2026-10-27_efdb305ba14b2755b4087bd29a1b2e01_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_efdb305ba14b2755b4087bd29a1b2e01_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 402KB
Sample261027-2drsaavy4p
SHA256 81bc59713244196d71fa7169f65f6b32c2e93744dec9fab34cb8e69f5eefbb10
MD5 efdb305ba14b2755b4087bd29a1b2e01
SHA1 45fc2c7fa678a3129cf3d688e4f210e424d84215
SHA512 af13233b844d5ab449b7e542bf2b9005487efc9f78fcb64094dbdb0c875eaf7b68425ba7c6ac7b213e6128f52e3c98ea4f6bee40a8103cf449bb0dc2d611a256
SSDEEP 6144:3RLp3ES00VdQel2YQjXA3ILzLSto4Gx6dKAOLCma/d3QYw:3P0SvjQvjXA3GStc6dKFba/d5w
TLSH
T1BB947B11759DC03EC5621B320939E6A2957CBD704D30F61B63E87F2EBFB1191E628B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-27_efdb305ba14b2755b4087bd29a1b2e01_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-10-27_efdb305ba14b2755b4087bd29a1b2e01_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 402KB

2026-10-27_efdb305ba14b2755b4087bd29a1b2e01_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH 6d78ad438653ca646e019b1542388609
SHA256 81bc59713244196d71fa7169f65f6b32c2e93744dec9fab34cb8e69f5eefbb10
MD5 efdb305ba14b2755b4087bd29a1b2e01
SHA1 45fc2c7fa678a3129cf3d688e4f210e424d84215
SHA512 af13233b844d5ab449b7e542bf2b9005487efc9f78fcb64094dbdb0c875eaf7b68425ba7c6ac7b213e6128f52e3c98ea4f6bee40a8103cf449bb0dc2d611a256
SSDEEP 6144:3RLp3ES00VdQel2YQjXA3ILzLSto4Gx6dKAOLCma/d3QYw:3P0SvjQvjXA3GStc6dKFba/d5w
TLSH
T1BB947B11759DC03EC5621B320939E6A2957CBD704D30F61B63E87F2EBFB1191E628B62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70900

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\amigo_helpers\amigo_loader_lite\Release\AmigoLoaderLite.pdb

kernel32

UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery GetModuleFileNameW GetACP GetModuleHandleW GetProcAddress InterlockedCompareExchange CreateDirectoryW RemoveDirectoryW GetFileAttributesW DeleteFileW GetCurrentProcessId GlobalAlloc GlobalLock GlobalUnlock GetStartupInfoW CreateProcessW GetExitCodeProcess GetTempPathW SizeofResource FreeResource LockResource LoadLibraryW LoadResource FindResourceW FreeLibrary MultiByteToWideChar MoveFileExW WideCharToMultiByte MoveFileW GetCurrentProcess GetVersionExW GetNativeSystemInfo SetFileAttributesW lstrcmpiW CreateFileW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage EnterCriticalSection FindFirstFileExW FindClose WriteConsoleW GetFullPathNameW GetCurrentDirectoryW GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle ExitProcess SetEndOfFile SetFilePointerEx GetConsoleCP WriteFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW ReadConsoleW GetConsoleMode ReadFile CopyFileW GetProcessHeap LocalFree HeapAlloc HeapReAlloc HeapSize GetCommandLineW HeapFree CloseHandle GetCurrentThreadId LeaveCriticalSection SetLastError DeleteCriticalSection DecodePointer RaiseException GetLastError SystemTimeToFileTime TzSpecificLocalTimeToSystemTime SetFileTime GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RtlUnwind FlushFileBuffers QueryPerformanceCounter TerminateProcess FindNextFileW InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW EncodePointer GetStringTypeW

user32

ReleaseCapture PtInRect DialogBoxParamW GetParent UpdateLayeredWindow GetDlgItem GetClientRect SetWindowLongW wsprintfW MoveWindow MapWindowPoints ClientToScreen CopyRect GetMonitorInfoW GetCapture IsWindow ShowWindow GetActiveWindow WindowFromPoint SetWindowTextW GetSystemMetrics EndDialog SendMessageW ScreenToClient FillRect MonitorFromWindow SetWindowPos IsWindowVisible GetWindowRect GetWindow CallWindowProcW DefWindowProcW UnregisterClassW EndPaint BeginPaint GetCursorPos InvalidateRect GetWindowLongW LoadImageW KillTimer SetTimer

gdi32

SetTextColor SetBkMode BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC DeleteDC SetViewportOrgEx DeleteObject CreateSolidBrush GetStockObject

advapi32

RegCreateKeyExW RegSetValueExW RegQueryValueExW RegCloseKey

shell32

CommandLineToArgvW ShellExecuteW

ole32

CoTaskMemFree CreateStreamOnHGlobal CoCreateGuid StringFromCLSID

shlwapi

PathFileExistsW PathFindFileNameW

comctl32

_TrackMouseEvent

gdiplus

GdipCreateLineBrushFromRect GdipLoadImageFromStream GdipGetImageWidth GdipGetImageHeight GdipLoadImageFromFile GdiplusShutdown GdipSetStringFormatAlign GdipDrawImageI GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipStringFormatGetGenericDefault GdipMeasureString GdipSetTextRenderingHint GdipCreateFromHDC GdipDrawString GdipFree GdipGetGenericFontFamilySansSerif GdipCreateSolidFill GdipCreateFont GdipCreatePath GdipSetSmoothingMode GdipDisposeImage GdipDeletePath GdipCreateBitmapFromHBITMAP GdipDrawImageRectI GdipAlloc GdipDeleteBrush GdipCloneImage GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateStringFormat GdipFillRectangle GdiplusStartup

Name

.text

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_efdb305ba14b2755b4087bd29a1b2e01_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

gdiplus

generic