2026-10-26_5e7c2efbb988c59b26ded55b66ec477f_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_5e7c2efbb988c59b26ded55b66ec477f_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader
Size 331KB
Sample261027-tskzaaev3s
SHA256 1b50d3af43cc752234bf991397c94b13ea0cee3dc4250bb9b5bb2ddaca49b8e2
MD5 5e7c2efbb988c59b26ded55b66ec477f
SHA1 1730d3cd0337183ae446c06c2ee036a9a232a4bf
SHA512 2ccac081e18211fbf96c76ca3b4cdbaeba37395598c2f03fca84aadf84f988f1e153613e003605c748c966eb8bfb55a30223deffb9a64021240d885842b2ed32
SSDEEP 6144:Tz1iHBZWx+BQ+F6Q0JHr75T2KWAOINBIaxSOx+V/HDDBVu:31sBZWMF6TN7RiGNBZnx+V/HBVu
TLSH
T18F74BE02B9E5C473E6B209324D7AA76559FC79300A21CA7F23D44D2DDE746C0B629BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_5e7c2efbb988c59b26ded55b66ec477f_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-10-26_5e7c2efbb988c59b26ded55b66ec477f_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

.exe 331KB

2026-10-26_5e7c2efbb988c59b26ded55b66ec477f_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

IMPHASH da6ad57680de38fbfede6e6179fd9973
SHA256 1b50d3af43cc752234bf991397c94b13ea0cee3dc4250bb9b5bb2ddaca49b8e2
MD5 5e7c2efbb988c59b26ded55b66ec477f
SHA1 1730d3cd0337183ae446c06c2ee036a9a232a4bf
SHA512 2ccac081e18211fbf96c76ca3b4cdbaeba37395598c2f03fca84aadf84f988f1e153613e003605c748c966eb8bfb55a30223deffb9a64021240d885842b2ed32
SSDEEP 6144:Tz1iHBZWx+BQ+F6Q0JHr75T2KWAOINBIaxSOx+V/HDDBVu:31sBZWMF6TN7RiGNBZnx+V/HBVu
TLSH
T18F74BE02B9E5C473E6B209324D7AA76559FC79300A21CA7F23D44D2DDE746C0B629BB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleCrashHandler_unsigned.pdb

kernel32

TerminateProcess SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetACP GetCurrentThread LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType OutputDebugStringA CloseHandle CreateThread SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW EncodePointer CreateFileW LoadLibraryW SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetCurrentProcess LocalFree CreateDirectoryW DeleteFileW RemoveDirectoryW GetTickCount WaitForMultipleObjects WaitForSingleObject GetExitCodeProcess DuplicateHandle ReleaseMutex GetEnvironmentVariableW lstrcmpiW VirtualQuery GetTempPathW GetLocalTime GetPrivateProfileIntW GetPrivateProfileStringW Sleep lstrcmpW lstrlenW SetFilePointer CreateMutexW CreateEventW InitializeSListHead TryEnterCriticalSection SetEvent ResetEvent GetFileAttributesExW VerifyVersionInfoW VerSetConditionMask MoveFileExW GetFileTime ReadFile DeviceIoControl SetProcessWorkingSetSize OpenProcess CreateProcessW ReadProcessMemory lstrcpynW GlobalAlloc GlobalLock GlobalUnlock GlobalFree WaitForDebugEvent GetProcessId DebugActiveProcessStop ContinueDebugEvent GetSystemInfo GetThreadContext DebugActiveProcess VirtualQueryEx GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LeaveCriticalSection WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState RtlCaptureContext ReleaseSemaphore CreateSemaphoreW EnterCriticalSection OutputDebugStringW GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize IsDebuggerPresent InitializeCriticalSection GetUserDefaultLangID GetSystemDefaultLangID GetComputerNameExW GetOverlappedResult ConnectNamedPipe CreateNamedPipeW DisconnectNamedPipe UnregisterWait GetProcessTimes UnregisterWaitEx RegisterWaitForSingleObject VirtualProtect VirtualAlloc InitializeCriticalSectionAndSpinCount HeapFree

user32

SetClipboardData EmptyClipboard OpenClipboard GetProcessWindowStation CloseDesktop CloseClipboard CharUpperW DispatchMessageW GetMessageW PeekMessageW EnumWindows IsWindowVisible GetWindowThreadProcessId wvsprintfW PostThreadMessageW CreateWindowStationW SetProcessWindowStation CreateDesktopW GetThreadDesktop SetThreadDesktop CharLowerW wsprintfW MessageBoxW CloseWindowStation

advapi32

GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl GetLengthSid CopySid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired SetSecurityDescriptorDacl AddAce InitializeAcl GetAclInformation InitializeSecurityDescriptor MakeAbsoluteSD OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetAce MakeSelfRelativeSD GetSecurityDescriptorLength EqualSid SetNamedSecurityInfoW ConvertStringSidToSidW OpenThreadToken RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW ConvertSidToStringSidW AllocateAndInitializeSid CheckTokenMembership FreeSid SetSecurityDescriptorSacl GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids TraceEvent SetTokenInformation

ole32

CoCreateGuid StringFromGUID2

shell32

SHGetFolderPathW

netapi32

NetWkstaGetInfo NetApiBufferFree

rpcrt4

UuidCreate

shlwapi

PathRemoveExtensionW PathRemoveFileSpecW PathStripPathW PathCanonicalizeW PathIsRelativeW SHQueryValueExW PathAppendW

userenv

UnloadUserProfile

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

332B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_5e7c2efbb988c59b26ded55b66ec477f_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

advapi32

ole32

shell32

netapi32

rpcrt4

shlwapi

userenv

version

generic