2026-10-25_ba845102365c4318b0cd889af928b53b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_ba845102365c4318b0cd889af928b53b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader
Size 1.0MB
Sample261026-rtpmrabc58
SHA256 e786482e7c2bfe1ad882c431169db065fdedeb56b4d5cbd022723d2b64492516
MD5 ba845102365c4318b0cd889af928b53b
SHA1 dbe95f14aeee74b9240c8e99d198057dd4f23318
SHA512 18fafc291de6debd8282224e2af2c26981f74e489f5e47d887a4564439f4acb055c0fe2b56e2596d432e3fc7c596b92678e43294790a9efd57638c95f308a001
SSDEEP 24576:LxcVlzdm2SrGx5as41fgKwP3Cae2Xt/DQc:C7Y2Sr+5as4EP3F
TLSH
T13D25122176D18876E1B309324DB9AAB249FD79260D32CF6B07D0095E8E716D1E639F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_ba845102365c4318b0cd889af928b53b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-10-25_ba845102365c4318b0cd889af928b53b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 1.0MB

2026-10-25_ba845102365c4318b0cd889af928b53b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH a63b58dc533753d34a565aee7faaff95
SHA256 e786482e7c2bfe1ad882c431169db065fdedeb56b4d5cbd022723d2b64492516
MD5 ba845102365c4318b0cd889af928b53b
SHA1 dbe95f14aeee74b9240c8e99d198057dd4f23318
SHA512 18fafc291de6debd8282224e2af2c26981f74e489f5e47d887a4564439f4acb055c0fe2b56e2596d432e3fc7c596b92678e43294790a9efd57638c95f308a001
SSDEEP 24576:LxcVlzdm2SrGx5as41fgKwP3Cae2Xt/DQc:C7Y2Sr+5as4EP3F
TLSH
T13D25122176D18876E1B309324DB9AAB249FD79260D32CF6B07D0095E8E716D1E639F33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleCrashHandler_unsigned.pdb

kernel32

GetProcessHeap DeleteCriticalSection GetModuleHandleW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetACP GetCurrentThread LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType OutputDebugStringA CloseHandle CreateThread SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetProcAddress SetFilePointerEx WriteConsoleW CreateFileW CreateDirectoryW SizeofResource RemoveDirectoryW WaitForMultipleObjects GetEnvironmentVariableW WaitForSingleObject ReleaseMutex DuplicateHandle LockResource DeleteFileW LoadLibraryW FindResourceExW LoadResource FindResourceW LocalFree lstrcmpiW WaitNamedPipeW GetTickCount GetExitCodeProcess GetTempPathW VirtualQuery OpenProcess Sleep ReadProcessMemory ReadFile lstrlenW SetFilePointer GetFileAttributesExW MoveFileExW GetFileTime CreateProcessW SetProcessWorkingSetSize GetPrivateProfileIntW GetPrivateProfileStringW GetLocalTime lstrcmpW VerSetConditionMask VerifyVersionInfoW TryEnterCriticalSection InitializeCriticalSection CreateMutexW CreateEventW SetEvent ResetEvent lstrcpynW GlobalAlloc GlobalFree GlobalLock GlobalUnlock WaitForDebugEvent GetProcessId DebugActiveProcessStop ContinueDebugEvent GetSystemInfo GetThreadContext DebugActiveProcess VirtualQueryEx SetNamedPipeHandleState CreateSemaphoreW ReleaseSemaphore RtlCaptureContext HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError TransactNamedPipe GetSystemDefaultLangID GetUserDefaultLangID DeviceIoControl GetComputerNameExW ConnectNamedPipe GetOverlappedResult DisconnectNamedPipe CreateNamedPipeW GetProcessTimes UnregisterWait UnregisterWaitEx RegisterWaitForSingleObject VirtualProtect VirtualAlloc HeapSize InitializeCriticalSectionAndSpinCount GetConsoleMode HeapFree

user32

GetWindowThreadProcessId IsWindowVisible EnumWindows CharUpperW GetProcessWindowStation SetProcessWindowStation GetMessageW DispatchMessageW PeekMessageW PostThreadMessageW OpenClipboard CloseClipboard EmptyClipboard SetClipboardData MessageBoxW CreateDesktopW CloseDesktop GetThreadDesktop SetThreadDesktop CloseWindowStation CreateWindowStationW wvsprintfW CharLowerW wsprintfW

advapi32

SetTokenInformation TraceEvent GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids GetTokenInformation SetSecurityDescriptorGroup MakeAbsoluteSD MakeSelfRelativeSD GetSecurityDescriptorLength GetLengthSid InitializeAcl InitializeSecurityDescriptor OpenProcessToken AddAce IsValidSid GetSecurityDescriptorOwner InitializeSid ConvertStringSidToSidW CopySid GetSecurityDescriptorControl SetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup EqualSid GetAce SetSecurityDescriptorOwner GetAclInformation GetSecurityDescriptorDacl SetSecurityDescriptorDacl GetSecurityDescriptorSacl OpenThreadToken ConvertSidToStringSidW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegCloseKey CheckTokenMembership FreeSid AllocateAndInitializeSid SetSecurityDescriptorSacl

ole32

CoCreateGuid StringFromGUID2

shell32

SHGetFolderPathW

netapi32

NetApiBufferFree NetWkstaGetInfo NetGetJoinInformation

rpcrt4

UuidCreate

shlwapi

PathStripPathW PathRemoveFileSpecW SHQueryValueExW PathAppendW PathIsRelativeW PathRemoveExtensionW PathCanonicalizeW

userenv

UnloadUserProfile

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_ba845102365c4318b0cd889af928b53b_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

advapi32

ole32

shell32

netapi32

rpcrt4

shlwapi

userenv

version

generic