226904251b62e31349c80feef694cc274d7b8ae445b062badbb257bf2dd1ba8029aca00daa28307e4c1a467ae8975e38d6858cd1721f7
SSDEEP 24576:w8XxtryeKKG9txye6bOQpgIEQWNVyrunbaj478nvGaWp4:nxtXu7+FUpVyrunWj4QnvGaWp4
TLSH
T1D3559D22B605C032D56101F0662DEFF1929C69301BAB64C7B3E86E7A67715C3A739F1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

729753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

InitCommonControlsEx

shell32

CommandLineToArgvW SHGetFolderPathW

user32

UpdateWindow MessageBoxW RegisterWindowMessageW SendMessageTimeoutW PostMessageW EnumWindows GetClassNameW GetWindowThreadProcessId GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW DefWindowProcW RegisterClassExW GetMonitorInfoW MonitorFromPoint LoadImageW LoadCursorW SetWindowLongW GetWindowLongW GetCursorPos GetWindowRect CreateWindowExW SetWindowTextW GetSystemMetrics KillTimer SetTimer MsgWaitForMultipleObjects SetWindowPos ShowWindow DestroyWindow IsWindow

bcrypt

BCryptGenRandom

ws2_32

htonl WSASetLastError WSACleanup __WSAFDIsSet closesocket connect ioctlsocket getsockopt WSAGetLastError htons recv select send socket WSAStartup

advapi32

ConvertSidToStringSidW IsValidSid GetTokenInformation GetLengthSid EqualSid OpenProcessToken

kernel32

GetACP IsValidCodePage HeapReAlloc GetConsoleOutputCP GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue GetCommandLineA GetFileType HeapAlloc HeapFree ExitProcess GetStdHandle ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapSize GetOEMCP FlsAlloc GetCommandLineW CloseHandle GetLastError SetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects GetCurrentProcessId TerminateProcess CreateProcessW LocalFree CreateFileW DeleteFileW FlushFileBuffers GetFileAttributesW GetFileSizeEx ReadFile WriteFile Sleep GetModuleFileNameW FormatMessageW MoveFileExW MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableW GetDiskFreeSpaceExW GetFileInformationByHandle LockFileEx SetEndOfFile SetFileInformationByHandle SetFilePointerEx UnlockFileEx SetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive CreateThread GetCurrentThreadId GetSystemTime GetSystemTimeAsFileTime GetTickCount64 FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW GetFileInformationByHandleEx GetHandleInformation SetHandleInformation ResetEvent OpenEventW CompareFileTime GetFinalPathNameByHandleW GetShortPathNameW ReleaseMutex CreateMutexW OpenMutexW GetProcessTimes GetProcessId OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess GetExitCodeProcess GetModuleHandleW CopyFileW CompareStringOrdinal LoadLibraryExW GetProcAddress LoadResource LockResource SizeofResource FindResourceW GetStringTypeW RaiseException FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW AreFileApisANSI WaitForSingleObjectEx GetExitCodeThread TryAcquireSRWLockExclusive QueryPerformanceCounter WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WriteConsoleW

Name

.text

Size

885KB

Virtual Size

885KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

223KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-15_05eeb52a8a73c84860f32d7887989bd0_amadey_blankgrabber_elex_helldown_luca-stealer_njrat_remcos_smoke-loader

comctl32

shell32

user32

bcrypt

ws2_32

advapi32

kernel32

generic