General
- Target 2026-07-06_e71a70d38eb1bb2ded22398d8144ddd2_amadey_elex_hijackloader_luca-stealer_njrat_play
- Size 28.8MB
- Sample260707-alcjsabs9r
- SHA256 4ea8461915643bc2600c96b12421b9c4683ee76b29a0f7eb907b3149377371b9
- MD5 e71a70d38eb1bb2ded22398d8144ddd2
- SHA1 5ca6eaf18b24781b97a4b9f0a02f43e9ae6a1df7
- SHA512 b1c85be2a0499e9bdc68207c523f6153ff200745c45867b34d42169733f1fada760566fd0f54a8a4836b743c62590cbb17580151685bb769a1784437d5caa8ee
- SSDEEP 393216:GpeTw4YKhVPs8ZRPpOlVEkD6e+XcRkcTiUs9zy+1VX1oBv/aGUOaapIVJfwhfbqk:nw41nyVE6+XXv9r1oBaOIVJf8b4UiC4o
- TLSH T1926733626FDC8462C9921A37DDBA8AFC59397C50FF50498313883BADDCF1780A779216
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-06_e71a70d38eb1bb2ded22398d8144ddd2_amadey_elex_hijackloader_luca-stealer_njrat_play.exe
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_e71a70d38eb1bb2ded22398d8144ddd2_amadey_elex_hijackloader_luca-stealer_njrat_play.exe
Resource
win11ltsc2024-20260706-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_e71a70d38eb1bb2ded22398d8144ddd2_amadey_elex_hijackloader_luca-stealer_njrat_play
- Size 28.8MB
- SHA256 4ea8461915643bc2600c96b12421b9c4683ee76b29a0f7eb907b3149377371b9
- MD5 e71a70d38eb1bb2ded22398d8144ddd2
- SHA1 5ca6eaf18b24781b97a4b9f0a02f43e9ae6a1df7
- SHA512 b1c85be2a0499e9bdc68207c523f6153ff200745c45867b34d42169733f1fada760566fd0f54a8a4836b743c62590cbb17580151685bb769a1784437d5caa8ee
- SSDEEP 393216:GpeTw4YKhVPs8ZRPpOlVEkD6e+XcRkcTiUs9zy+1VX1oBv/aGUOaapIVJfwhfbqk:nw41nyVE6+XXv9r1oBaOIVJf8b4UiC4o
- TLSH T1926733626FDC8462C9921A37DDBA8AFC59397C50FF50498313883BADDCF1780A779216
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects binaries and memory artifacts referencing sandbox product IDs
-
Detects executables packed with ASPack
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory