2026-11-03_55728514fe88027f7555ad6d372fef6c_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_55728514fe88027f7555ad6d372fef6c_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 402KB
Sample261104-y28txsvsd1
SHA256 f0e29ba44cb785f5b933a8bdda9d67d9e899bdffb503f3217aa81fb572d25031
MD5 55728514fe88027f7555ad6d372fef6c
SHA1 4b2098748c94edaa4b114e43923453eca74cf1aa
SHA512 d0e507ce73771939c223b9f662f3783bd2daaaeafe1c839f546ee464aae927f768d054f8c28c0f1d77f7e0f67f6b1f7150296df269a1fa55bd25d0e34e433148
SSDEEP 6144:3RLp3ES00VdQel2YQjXA3ILzLSto4Gx6dKAOLCma/d3QYw2:3P0SvjQvjXA3GStc6dKFba/d5w2
TLSH
T101947B11759DC03EC5621B320939E6A2957CBD704D30F61B63E87F2EBFB1191E628B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_55728514fe88027f7555ad6d372fef6c_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-11-03_55728514fe88027f7555ad6d372fef6c_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 402KB

2026-11-03_55728514fe88027f7555ad6d372fef6c_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH 6d78ad438653ca646e019b1542388609
SHA256 f0e29ba44cb785f5b933a8bdda9d67d9e899bdffb503f3217aa81fb572d25031
MD5 55728514fe88027f7555ad6d372fef6c
SHA1 4b2098748c94edaa4b114e43923453eca74cf1aa
SHA512 d0e507ce73771939c223b9f662f3783bd2daaaeafe1c839f546ee464aae927f768d054f8c28c0f1d77f7e0f67f6b1f7150296df269a1fa55bd25d0e34e433148
SSDEEP 6144:3RLp3ES00VdQel2YQjXA3ILzLSto4Gx6dKAOLCma/d3QYw2:3P0SvjQvjXA3GStc6dKFba/d5w2
TLSH
T101947B11759DC03EC5621B320939E6A2957CBD704D30F61B63E87F2EBFB1191E628B62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70900

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\amigo_helpers\amigo_loader_lite\Release\AmigoLoaderLite.pdb

kernel32

UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery GetModuleFileNameW GetACP GetModuleHandleW GetProcAddress InterlockedCompareExchange CreateDirectoryW RemoveDirectoryW GetFileAttributesW DeleteFileW GetCurrentProcessId GlobalAlloc GlobalLock GlobalUnlock GetStartupInfoW CreateProcessW GetExitCodeProcess GetTempPathW SizeofResource FreeResource LockResource LoadLibraryW LoadResource FindResourceW FreeLibrary MultiByteToWideChar MoveFileExW WideCharToMultiByte MoveFileW GetCurrentProcess GetVersionExW GetNativeSystemInfo SetFileAttributesW lstrcmpiW CreateFileW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage EnterCriticalSection FindFirstFileExW FindClose WriteConsoleW GetFullPathNameW GetCurrentDirectoryW GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle ExitProcess SetEndOfFile SetFilePointerEx GetConsoleCP WriteFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW ReadConsoleW GetConsoleMode ReadFile CopyFileW GetProcessHeap LocalFree HeapAlloc HeapReAlloc HeapSize GetCommandLineW HeapFree CloseHandle GetCurrentThreadId LeaveCriticalSection SetLastError DeleteCriticalSection DecodePointer RaiseException GetLastError SystemTimeToFileTime TzSpecificLocalTimeToSystemTime SetFileTime GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RtlUnwind FlushFileBuffers QueryPerformanceCounter TerminateProcess FindNextFileW InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW EncodePointer GetStringTypeW

user32

ReleaseCapture PtInRect DialogBoxParamW GetParent UpdateLayeredWindow GetDlgItem GetClientRect SetWindowLongW wsprintfW MoveWindow MapWindowPoints ClientToScreen CopyRect GetMonitorInfoW GetCapture IsWindow ShowWindow GetActiveWindow WindowFromPoint SetWindowTextW GetSystemMetrics EndDialog SendMessageW ScreenToClient FillRect MonitorFromWindow SetWindowPos IsWindowVisible GetWindowRect GetWindow CallWindowProcW DefWindowProcW UnregisterClassW EndPaint BeginPaint GetCursorPos InvalidateRect GetWindowLongW LoadImageW KillTimer SetTimer

gdi32

SetTextColor SetBkMode BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC DeleteDC SetViewportOrgEx DeleteObject CreateSolidBrush GetStockObject

advapi32

RegCreateKeyExW RegSetValueExW RegQueryValueExW RegCloseKey

shell32

CommandLineToArgvW ShellExecuteW

ole32

CoTaskMemFree CreateStreamOnHGlobal CoCreateGuid StringFromCLSID

shlwapi

PathFileExistsW PathFindFileNameW

comctl32

_TrackMouseEvent

gdiplus

GdipCreateLineBrushFromRect GdipLoadImageFromStream GdipGetImageWidth GdipGetImageHeight GdipLoadImageFromFile GdiplusShutdown GdipSetStringFormatAlign GdipDrawImageI GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipStringFormatGetGenericDefault GdipMeasureString GdipSetTextRenderingHint GdipCreateFromHDC GdipDrawString GdipFree GdipGetGenericFontFamilySansSerif GdipCreateSolidFill GdipCreateFont GdipCreatePath GdipSetSmoothingMode GdipDisposeImage GdipDeletePath GdipCreateBitmapFromHBITMAP GdipDrawImageRectI GdipAlloc GdipDeleteBrush GdipCloneImage GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateStringFormat GdipFillRectangle GdiplusStartup

Name

.text

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_55728514fe88027f7555ad6d372fef6c_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

gdiplus

generic