2026-06-02_9149b8b69b5ae8461918c3fe1858f81e_amadey_elex_gcleaner_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_9149b8b69b5ae8461918c3fe1858f81e_amadey_elex_gcleaner_luca-stealer_lynx_njrat_smoke-loader
Size 242KB
Sample260602-effrgadt71
SHA256 02be99ffc2a1790d4ceab78c6aad1340d40c4470fb4139d82ebd460f4b6520a7
MD5 9149b8b69b5ae8461918c3fe1858f81e
SHA1 1e672b29f4766cf3c9dd25acb6a3b646bc7ebc10
SHA512 d77ebd74cd5d52b5ae9e1432e063ca3e080faff7153ef129cc30e7727405b850ca22b3d49fb86dbdfe0c33812768692a8d5733d0f0940a28f94b6e06284d24eb
SSDEEP 3072:waUaAVq6/mLHI5dHtXm4nMJN6glT76hunCopnRd/RWh/3hcIaE/4sIaEAg0FuDE0:P+EI/NXhn/gB6Wzjd/Ry/3AAOs+AM3j
TLSH
T119348D117892C476D572153154F8EBB1896EBD340B714AEB67D40F3E8E302E3AA31E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_9149b8b69b5ae8461918c3fe1858f81e_amadey_elex_gcleaner_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-06-02_9149b8b69b5ae8461918c3fe1858f81e_amadey_elex_gcleaner_luca-stealer_lynx_njrat_smoke-loader

.exe 242KB

2026-06-02_9149b8b69b5ae8461918c3fe1858f81e_amadey_elex_gcleaner_luca-stealer_lynx_njrat_smoke-loader

IMPHASH dceb956bd502ba5be8a5b3fdad7541bc
SHA256 02be99ffc2a1790d4ceab78c6aad1340d40c4470fb4139d82ebd460f4b6520a7
MD5 9149b8b69b5ae8461918c3fe1858f81e
SHA1 1e672b29f4766cf3c9dd25acb6a3b646bc7ebc10
SHA512 d77ebd74cd5d52b5ae9e1432e063ca3e080faff7153ef129cc30e7727405b850ca22b3d49fb86dbdfe0c33812768692a8d5733d0f0940a28f94b6e06284d24eb
SSDEEP 3072:waUaAVq6/mLHI5dHtXm4nMJN6glT76hunCopnRd/RWh/3hcIaE/4sIaEAg0FuDE0:P+EI/NXhn/gB6Wzjd/Ry/3AAOs+AM3j
TLSH
T119348D117892C476D572153154F8EBB1896EBD340B714AEB67D40F3E8E302E3AA31E7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

62819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WideCharToMultiByte GetLocaleInfoA GetTempPathA OpenProcess K32GetModuleBaseNameA GetCurrentProcessId K32EnumProcessModules GetTickCount GetConsoleMode GetConsoleOutputCP CloseHandle CreateFileA MultiByteToWideChar WriteFile K32GetModuleFileNameExA FlushFileBuffers HeapSize SetFilePointerEx GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW EnumSystemLocalesW GetUserDefaultLCID EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException GetLastError FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle HeapReAlloc HeapFree HeapAlloc IsValidLocale WriteConsoleW

user32

GetKeyboardLayoutList

shell32

ShellExecuteA

ole32

CoCreateInstance CoUninitialize

wininet

InternetOpenA InternetSetFilePointer InternetSetOptionA HttpOpenRequestA HttpQueryInfoA InternetReadFile HttpAddRequestHeadersA InternetConnectA InternetCloseHandle HttpSendRequestA

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReceiveResponse WinHttpConnect

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_9149b8b69b5ae8461918c3fe1858f81e_amadey_elex_gcleaner_luca-stealer_lynx_njrat_smoke-loader

kernel32

user32

shell32

ole32

wininet

winhttp

generic