2026-05-28_94ac568c00950c597662085dbfb598a5_amadey_elex_hijackloader_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_94ac568c00950c597662085dbfb598a5_amadey_elex_hijackloader_luca-stealer_lynx_njrat
Size 1.0MB
Sample260528-tglfnset2j
SHA256 c1709655352854cec8187d854f819aa1ffa44d9d97a9994606c8701159b96853
MD5 94ac568c00950c597662085dbfb598a5
SHA1 bb00a00a636ad27da019d8749bd84f55ab4d0fe7
SHA512 2bd1a7696d68e5bd58a1aaf0a6b50f09ea2c9ab734c6361945bca68293b72599d4f6c79d5d9200acd4507a321785cc7319f732f467c05a9da854483cb34f0bef
SSDEEP 12288:obp/ccJtK5TvsI4c9V5v5f21gL5pRTcAkS/3hzN8qE43fm78VgdUIVlN9o:+yv/L9VTX5jcAkSYqyEgHVlN9o
TLSH
T1BB352911F6A48131D07384758AA2A65EDA353845CB238ECF1385AEEDFFF26D18935B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_94ac568c00950c597662085dbfb598a5_amadey_elex_hijackloader_luca-stealer_lynx_njrat

File Explorer

2026-05-28_94ac568c00950c597662085dbfb598a5_amadey_elex_hijackloader_luca-stealer_lynx_njrat

.exe 1.0MB

2026-05-28_94ac568c00950c597662085dbfb598a5_amadey_elex_hijackloader_luca-stealer_lynx_njrat

IMPHASH 707ceb865c9d276f7f39a10eefb9cb15
SHA256 c1709655352854cec8187d854f819aa1ffa44d9d97a9994606c8701159b96853
MD5 94ac568c00950c597662085dbfb598a5
SHA1 bb00a00a636ad27da019d8749bd84f55ab4d0fe7
SHA512 2bd1a7696d68e5bd58a1aaf0a6b50f09ea2c9ab734c6361945bca68293b72599d4f6c79d5d9200acd4507a321785cc7319f732f467c05a9da854483cb34f0bef
SSDEEP 12288:obp/ccJtK5TvsI4c9V5v5f21gL5pRTcAkS/3hzN8qE43fm78VgdUIVlN9o:+yv/L9VTX5jcAkSYqyEgHVlN9o
TLSH
T1BB352911F6A48131D07384758AA2A65EDA353845CB238ECF1385AEEDFFF26D18935B31
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u421\1068\build\windows-i586\deploy\jre-image\bin\javaws.pdb

kernel32

GetCurrentProcessId WideCharToMultiByte FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW CreateDirectoryW FindClose FindFirstFileW CloseHandle WaitForSingleObject CreateEventW OpenProcess GetTickCount GetSystemWindowsDirectoryW GetModuleFileNameW GetThreadLocale CreateToolhelp32Snapshot Process32FirstW Process32NextW VerSetConditionMask GetEnvironmentVariableW CreateFileW GetLongPathNameW GetShortPathNameW GetTempPathW DecodePointer GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentProcess CreateProcessW GlobalMemoryStatusEx GetLocalTime GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo GlobalAlloc GlobalFree LocalAlloc LocalFree FormatMessageW lstrlenW VerifyVersionInfoW WTSGetActiveConsoleSessionId OutputDebugStringW GetCurrentThreadId GetExitCodeProcess GetModuleHandleExW GetFileAttributesW GetFullPathNameW GetCurrentDirectoryW SetEnvironmentVariableW HeapAlloc HeapFree WriteConsoleW HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetFileSizeEx GetFileAttributesExW GetStringTypeW WriteFile GetStdHandle SetFilePointerEx ReadConsoleW ReadFile SetEndOfFile HeapReAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetTimeZoneInformation LCMapStringW CompareStringW GetTimeFormatW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead EnterCriticalSection LeaveCriticalSection MultiByteToWideChar RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetCommandLineA GetCommandLineW DeleteFileW GetDateFormatW

user32

DispatchMessageW DefWindowProcW RegisterClassW CreateWindowExW SetTimer LoadCursorW wsprintfW OpenInputDesktop CloseDesktop GetShellWindow GetWindowThreadProcessId GetMessageW TranslateMessage MessageBoxW

ole32

StringFromCLSID CoTaskMemFree

oleaut32

SysStringLen SysFreeString SysAllocString SysAllocStringByteLen VariantClear

wsock32

WSAAsyncSelect recv accept bind connect getsockname htons ioctlsocket listen ntohs send socket closesocket WSAGetLastError WSAStartup

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_94ac568c00950c597662085dbfb598a5_amadey_elex_hijackloader_luca-stealer_lynx_njrat

kernel32

user32

ole32

oleaut32

wsock32

generic