2026-06-28_f25e8d73fb5dcce173b008b777c92f99_amadey_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-06-28_f25e8d73fb5dcce173b008b777c92f99_amadey_elex_luca-stealer_njrat_smoke-loader
Size 696KB
Sample260628-wlkfaabs3q
SHA256 45e003d0f3524133bfa72f9ad0c2aa90abdbe7427056cf39d2b60069b3bd35fa
MD5 f25e8d73fb5dcce173b008b777c92f99
SHA1 ff238fb7a3c360d59023e878a5ded33570de0827
SHA512 17cc62bb28db6b783565a6181663d0967f66add1b0261ddc6a6ea9dacfdfb4c1c81ab46c6cef069ce98b00d1c8f0f68a2464d2ec2f34c12b544b8a3884f6cd16
SSDEEP 12288:9aWjdcLrZRgNH6+PU6CNmKsPtdsXlOZN:4WjdwzgA+M63ds0
TLSH
T19EE43821658180FED1E533385B29CA6D0B696DA27AA289DF23D47D2EFEFD183C5104D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_f25e8d73fb5dcce173b008b777c92f99_amadey_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-06-28_f25e8d73fb5dcce173b008b777c92f99_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 696KB

2026-06-28_f25e8d73fb5dcce173b008b777c92f99_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH a4ea38a32aa093889cfc9a4187dd66f4
SHA256 45e003d0f3524133bfa72f9ad0c2aa90abdbe7427056cf39d2b60069b3bd35fa
MD5 f25e8d73fb5dcce173b008b777c92f99
SHA1 ff238fb7a3c360d59023e878a5ded33570de0827
SHA512 17cc62bb28db6b783565a6181663d0967f66add1b0261ddc6a6ea9dacfdfb4c1c81ab46c6cef069ce98b00d1c8f0f68a2464d2ec2f34c12b544b8a3884f6cd16
SSDEEP 12288:9aWjdcLrZRgNH6+PU6CNmKsPtdsXlOZN:4WjdwzgA+M63ds0
TLSH
T19EE43821658180FED1E533385B29CA6D0B696DA27AA289DF23D47D2EFEFD183C5104D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

89833

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\WorkSpace\Squirrel.Windows\src\StubExecutable\bin\Release\StubExecutable.pdb

kernel32

FindFirstFileW FindClose GetModuleFileNameW GetModuleHandleW FindNextFileW GetLogicalProcessorInformationEx GetLastError CreateProcessW SetProcessAffinityMask ResumeThread WriteConsoleW HeapSize CreateFileW SetStdHandle MultiByteToWideChar WideCharToMultiByte GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode HeapFree HeapAlloc ReadFile ReadConsoleW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CloseHandle HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetEndOfFile

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_f25e8d73fb5dcce173b008b777c92f99_amadey_elex_luca-stealer_njrat_smoke-loader

kernel32

user32

generic