2026-07-10_edb0fe956032c8a648911a3d832432a1_amadey_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_edb0fe956032c8a648911a3d832432a1_amadey_elex_luca-stealer_njrat_smoke-loader
Size 1.5MB
Sample260710-xt7ffsft5p
SHA256 37bddaa82d372d6f41030ed0408f3e60be958ad2f25505a9a6447721129508bd
MD5 edb0fe956032c8a648911a3d832432a1
SHA1 2e86bd1abd9c2d99406a894ce5f275b3cf2e3eb9
SHA512 2abda54a8a248ae0ed1dcfbd82ad43ef2340ca57a8f77409b73ebb6bf5ca09552634381a8a519cb385209d462ba3a00c6ba123055d0bed9dec37791b5d66a698
SSDEEP 24576:jzlF2av6hlgZcdpFCU+CujMar1PcYc89inxLs3EL05q2Z/IrCFFZX:9FT6hlgZcdpFCsarh7P9inm4uLZOkZ
TLSH
T19F65E13139818171DDE210B646ECFA3A42AED4B00B2956CB62C857FEEA745D17F33987
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_edb0fe956032c8a648911a3d832432a1_amadey_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-10_edb0fe956032c8a648911a3d832432a1_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 1.5MB

2026-07-10_edb0fe956032c8a648911a3d832432a1_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH b88ef5e63292abb9c88f06019a95c5b2
SHA256 37bddaa82d372d6f41030ed0408f3e60be958ad2f25505a9a6447721129508bd
MD5 edb0fe956032c8a648911a3d832432a1
SHA1 2e86bd1abd9c2d99406a894ce5f275b3cf2e3eb9
SHA512 2abda54a8a248ae0ed1dcfbd82ad43ef2340ca57a8f77409b73ebb6bf5ca09552634381a8a519cb385209d462ba3a00c6ba123055d0bed9dec37791b5d66a698
SSDEEP 24576:jzlF2av6hlgZcdpFCU+CujMar1PcYc89inxLs3EL05q2Z/IrCFFZX:9FT6hlgZcdpFCsarh7P9inm4uLZOkZ
TLSH
T19F65E13139818171DDE210B646ECFA3A42AED4B00B2956CB62C857FEEA745D17F33987
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\workspace\p-80ba572eab7846c3a8bc4837b685d41f\src\product\win32\cfpixeleditor.pdb

kernel32

DecodePointer CloseHandle RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar WideCharToMultiByte DeleteFileW GetFileSizeEx SetFilePointer SetLastError ReleaseMutex WaitForSingleObject CreateMutexW Sleep WriteFile GetCurrentThreadId GetLocalTime GetTickCount GetModuleFileNameW FormatMessageW ExpandEnvironmentStringsW GetLogicalDriveStringsW QueryDosDeviceW GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess ReadProcessMemory FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW LocalFree SetDllDirectoryW FreeEnvironmentStringsW WriteConsoleW ReadConsoleW SetEndOfFile ReadFile GetFileSize GetFileAttributesW CreateFileW GetCurrentProcessId CreateDirectoryW SetConsoleCtrlHandler GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetEnvironmentStringsW GetTimeZoneInformation SetStdHandle IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead FormatMessageA GetStringTypeW EncodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo RtlUnwind InterlockedPushEntrySList InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle GetCurrentThread GetFileType GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW

user32

UnregisterClassW

advapi32

AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW

shell32

ShellExecuteExW CommandLineToArgvW

shlwapi

PathRemoveExtensionW PathFindFileNameW PathRemoveFileSpecW PathAddBackslashW PathAppendW

Name

.text

Size

779KB

Virtual Size

779KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

265B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_edb0fe956032c8a648911a3d832432a1_amadey_elex_luca-stealer_njrat_smoke-loader

kernel32

user32

advapi32

shell32

shlwapi

generic