2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader
Size 1.6MB
Sample261102-s4mftabs21
SHA256 d11495876096be8cd02e63927fb8e5b2827a2d468dbaa7ed6a3010b9ba577a4f
MD5 890864f91f9329a5cea9657d79974a76
SHA1 c464462f5f04759c605a2d2381f25ad482b1dcf3
SHA512 8544d9deb437bae6c784bce0b285f7c946997ad117c1ea7a0128a47323306ea93d609c7467daab6840195bfe1a129af740056a72fbe6a600fac50527a62e37b4
SSDEEP 24576:Nyy2sp+WTBmvUmwZ8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz/:Nyy27WTqUFZ8LNiXicJFFRGNzj3
TLSH
T1ED7502117685A432C1B305324B6DD22529BCBC315D214BAFA3D87F2DEE756C2AB24B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

.exe 1.6MB

2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 0ba45f8e3256fff048470d02ee09aabb
SHA256 d11495876096be8cd02e63927fb8e5b2827a2d468dbaa7ed6a3010b9ba577a4f
MD5 890864f91f9329a5cea9657d79974a76
SHA1 c464462f5f04759c605a2d2381f25ad482b1dcf3
SHA512 8544d9deb437bae6c784bce0b285f7c946997ad117c1ea7a0128a47323306ea93d609c7467daab6840195bfe1a129af740056a72fbe6a600fac50527a62e37b4
SSDEEP 24576:Nyy2sp+WTBmvUmwZ8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz/:Nyy27WTqUFZ8LNiXicJFFRGNzj3
TLSH
T1ED7502117685A432C1B305324B6DD22529BCBC315D214BAFA3D87F2DEE756C2AB24B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107834

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ninite\Output\pdbs\Release\FetchApps.pdb

kernel32

ReadFile CreateFileW GetFileSizeEx GetSystemTimeAsFileTime GetTickCount GetVersionExW GetProcAddress GetModuleHandleW SetFileTime GetStdHandle Sleep LoadLibraryW LocalFree FormatMessageW VirtualQuery SetUnhandledExceptionFilter EnterCriticalSection LeaveCriticalSection GetComputerNameW GetLocalTime InitializeCriticalSectionAndSpinCount DeleteCriticalSection CreateProcessW WaitForSingleObject GetExitCodeProcess GetPrivateProfileStringW SetEvent CreateEventW TerminateProcess CreateThread SetFilePointerEx RaiseException GetCommandLineW GetCurrentThreadId SetLastError FreeLibrary DecodePointer FlushFileBuffers WriteFile GetConsoleCP SetStdHandle CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetACP GetModuleHandleExW ExitProcess LoadLibraryExW RtlUnwind GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW TlsFree WideCharToMultiByte GetConsoleMode MultiByteToWideChar GetLastError MoveFileExW FindClose FindNextFileW FindFirstFileW GetCurrentProcess RemoveDirectoryW DeleteFileW SetFileAttributesW GetFileAttributesW GetModuleFileNameW ExpandEnvironmentStringsW GetShortPathNameW GetTempPathW CloseHandle LocalAlloc GetProcessHeap TlsSetValue TlsGetValue TlsAlloc LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent WriteConsoleW

user32

GetParent GetClientRect GetWindowRect MapWindowPoints MonitorFromWindow GetWindowLongW GetWindow LoadImageW GetSystemMetrics SendMessageW SetWindowLongW ShowWindow SetWindowPos GetWindowTextLengthW GetWindowTextW GetDlgItem PostMessageW GetMonitorInfoW DestroyMenu CallWindowProcW LoadMenuW GetSubMenu CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW UnregisterClassW LoadStringW DialogBoxParamW PeekMessageW GetMessageW TranslateMessage DispatchMessageW DefWindowProcW TrackPopupMenu GetCursorPos SetForegroundWindow PostQuitMessage RegisterWindowMessageW EndDialog MessageBoxW WaitForInputIdle

gdi32

GetStockObject

advapi32

CheckTokenMembership GetLengthSid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired RegQueryValueExW RegCloseKey RegOpenKeyExW DeregisterEventSource RegisterEventSourceW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus ReportEventW CopySid

shell32

ShellExecuteW Shell_NotifyIconW CommandLineToArgvW

wintrust

WinVerifyTrust

crypt32

CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CertGetCertificateContextProperty CryptUnprotectData CryptMsgClose CertCloseStore CertFreeCertificateContext CertFreeCertificateChain CryptQueryObject

wininet

InternetConnectW HttpSendRequestW InternetOpenW InternetOpenUrlW InternetCloseHandle InternetCrackUrlW InternetQueryOptionW InternetSetOptionW HttpOpenRequestW InternetWriteFile InternetReadFile HttpQueryInfoW HttpEndRequestW HttpSendRequestExW

rpcrt4

UuidCreateSequential RpcStringFreeW UuidToStringW

urlmon

ObtainUserAgentString

Name

.text

Size

228KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

wintrust

crypt32

wininet

rpcrt4

urlmon

generic