2026-10-31_f6a4f26ead01ef435cf22363c845ff39_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

General

Target
2026-10-31_f6a4f26ead01ef435cf22363c845ff39_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader
Size 337KB
Sample261031-maa8ssha68
SHA256 39cb4f07ec6a640c74d236233e3d874873e1f42488f6e713935693567e3985e2
MD5 f6a4f26ead01ef435cf22363c845ff39
SHA1 4b64227491496dc544302c32ed481b2c005235d3
SHA512 0d2f30fb83876acb46df227618555afebc5a6bc132f2a6e5bd71b5d9ef6d62f3c5c058a4205a45e055df2aca01de33f9014b6ebdab4450de67769c932cf31619
SSDEEP 3072:sJzuL1kcwhkrp84zuWN6opmMhWUFuvB27V6J4agZH/zxR88L3oKCMr71X6pL7Xb/:sO1kwG4ajopmMhWsbB6Szj88LN1X6p
TLSH
T1F7743712ED8C8CA9E09306BC37B08761153E7912EE58C45E7A84F2394A637F2271B5FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_f6a4f26ead01ef435cf22363c845ff39_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

File Explorer

2026-10-31_f6a4f26ead01ef435cf22363c845ff39_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

.exe 337KB

2026-10-31_f6a4f26ead01ef435cf22363c845ff39_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

IMPHASH 35311ec8ab3b5caa3950d07500cb1cc2
SHA256 39cb4f07ec6a640c74d236233e3d874873e1f42488f6e713935693567e3985e2
MD5 f6a4f26ead01ef435cf22363c845ff39
SHA1 4b64227491496dc544302c32ed481b2c005235d3
SHA512 0d2f30fb83876acb46df227618555afebc5a6bc132f2a6e5bd71b5d9ef6d62f3c5c058a4205a45e055df2aca01de33f9014b6ebdab4450de67769c932cf31619
SSDEEP 3072:sJzuL1kcwhkrp84zuWN6opmMhWUFuvB27V6J4agZH/zxR88L3oKCMr71X6pL7Xb/:sO1kwG4ajopmMhWsbB6Szj88LN1X6p
TLSH
T1F7743712ED8C8CA9E09306BC37B08761153E7912EE58C45E7A84F2394A637F2271B5FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

339968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleWindow SetConsoleTitleA SetConsoleTitleW WaitForSingleObject SetEvent ReadFile GlobalMemoryStatus GetProcAddress GetModuleHandleW WriteFile CloseHandle UnmapViewOfFile CreateFileA GetModuleFileNameA GetPrivateProfileStringA QueryPerformanceCounter GetTickCount QueryPerformanceFrequency LoadLibraryA GlobalMemoryStatusEx CreateFileMappingA MapViewOfFile OpenFileMappingA OpenEventA WriteConsoleW SetEndOfFile HeapReAlloc HeapSize CreateFileW FlushFileBuffers GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess FormatMessageA GetThreadLocale InitializeCriticalSection LoadLibraryExA LeaveCriticalSection GetModuleHandleExA GetEnvironmentVariableA EnterCriticalSection RtlUnwind RaiseException GetLastError SetLastError EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc CompareStringW LCMapStringW GetFileType SetStdHandle SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP DeleteFileW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap DecodePointer

user32

MessageBoxA

ole32

CoCreateInstance CoInitialize CoUninitialize

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_f6a4f26ead01ef435cf22363c845ff39_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

kernel32

user32

ole32

generic