2026-07-21_ac547250d927166c02f1414058d8c170_amadey_elex_luca-stealer_lynx_magniber_njrat

General

Target
2026-07-21_ac547250d927166c02f1414058d8c170_amadey_elex_luca-stealer_lynx_magniber_njrat
Size 2.7MB
Sample260721-vb2fda1bjc
SHA256 76d1e3b28ffad9766748d528d5711cfdfbec88d9a0d0c5b97d58eeb7d26ba45d
MD5 ac547250d927166c02f1414058d8c170
SHA1 727236dee4f0a9dfb30167315400c029fa3dbc77
SHA512 aa043768649f4a8e719fbaf162aa99f895986f350df2e05a529547df57dbdf7b16d0ae24abcc52b19980d6cd3ae41c909dab7c551ba26bb9a30faf48e91da26c
SSDEEP 49152:CdDa7yNeiEbMZgZKUxT25uvmB+kn3Hnx:R2NeijgDx2z+k
TLSH
T18CD5D012F2819138C9E561306C3D97BD2B3AFC386FA6619B73D4BB3949705C0AD35B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_ac547250d927166c02f1414058d8c170_amadey_elex_luca-stealer_lynx_magniber_njrat

File Explorer

2026-07-21_ac547250d927166c02f1414058d8c170_amadey_elex_luca-stealer_lynx_magniber_njrat

.exe 2.7MB

2026-07-21_ac547250d927166c02f1414058d8c170_amadey_elex_luca-stealer_lynx_magniber_njrat

IMPHASH e59e2176b6396e3a4c2c408e3cff4347
SHA256 76d1e3b28ffad9766748d528d5711cfdfbec88d9a0d0c5b97d58eeb7d26ba45d
MD5 ac547250d927166c02f1414058d8c170
SHA1 727236dee4f0a9dfb30167315400c029fa3dbc77
SHA512 aa043768649f4a8e719fbaf162aa99f895986f350df2e05a529547df57dbdf7b16d0ae24abcc52b19980d6cd3ae41c909dab7c551ba26bb9a30faf48e91da26c
SSDEEP 49152:CdDa7yNeiEbMZgZKUxT25uvmB+kn3Hnx:R2NeijgDx2z+k
TLSH
T18CD5D012F2819138C9E561306C3D97BD2B3AFC386FA6619B73D4BB3949705C0AD35B29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

392783

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MB5Uns\bin\Win32\Release\mb5uns.pdb

kernel32

LoadResource FindResourceW FindResourceExW LeaveCriticalSection EnterCriticalSection GetCurrentThreadId SetLastError RaiseException DeleteCriticalSection GetLastError InitializeCriticalSectionEx LocalFree FormatMessageW LocalAlloc Sleep CallNamedPipeW FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW MultiByteToWideChar LoadLibraryExW GetModuleFileNameW GetWindowsDirectoryW SetCurrentDirectoryW CreateMutexW DecodePointer LockResource GlobalAlloc GlobalLock GlobalFree LoadLibraryW VerifyVersionInfoW VerSetConditionMask SetThreadUILanguage GetSystemDirectoryW GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle OpenProcess K32GetModuleFileNameExA WaitForSingleObject GetExitCodeProcess GetModuleFileNameA GetTickCount OutputDebugStringW GetLocalTime CreateFileW GetSystemTimeAsFileTime WriteConsoleW SetStdHandle SetEnvironmentVariableW SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy WideCharToMultiByte MulDiv FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA FormatMessageA GetStringTypeW FindClose FindFirstFileExW FindNextFileW GetFileAttributesW GetTempPathW AreFileApisANSI GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive EncodePointer LCMapStringEx QueryPerformanceCounter GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA GetCommandLineW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadFile GetFileSizeEx GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale SetEndOfFile

dwmapi

DwmGetWindowAttribute

crypt32

CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CryptStringToBinaryA

bcrypt

BCryptGenerateSymmetricKey BCryptDestroyKey BCryptFinishHash BCryptDecrypt BCryptCreateHash BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_ac547250d927166c02f1414058d8c170_amadey_elex_luca-stealer_lynx_magniber_njrat

kernel32

dwmapi

crypt32

bcrypt

generic