acreed | 2025-10-10_1453cbbddc4fe7d60560a74771cb960a_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2025-10-10_1453cbbddc4fe7d60560a74771cb960a_amadey_elex_luca-stealer_lynx_njrat
Size 1.4MB
Sample251010-cn9cmsdr7z
SHA256 c84f48d7f383a98220b8d3aa851b0c6b6516c4fe6c90ba4dbee8be2d7164ce73
MD5 1453cbbddc4fe7d60560a74771cb960a
SHA1 d1bf4afcdc6a49becc828628160e66bd67ad9da6
SHA512 ed71b6568ae30bdbf24a174b67318e9e8dbee664968ac78fb046a0cd8ed73f1aa4e9a40dea1e10472afb686b3b4c714ca92eade74a6ea1cb0edbc073d2305824
SSDEEP 24576:lxu/UPTv4iGd5FprVueuqSTzLEAONA+WxCpZlE0S0ppgZ63nIn/IzuYQ0x2222vz:S/CQiGkeubLp+A+WxCpZlEoy63nIn/It
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

acreed

Malware Config

Signatures

Acreed family
acreed

Detects Acreed Stealer 1 IoCs

resource	yara_rule
sample	family_acreed

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-10-10_1453cbbddc4fe7d60560a74771cb960a_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2025-10-10_1453cbbddc4fe7d60560a74771cb960a_amadey_elex_luca-stealer_lynx_njrat

.exe 1.4MB

2025-10-10_1453cbbddc4fe7d60560a74771cb960a_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 29c36a4c82d7d1ffd7acebc726a9f7f4
SHA256 c84f48d7f383a98220b8d3aa851b0c6b6516c4fe6c90ba4dbee8be2d7164ce73
MD5 1453cbbddc4fe7d60560a74771cb960a
SHA1 d1bf4afcdc6a49becc828628160e66bd67ad9da6
SHA512 ed71b6568ae30bdbf24a174b67318e9e8dbee664968ac78fb046a0cd8ed73f1aa4e9a40dea1e10472afb686b3b4c714ca92eade74a6ea1cb0edbc073d2305824
SSDEEP 24576:lxu/UPTv4iGd5FprVueuqSTzLEAONA+WxCpZlE0S0ppgZ63nIn/IzuYQ0x2222vz:S/CQiGkeubLp+A+WxCpZlEoy63nIn/It
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects Acreed Stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

655727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\source\VIEW\Release\WebView2GettingStarted.pdb

kernel32

OutputDebugStringW LoadLibraryA WaitForSingleObjectEx OpenSemaphoreW Process32Next CloseHandle HeapAlloc GetProcAddress GlobalLock CreateMutexExW GetCurrentProcessId GetProcessHeap CreateProcessW GetModuleHandleW FreeLibrary WideCharToMultiByte CreateDirectoryA DebugBreak GlobalUnlock IsDebuggerPresent GetFileAttributesW CreateFileW OutputDebugStringA GetModuleFileNameW LoadLibraryExW LoadLibraryW GetEnvironmentVariableW QueryPerformanceCounter QueryPerformanceFrequency SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetFileAttributesA HeapSize GetTimeZoneInformation SetStdHandle ReadConsoleW GetExitCodeProcess HeapReAlloc DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx WriteFile GetStdHandle SystemTimeToFileTime TzSpecificLocalTimeToSystemTime ReadFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetLastError CopyFileA FormatMessageW Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess ReleaseMutex GetModuleHandleA GetCurrentThreadId WaitForSingleObject CreateMutexA TerminateProcess GetModuleHandleExW ReleaseSemaphore SetLastError HeapFree CreateSemaphoreExW Process32First GetModuleFileNameA RaiseException InterlockedPushEntrySList RtlUnwind GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo WriteConsoleW CompareStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle SetFileTime AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetExitCodeThread LCMapStringEx InitializeCriticalSectionEx GetSystemTimeAsFileTime

user32

SetCursorPos IsIconic InvalidateRect ShowCursor SetCursor SetCapture SendMessageA GetClipboardData TranslateMessage GetCursorPos DefWindowProcA EnumWindows UnhookWindowsHookEx ReleaseCapture UpdateWindow RegisterClassExA UnregisterDeviceNotification FindWindowA PostQuitMessage GetClientRect ReleaseDC CreateWindowExA GetWindowPlacement RegisterClassA GetWindowThreadProcessId GetMessageA LoadImageA DispatchMessageA GetWindowRect LoadCursorA DestroyWindow GetDC SetWindowPos CallNextHookEx GetSystemMetrics BlockInput GetActiveWindow ShowWindow IsWindow OpenClipboard SetWindowLongA FindWindowExA CloseClipboard SetWindowsHookExA GetWindowTextA RegisterDeviceNotificationA GetWindowLongA MessageBoxA LoadIconA

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits DeleteDC DeleteObject GetObjectA BitBlt

advapi32

RegGetValueW RegCloseKey RegQueryValueExW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister

shell32

SetCurrentProcessExplicitAppUserModelID SHGetFolderPathW

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize CoTaskMemAlloc CoInitialize

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSetOption

wininet

InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpOpenRequestA InternetReadFile

Name

.text

Size

887KB

Virtual Size

887KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

288KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

jehd

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2025-10-10_1453cbbddc4fe7d60560a74771cb960a_amadey_elex_luca-stealer_lynx_njrat

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

wininet

generic