2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader
Size 1.5MB
Sample260604-twstasay7v
SHA256 6fd6cb800bc1dc5c28001adf8c7847c4b920fa3233ebc587baa6724b3e407820
MD5 88249a9528191431169111148b1254dc
SHA1 a22cbe96f1a8604c9b5f64f1d42aa54ac6a56d4c
SHA512 e8a2853fb6075a5bea0a0264f1b1042da26a06a6a711d6f2fe6cad32001e7f52a32a6e2516d89dfee70716017b3f272c94ed7ddf4cfe93aac2d064aa9e813b8f
SSDEEP 24576:Famv/M7y6tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:smHM7y6tdnYz5d6JgCg
TLSH
T19E65F1507591C032D8B600324D68DBB5897EBD214F6189EBB3D42A7EDE306C2A735B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader

File Explorer

2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader

.exe 1.5MB

2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader

IMPHASH 57e905e000761bf18445a4116ce84827
SHA256 6fd6cb800bc1dc5c28001adf8c7847c4b920fa3233ebc587baa6724b3e407820
MD5 88249a9528191431169111148b1254dc
SHA1 a22cbe96f1a8604c9b5f64f1d42aa54ac6a56d4c
SHA512 e8a2853fb6075a5bea0a0264f1b1042da26a06a6a711d6f2fe6cad32001e7f52a32a6e2516d89dfee70716017b3f272c94ed7ddf4cfe93aac2d064aa9e813b8f
SSDEEP 24576:Famv/M7y6tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:smHM7y6tdnYz5d6JgCg
TLSH
T19E65F1507591C032D8B600324D68DBB5897EBD214F6189EBB3D42A7EDE306C2A735B6F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\out\Release\RadminVPN\x86\RvGuiStarter.pdb

kernel32

MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CloseHandle SetEvent ResetEvent WaitForSingleObject SetLastError OpenEventW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTime GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection Sleep CreateEventW WriteConsoleW SetEndOfFile HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW GetTempPathW RtlCaptureContext CreateFileW SetUnhandledExceptionFilter InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW GetCurrentProcess CreateThread GetCurrentThreadId GetProcessId VirtualQueryEx FreeLibrary GetProcAddress LoadLibraryW WriteFile SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW WaitForMultipleObjects GetCurrentProcessId InitializeCriticalSectionEx GetModuleHandleW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle HeapAlloc HeapFree GetFileType HeapReAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx GetLastError

shell32

ShellExecuteW

wininet

HttpAddRequestHeadersW HttpOpenRequestW HttpSendRequestW HttpQueryInfoW InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW InternetCrackUrlW InternetQueryDataAvailable InternetSetOptionW

msi

ord205 ord70

advapi32

RegGetValueW RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader

kernel32

shell32

wininet

msi

advapi32

generic