2026-10-30_c5644fc4dd2176d6fd114bd53b6595f2_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

General

Target
2026-10-30_c5644fc4dd2176d6fd114bd53b6595f2_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader
Size 338KB
Sample261031-ys3asazvcx
SHA256 cd469b460bd08f03e46d59c8cc7c938b24f519596ac35d497e8386a7b1836b15
MD5 c5644fc4dd2176d6fd114bd53b6595f2
SHA1 8adac6ba9e8bd7f8bd1344e40661b9994c47e6d9
SHA512 b51fe45035702b7c524f7af2d2461035580107335c8dc09cd649ec37d4427981af0eaa852f2f525a7e1d1f71d637cf4160268032e983c98a4cde475a83d0dc56
SSDEEP 3072:zJzuL1kcwhkrp84zuWN6opmMhWUFuvB27V6J4agZH/r/DN1SqTIF8jjgA9u5CHQ4:zO1kwG4ajopmMhWsbB6SutuKDue5zKH
TLSH
T11A7458B1E3F0C821CA77143034A2B6A71D2BA5121A338F561B869FFB4A7B098FD175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_c5644fc4dd2176d6fd114bd53b6595f2_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

File Explorer

2026-10-30_c5644fc4dd2176d6fd114bd53b6595f2_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

.exe 338KB

2026-10-30_c5644fc4dd2176d6fd114bd53b6595f2_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

IMPHASH 35311ec8ab3b5caa3950d07500cb1cc2
SHA256 cd469b460bd08f03e46d59c8cc7c938b24f519596ac35d497e8386a7b1836b15
MD5 c5644fc4dd2176d6fd114bd53b6595f2
SHA1 8adac6ba9e8bd7f8bd1344e40661b9994c47e6d9
SHA512 b51fe45035702b7c524f7af2d2461035580107335c8dc09cd649ec37d4427981af0eaa852f2f525a7e1d1f71d637cf4160268032e983c98a4cde475a83d0dc56
SSDEEP 3072:zJzuL1kcwhkrp84zuWN6opmMhWUFuvB27V6J4agZH/r/DN1SqTIF8jjgA9u5CHQ4:zO1kwG4ajopmMhWsbB6SutuKDue5zKH
TLSH
T11A7458B1E3F0C821CA77143034A2B6A71D2BA5121A338F561B869FFB4A7B098FD175D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

344064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleWindow SetConsoleTitleA SetConsoleTitleW WaitForSingleObject SetEvent ReadFile GlobalMemoryStatus GetProcAddress GetModuleHandleW WriteFile CloseHandle UnmapViewOfFile CreateFileA GetModuleFileNameA GetPrivateProfileStringA QueryPerformanceCounter GetTickCount QueryPerformanceFrequency LoadLibraryA GlobalMemoryStatusEx CreateFileMappingA MapViewOfFile OpenFileMappingA OpenEventA WriteConsoleW SetEndOfFile HeapReAlloc HeapSize CreateFileW FlushFileBuffers GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess FormatMessageA GetThreadLocale InitializeCriticalSection LoadLibraryExA LeaveCriticalSection GetModuleHandleExA GetEnvironmentVariableA EnterCriticalSection RtlUnwind RaiseException GetLastError SetLastError EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc CompareStringW LCMapStringW GetFileType SetStdHandle SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP DeleteFileW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap DecodePointer

user32

MessageBoxA

ole32

CoCreateInstance CoInitialize CoUninitialize

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

158B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_c5644fc4dd2176d6fd114bd53b6595f2_elex_helldown_luca-stealer_njrat_ramnit_remcos_smoke-loader

kernel32

user32

ole32

generic