2026-10-31_8a32666cee2c268a1c7fb0a422047bbf_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

General

Target
2026-10-31_8a32666cee2c268a1c7fb0a422047bbf_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader
Size 338KB
Sample261031-qa36csdt9q
SHA256 021b9e8903964ff66355555169c62d07162f2a99b8f62b0d210a0f207bba1523
MD5 8a32666cee2c268a1c7fb0a422047bbf
SHA1 71a7c4d9b08c030a10256965ae7afcd1fb8edaca
SHA512 477f3a34ab738f24d241d67faa1b0c833ee58af2c2f88aba780acb7a7afb340b93751c8a5b9a55a294a36e9a07eae9638dda91dabf72aa779e0753d5f410e9aa
SSDEEP 6144:/O1kwG4ajopmMhWsbB6SlhIXWQ1o+1oFKkSH:/OewG4a4zbB6Tf1GM
TLSH
T16A74381079E3ECBDF0B6C43A94B98BEB16E8273805944453BB64BA25FBB8DC20533557
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_8a32666cee2c268a1c7fb0a422047bbf_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

File Explorer

2026-10-31_8a32666cee2c268a1c7fb0a422047bbf_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

.exe 338KB

2026-10-31_8a32666cee2c268a1c7fb0a422047bbf_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

IMPHASH 35311ec8ab3b5caa3950d07500cb1cc2
SHA256 021b9e8903964ff66355555169c62d07162f2a99b8f62b0d210a0f207bba1523
MD5 8a32666cee2c268a1c7fb0a422047bbf
SHA1 71a7c4d9b08c030a10256965ae7afcd1fb8edaca
SHA512 477f3a34ab738f24d241d67faa1b0c833ee58af2c2f88aba780acb7a7afb340b93751c8a5b9a55a294a36e9a07eae9638dda91dabf72aa779e0753d5f410e9aa
SSDEEP 6144:/O1kwG4ajopmMhWsbB6SlhIXWQ1o+1oFKkSH:/OewG4a4zbB6Tf1GM
TLSH
T16A74381079E3ECBDF0B6C43A94B98BEB16E8273805944453BB64BA25FBB8DC20533557
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

344064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleWindow SetConsoleTitleA SetConsoleTitleW WaitForSingleObject SetEvent ReadFile GlobalMemoryStatus GetProcAddress GetModuleHandleW WriteFile CloseHandle UnmapViewOfFile CreateFileA GetModuleFileNameA GetPrivateProfileStringA QueryPerformanceCounter GetTickCount QueryPerformanceFrequency LoadLibraryA GlobalMemoryStatusEx CreateFileMappingA MapViewOfFile OpenFileMappingA OpenEventA WriteConsoleW SetEndOfFile HeapReAlloc HeapSize CreateFileW FlushFileBuffers GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess FormatMessageA GetThreadLocale InitializeCriticalSection LoadLibraryExA LeaveCriticalSection GetModuleHandleExA GetEnvironmentVariableA EnterCriticalSection RtlUnwind RaiseException GetLastError SetLastError EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc CompareStringW LCMapStringW GetFileType SetStdHandle SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP DeleteFileW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap DecodePointer

user32

MessageBoxA

ole32

CoCreateInstance CoInitialize CoUninitialize

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

158B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_8a32666cee2c268a1c7fb0a422047bbf_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

kernel32

user32

ole32

generic