2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat
Size 1.1MB
Sample260707-ajzxasbs8l
SHA256 42fff6c69ca79a94c61270532ff71ea581bba45eb6a888ca8aee6e6229b9cb16
MD5 e8aa37b5e632aad6e36eac90aa2d1dc7
SHA1 1d82d91b44d80f3dcf8bc0f73a3d988dde27caae
SHA512 f7fffa0e60596afa2157d2db73c70f4e7be8cd58b5d8a5a0598830409e86c5f49b25816b05026f801b349a97ba6421b9fe3c9f8a244b2ee576a634900e83a048
SSDEEP 24576:IHv9VDzhVtJdH+MgNPuHHASIbGKiARu6W2qTxi9trwUl7eFsj:I5JR+DPQAScGhARub2tkrFs
TLSH
T12B45E026F412C432E1B112F0697DABA6906DBC354B6449CBB3C45E6A49706E37F32E37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat

.exe 1.1MB

2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 2ad9fe49db3ae53c2f0fcfd324bbcee2
SHA256 42fff6c69ca79a94c61270532ff71ea581bba45eb6a888ca8aee6e6229b9cb16
MD5 e8aa37b5e632aad6e36eac90aa2d1dc7
SHA1 1d82d91b44d80f3dcf8bc0f73a3d988dde27caae
SHA512 f7fffa0e60596afa2157d2db73c70f4e7be8cd58b5d8a5a0598830409e86c5f49b25816b05026f801b349a97ba6421b9fe3c9f8a244b2ee576a634900e83a048
SSDEEP 24576:IHv9VDzhVtJdH+MgNPuHHASIbGKiARu6W2qTxi9trwUl7eFsj:I5JR+DPQAScGhARub2tkrFs
TLSH
T12B45E026F412C432E1B112F0697DABA6906DBC354B6449CBB3C45E6A49706E37F32E37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

279537

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\data\landun\workspace\rx64\QQInstaller\Setup3\build\Release\Uninstall.pdb

msi

ord195

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

htons recv WSACleanup closesocket gethostbyname WSAStartup inet_addr send socket connect inet_ntoa

kernel32

EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetFileType CreateDirectoryW GetLongPathNameW GetTempPathW GetFileAttributesW DeleteFileW GetProcAddress GetModuleHandleW RemoveDirectoryW MoveFileExW GetTickCount MoveFileW GetLastError CreateMutexW LoadLibraryW GetVersionExW WideCharToMultiByte QueryDosDeviceW K32GetModuleFileNameExW WaitForSingleObject K32GetProcessImageFileNameW OpenProcess GetLogicalDriveStringsW CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetCurrentProcessId CreateProcessW lstrcmpiW TerminateProcess K32EnumProcessModules MultiByteToWideChar SizeofResource FindFirstFileW WriteFile FindClose CreateFileW LoadResource FindResourceW SetUnhandledExceptionFilter ExpandEnvironmentStringsW CreateEventW ReadFile SetLastError FindNextFileW GetCurrentProcess GetFileAttributesExW GetCurrentDirectoryW CopyFileW OutputDebugStringA GetModuleFileNameW SetFilePointer ReleaseMutex HeapAlloc GetStdHandle AssignProcessToJobObject ResumeThread GetSystemTimeAsFileTime GetCommandLineW LocalFree GetNativeSystemInfo QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection DeleteCriticalSection TlsSetValue TlsAlloc TlsGetValue TlsFree GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort SetEndOfFile SetFilePointerEx FlushFileBuffers HeapSize GetCurrentThreadId Sleep RaiseException CreateThread GetSystemDirectoryW GetWindowsDirectoryW SetEvent ExitProcess FreeResource LockResource SetStdHandle GetModuleHandleExW GetConsoleMode GetConsoleOutputCP GetFullPathNameW LoadLibraryExW FreeLibrary RtlUnwind GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx HeapFree GetDriveTypeW GetTimeZoneInformation ReadConsoleW GetFileSizeEx HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW IsDebuggerPresent

user32

wsprintfW MessageBoxW PostQuitMessage KillTimer TranslateMessage GetQueueStatus CallMsgFilterW MsgWaitForMultipleObjectsEx PeekMessageW SetTimer DispatchMessageW DefWindowProcW PostMessageW DestroyWindow CreateWindowExW UnregisterClassW WaitMessage RegisterClassExW

advapi32

CreateProcessAsUserW RegCreateKeyExW RegDeleteValueW RegCloseKey RegOpenKeyW RegQueryInfoKeyW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW

shell32

CommandLineToArgvW SHChangeNotify SHGetSpecialFolderPathW ShellExecuteW SHGetFolderPathW SHFileOperationW

ole32

CLSIDFromProgID CoTaskMemFree CoInitialize CoInitializeEx CoCreateInstance CoUninitialize StringFromCLSID

shlwapi

SHDeleteKeyW PathStripToRootW wnsprintfW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winmm

timeGetTime timeBeginPeriod timeEndPeriod

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat

msi

version

ws2_32

kernel32

user32

advapi32

shell32

ole32

shlwapi

userenv

winmm

generic