2026-10-26_5e99dc904f5b4b00805b7745ee0928a1_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_5e99dc904f5b4b00805b7745ee0928a1_amadey_elex_luca-stealer_njrat_remcos_smoke-loader
Size 1.0MB
Sample261027-tr58tsev21
SHA256 75244e8a047858ed3fb040fc8c1254abacf6abbbfccc9973922bf1e26d4915c0
MD5 5e99dc904f5b4b00805b7745ee0928a1
SHA1 887826bef9c3fd641df7debd2cf3dd9b35d47be1
SHA512 6df34ae42d52a739f90a5c6402c31a14a2c16ec06b8b189672d51274ae3f0c674602d5e99470ec9cda628db67645808a170da6f05c3fe6f7af7b78102d248c49
SSDEEP 24576:ZxcVXzdm2SrGxtxiVFFfwOqp9IFNG1R/qpl6wJrosi0Ejk2WJj:w5Y2Sr+GVLw3p9v1tTw9xi0E5WJ
TLSH
T19825121176E288B3E2B216324DB4DBA19DBE7D220D31CA6F03D0095C9F74591EA3AF57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_5e99dc904f5b4b00805b7745ee0928a1_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-10-26_5e99dc904f5b4b00805b7745ee0928a1_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 1.0MB

2026-10-26_5e99dc904f5b4b00805b7745ee0928a1_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH a63b58dc533753d34a565aee7faaff95
SHA256 75244e8a047858ed3fb040fc8c1254abacf6abbbfccc9973922bf1e26d4915c0
MD5 5e99dc904f5b4b00805b7745ee0928a1
SHA1 887826bef9c3fd641df7debd2cf3dd9b35d47be1
SHA512 6df34ae42d52a739f90a5c6402c31a14a2c16ec06b8b189672d51274ae3f0c674602d5e99470ec9cda628db67645808a170da6f05c3fe6f7af7b78102d248c49
SSDEEP 24576:ZxcVXzdm2SrGxtxiVFFfwOqp9IFNG1R/qpl6wJrosi0Ejk2WJj:w5Y2Sr+GVLw3p9v1tTw9xi0E5WJ
TLSH
T19825121176E288B3E2B216324DB4DBA19DBE7D220D31CA6F03D0095C9F74591EA3AF57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleCrashHandler_unsigned.pdb

kernel32

GetProcessHeap DeleteCriticalSection GetModuleHandleW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetACP GetCurrentThread LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType OutputDebugStringA CloseHandle CreateThread SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetProcAddress SetFilePointerEx WriteConsoleW CreateFileW CreateDirectoryW SizeofResource RemoveDirectoryW WaitForMultipleObjects GetEnvironmentVariableW WaitForSingleObject ReleaseMutex DuplicateHandle LockResource DeleteFileW LoadLibraryW FindResourceExW LoadResource FindResourceW LocalFree lstrcmpiW WaitNamedPipeW GetTickCount GetExitCodeProcess GetTempPathW VirtualQuery OpenProcess Sleep ReadProcessMemory ReadFile lstrlenW SetFilePointer GetFileAttributesExW MoveFileExW GetFileTime CreateProcessW SetProcessWorkingSetSize GetPrivateProfileIntW GetPrivateProfileStringW GetLocalTime lstrcmpW VerSetConditionMask VerifyVersionInfoW TryEnterCriticalSection InitializeCriticalSection CreateMutexW CreateEventW SetEvent ResetEvent lstrcpynW GlobalAlloc GlobalFree GlobalLock GlobalUnlock WaitForDebugEvent GetProcessId DebugActiveProcessStop ContinueDebugEvent GetSystemInfo GetThreadContext DebugActiveProcess VirtualQueryEx SetNamedPipeHandleState CreateSemaphoreW ReleaseSemaphore RtlCaptureContext HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError TransactNamedPipe GetSystemDefaultLangID GetUserDefaultLangID DeviceIoControl GetComputerNameExW ConnectNamedPipe GetOverlappedResult DisconnectNamedPipe CreateNamedPipeW GetProcessTimes UnregisterWait UnregisterWaitEx RegisterWaitForSingleObject VirtualProtect VirtualAlloc HeapSize InitializeCriticalSectionAndSpinCount GetConsoleMode HeapFree

user32

GetWindowThreadProcessId IsWindowVisible EnumWindows CharUpperW GetProcessWindowStation SetProcessWindowStation GetMessageW DispatchMessageW PeekMessageW PostThreadMessageW OpenClipboard CloseClipboard EmptyClipboard SetClipboardData MessageBoxW CreateDesktopW CloseDesktop GetThreadDesktop SetThreadDesktop CloseWindowStation CreateWindowStationW wvsprintfW CharLowerW wsprintfW

advapi32

SetTokenInformation TraceEvent GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids GetTokenInformation SetSecurityDescriptorGroup MakeAbsoluteSD MakeSelfRelativeSD GetSecurityDescriptorLength GetLengthSid InitializeAcl InitializeSecurityDescriptor OpenProcessToken AddAce IsValidSid GetSecurityDescriptorOwner InitializeSid ConvertStringSidToSidW CopySid GetSecurityDescriptorControl SetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup EqualSid GetAce SetSecurityDescriptorOwner GetAclInformation GetSecurityDescriptorDacl SetSecurityDescriptorDacl GetSecurityDescriptorSacl OpenThreadToken ConvertSidToStringSidW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegCloseKey CheckTokenMembership FreeSid AllocateAndInitializeSid SetSecurityDescriptorSacl

ole32

CoCreateGuid StringFromGUID2

shell32

SHGetFolderPathW

netapi32

NetApiBufferFree NetWkstaGetInfo NetGetJoinInformation

rpcrt4

UuidCreate

shlwapi

PathStripPathW PathRemoveFileSpecW SHQueryValueExW PathAppendW PathIsRelativeW PathRemoveExtensionW PathCanonicalizeW

userenv

UnloadUserProfile

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_5e99dc904f5b4b00805b7745ee0928a1_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

advapi32

ole32

shell32

netapi32

rpcrt4

shlwapi

userenv

version

generic