2026-10-31_9c7bc35f7a368998259a02372a785d8d_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_9c7bc35f7a368998259a02372a785d8d_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader
Size 329KB
Sample261101-2aaplaythv
SHA256 91eb08fb3d65c513f47dc075b945e4ba0102749fa2f8f6951dbb3dff48ce7234
MD5 9c7bc35f7a368998259a02372a785d8d
SHA1 1bc688656e50783b688fb3ac20676e7f35a042b6
SHA512 cfd510c608c91a4440a0102e1615809f8aa135aa4f0a346d138501ebed3c883abaddf49095ec4abd8ffcfa289baae56fadfea4cfb175e4eecf8a30b7ff6baa12
SSDEEP 6144:7z1iHBZWx+Bs+F6Q0JHr75T2KWAOINBIaxSOx+V/HFfNl5n:P1sBZWwF6TN7RiGNBZnx+V/ZN/n
TLSH
T1BE74BE12B9A5C473E6B215324D7AA76559FC7D300A20CA7F23E44D2DDE742C0B629BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_9c7bc35f7a368998259a02372a785d8d_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-10-31_9c7bc35f7a368998259a02372a785d8d_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

.exe 329KB

2026-10-31_9c7bc35f7a368998259a02372a785d8d_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

IMPHASH da6ad57680de38fbfede6e6179fd9973
SHA256 91eb08fb3d65c513f47dc075b945e4ba0102749fa2f8f6951dbb3dff48ce7234
MD5 9c7bc35f7a368998259a02372a785d8d
SHA1 1bc688656e50783b688fb3ac20676e7f35a042b6
SHA512 cfd510c608c91a4440a0102e1615809f8aa135aa4f0a346d138501ebed3c883abaddf49095ec4abd8ffcfa289baae56fadfea4cfb175e4eecf8a30b7ff6baa12
SSDEEP 6144:7z1iHBZWx+Bs+F6Q0JHr75T2KWAOINBIaxSOx+V/HFfNl5n:P1sBZWwF6TN7RiGNBZnx+V/ZN/n
TLSH
T1BE74BE12B9A5C473E6B215324D7AA76559FC7D300A20CA7F23E44D2DDE742C0B629BB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleCrashHandler_unsigned.pdb

kernel32

TerminateProcess SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetACP GetCurrentThread LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType OutputDebugStringA CloseHandle CreateThread SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW EncodePointer CreateFileW LoadLibraryW SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetCurrentProcess LocalFree CreateDirectoryW DeleteFileW RemoveDirectoryW GetTickCount WaitForMultipleObjects WaitForSingleObject GetExitCodeProcess DuplicateHandle ReleaseMutex GetEnvironmentVariableW lstrcmpiW VirtualQuery GetTempPathW GetLocalTime GetPrivateProfileIntW GetPrivateProfileStringW Sleep lstrcmpW lstrlenW SetFilePointer CreateMutexW CreateEventW InitializeSListHead TryEnterCriticalSection SetEvent ResetEvent GetFileAttributesExW VerifyVersionInfoW VerSetConditionMask MoveFileExW GetFileTime ReadFile DeviceIoControl SetProcessWorkingSetSize OpenProcess CreateProcessW ReadProcessMemory lstrcpynW GlobalAlloc GlobalLock GlobalUnlock GlobalFree WaitForDebugEvent GetProcessId DebugActiveProcessStop ContinueDebugEvent GetSystemInfo GetThreadContext DebugActiveProcess VirtualQueryEx GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LeaveCriticalSection WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState RtlCaptureContext ReleaseSemaphore CreateSemaphoreW EnterCriticalSection OutputDebugStringW GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize IsDebuggerPresent InitializeCriticalSection GetUserDefaultLangID GetSystemDefaultLangID GetComputerNameExW GetOverlappedResult ConnectNamedPipe CreateNamedPipeW DisconnectNamedPipe UnregisterWait GetProcessTimes UnregisterWaitEx RegisterWaitForSingleObject VirtualProtect VirtualAlloc InitializeCriticalSectionAndSpinCount HeapFree

user32

SetClipboardData EmptyClipboard OpenClipboard GetProcessWindowStation CloseDesktop CloseClipboard CharUpperW DispatchMessageW GetMessageW PeekMessageW EnumWindows IsWindowVisible GetWindowThreadProcessId wvsprintfW PostThreadMessageW CreateWindowStationW SetProcessWindowStation CreateDesktopW GetThreadDesktop SetThreadDesktop CharLowerW wsprintfW MessageBoxW CloseWindowStation

advapi32

GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl GetLengthSid CopySid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired SetSecurityDescriptorDacl AddAce InitializeAcl GetAclInformation InitializeSecurityDescriptor MakeAbsoluteSD OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetAce MakeSelfRelativeSD GetSecurityDescriptorLength EqualSid SetNamedSecurityInfoW ConvertStringSidToSidW OpenThreadToken RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW ConvertSidToStringSidW AllocateAndInitializeSid CheckTokenMembership FreeSid SetSecurityDescriptorSacl GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids TraceEvent SetTokenInformation

ole32

CoCreateGuid StringFromGUID2

shell32

SHGetFolderPathW

netapi32

NetWkstaGetInfo NetApiBufferFree

rpcrt4

UuidCreate

shlwapi

PathRemoveExtensionW PathRemoveFileSpecW PathStripPathW PathCanonicalizeW PathIsRelativeW SHQueryValueExW PathAppendW

userenv

UnloadUserProfile

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

332B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_9c7bc35f7a368998259a02372a785d8d_amadey_elex_hawkeye_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

advapi32

ole32

shell32

netapi32

rpcrt4

shlwapi

userenv

version

generic