2026-10-25_c75628ec5c1815c74e9e7b8b170ee304_amadey_elex_luca-stealer_njrat_remcos_smoke-loader_virut

General

Target
2026-10-25_c75628ec5c1815c74e9e7b8b170ee304_amadey_elex_luca-stealer_njrat_remcos_smoke-loader_virut
Size 223KB
Sample261026-pyw7aae12l
SHA256 e4b77e3a0630495b2476f0c938746a563958fbd230beff8e4e8ae4728e88b81a
MD5 c75628ec5c1815c74e9e7b8b170ee304
SHA1 4d7cf3d71376ae78529e9be2e776acc9a8d2d637
SHA512 569a378a32367ae05be08a856aaf84fad67a69618116423afde665274f4ac29f1b530f1c6a0f403543208fdf702228f9fa2386f107724e16e821303855821904
SSDEEP 3072:5Tz9Q89N7TK8/5zfWkivUIQC2mClHM68rOG4JAGN6is8cdCf3hCFb7Wweb/K:5Tz9Q89o8/JfWk9s0dJjN347DeO
TLSH
T1E2248C21BC82C472D1B6093056F9C7756A7CBD302B654E9F93941B39AF342C26639BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-25_c75628ec5c1815c74e9e7b8b170ee304_amadey_elex_luca-stealer_njrat_remcos_smoke-loader_virut

File Explorer

2026-10-25_c75628ec5c1815c74e9e7b8b170ee304_amadey_elex_luca-stealer_njrat_remcos_smoke-loader_virut

.exe 223KB

2026-10-25_c75628ec5c1815c74e9e7b8b170ee304_amadey_elex_luca-stealer_njrat_remcos_smoke-loader_virut

IMPHASH 63309d96f83103cbd702e7797cb9eb70
SHA256 e4b77e3a0630495b2476f0c938746a563958fbd230beff8e4e8ae4728e88b81a
MD5 c75628ec5c1815c74e9e7b8b170ee304
SHA1 4d7cf3d71376ae78529e9be2e776acc9a8d2d637
SHA512 569a378a32367ae05be08a856aaf84fad67a69618116423afde665274f4ac29f1b530f1c6a0f403543208fdf702228f9fa2386f107724e16e821303855821904
SSDEEP 3072:5Tz9Q89N7TK8/5zfWkivUIQC2mClHM68rOG4JAGN6is8cdCf3hCFb7Wweb/K:5Tz9Q89o8/JfWk9s0dJjN347DeO
TLSH
T1E2248C21BC82C472D1B6093056F9C7756A7CBD302B654E9F93941B39AF342C26639BB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3d:c7:32:20:b6:01:5f:da:df:76:16:72:3a:9a:8a:8c:f1:6d:d1:d7:66:9c:de:70:ef:ed:c7:b2:f9:58:36:36

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 29, 2024

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

29:5b:f8:6e:85:26:53:40:33:13:83:7b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

1

Major OS version

5

Entry point

235834

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\810608\out\Release\wdsandbox.pdb

kernel32

CreateFileW GetCurrentThreadId GetVersionExW GetSystemDirectoryW GetLastError CloseHandle RaiseException GetEnvironmentVariableW DecodePointer GetProcAddress DeleteCriticalSection GetCurrentProcessId FreeLibrary LoadLibraryExW SetUnhandledExceptionFilter GetModuleFileNameW InitializeCriticalSectionAndSpinCount DeviceIoControl GetCurrentProcess LoadLibraryW WriteConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection SetLastError GetSystemTimeAsFileTime SystemTimeToFileTime LocalFileTimeToFileTime CreateFileA GetFileSizeEx WriteFile SetFilePointerEx HeapAlloc HeapFree GetProcessHeap HeapLock HeapUnlock HeapWalk OpenThread ReleaseMutex WaitForSingleObject TlsAlloc TlsGetValue TlsSetValue TlsFree CreateMutexW UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter InitializeSListHead RtlUnwind EncodePointer ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetACP LCMapStringW GetFileType HeapSize HeapReAlloc GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW ReadFile

user32

PostThreadMessageW GetMessageW GetInputState

shlwapi

PathMatchSpecW PathCombineW

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_c75628ec5c1815c74e9e7b8b170ee304_amadey_elex_luca-stealer_njrat_remcos_smoke-loader_virut

PE Signature issue

kernel32

user32

shlwapi

advapi32

generic