2026-07-19_be9aee8c3cb56fa17d293d48dd0fc1d1_amadey_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_be9aee8c3cb56fa17d293d48dd0fc1d1_amadey_elex_luca-stealer_njrat_smoke-loader
Size 3.8MB
Sample260720-a1e88acy7v
SHA256 65ab49119c845801f29a57e8aa177146b2ffbd289d4278109b146f933380f951
MD5 be9aee8c3cb56fa17d293d48dd0fc1d1
SHA1 616a15883f34627757fe19b12324ed8f0583b739
SHA512 d3574bdc2c2a365194224a60df8cd45879a4b13d7e73f750db2109830052e1cf696e067d3172437ed42e943fb64922be23b716f5f96c2f121f1002378907db9f
SSDEEP 49152:PvVnLYyAH0n6JZUfr4XF0NXTvOwJ/aHZVdG8lzLVKKpasTHLTpYGFXD8hH5u5477:VnLY5H0cvV0JZF0VZ7KAasTHKOAhZvo4
TLSH
T11506E012B441D47BD6861070DC2DE67867213E3CA7F249E3B7C43EEA79B02D1753AA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_be9aee8c3cb56fa17d293d48dd0fc1d1_amadey_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-19_be9aee8c3cb56fa17d293d48dd0fc1d1_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 3.8MB

2026-07-19_be9aee8c3cb56fa17d293d48dd0fc1d1_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH 91f3638ed81918491a1a5366767e31e9
SHA256 65ab49119c845801f29a57e8aa177146b2ffbd289d4278109b146f933380f951
MD5 be9aee8c3cb56fa17d293d48dd0fc1d1
SHA1 616a15883f34627757fe19b12324ed8f0583b739
SHA512 d3574bdc2c2a365194224a60df8cd45879a4b13d7e73f750db2109830052e1cf696e067d3172437ed42e943fb64922be23b716f5f96c2f121f1002378907db9f
SSDEEP 49152:PvVnLYyAH0n6JZUfr4XF0NXTvOwJ/aHZVdG8lzLVKKpasTHLTpYGFXD8hH5u5477:VnLY5H0cvV0JZF0VZ7KAasTHKOAhZvo4
TLSH
T11506E012B441D47BD6861070DC2DE67867213E3CA7F249E3B7C43EEA79B02D1753AA4A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1075520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

nw.exe.pdb

user32

CloseDesktop CloseWindowStation CreateDesktopW CreateWindowExW CreateWindowStationW DefWindowProcW DestroyWindow DispatchMessageW GetMessageW GetProcessWindowStation GetThreadDesktop GetUserObjectInformationW GetWindowLongW PeekMessageW PostMessageW PostThreadMessageW RegisterClassW SetProcessDPIAware SetProcessWindowStation SetWindowLongW TranslateMessage UnregisterClassW wsprintfW

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject ChangeTimerQueueTimer CloseHandle CompareStringW ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateSemaphoreW CreateThread CreateTimerQueue CreateTimerQueueTimer DebugBreak DecodePointer DeleteCriticalSection DeleteFileW DeleteTimerQueueTimer DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetNumaHighestNodeNumber GetOEMCP GetProcAddress GetProcessAffinityMask GetProcessHandleCount GetProcessHeaps GetProcessId GetProcessTimes GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadLocale GetThreadPriority GetThreadTimes GetTickCount GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersion GetVersionExW GetWindowsDirectoryW HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedFlushSList InterlockedPopEntrySList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MapViewOfFile MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus ProcessIdToSessionId QueryDepthSList QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureStackBackTrace RtlUnwind SearchPathW SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetThreadAffinityMask SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait Sleep SleepEx SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWait UnregisterWaitEx VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory lstrlenW

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath

advapi32

AccessCheck ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DuplicateToken DuplicateTokenEx EqualSid EventRegister EventUnregister EventWrite FreeSid GetAce GetKernelObjectSecurity GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorSacl GetSecurityInfo GetSidSubAuthority GetTokenInformation ImpersonateLoggedOnUser ImpersonateNamedPipeClient InitializeSid IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteValueW RegDisablePredefinedCache RegOpenKeyExW RegQueryValueExW RegSetValueExW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036

winmm

timeGetTime

shlwapi

PathMatchSpecW

psapi

GetPerformanceInfo GetProcessMemoryInfo QueryWorkingSetEx

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

326KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

prot

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_be9aee8c3cb56fa17d293d48dd0fc1d1_amadey_elex_luca-stealer_njrat_smoke-loader

user32

kernel32

shell32

advapi32

winmm

shlwapi

psapi

version

generic