2026-07-22_0e01ef59e441c4fdd3462fd8498d2c85_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_0e01ef59e441c4fdd3462fd8498d2c85_amadey_elex_luca-stealer_lynx_njrat
Size 1.2MB
Sample260722-1a5pas1vas
SHA256 943af132316f2ed9c919732ee04f5b1ee5ffba1556a09da48380b4211c4093ee
MD5 0e01ef59e441c4fdd3462fd8498d2c85
SHA1 f4eec1585c0f348c70aeb7fcc0cd8c4677049c96
SHA512 038e4c5b28036f2a7a1f8af4141bb3482d804b4a3f3fe010909d44bdc6f92d0b35d1694d82bc2479064546dfd08b5cb60ef4f879a53f76f90e529f314aa551cf
SSDEEP 24576:0PyefhnsltoWgrQE2vhSMXl7ho+yLdCN/j2GLl3iFSE33b9I:hltoWx3o+yoN/j2U4FH
TLSH
T17B45F13275B1C033E032827109ACEBA466BDFA714F32068B77D426AD6F745C19B36A57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_0e01ef59e441c4fdd3462fd8498d2c85_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-07-22_0e01ef59e441c4fdd3462fd8498d2c85_amadey_elex_luca-stealer_lynx_njrat

.exe 1.2MB

2026-07-22_0e01ef59e441c4fdd3462fd8498d2c85_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 304d3f4083263197807c084759035490
SHA256 943af132316f2ed9c919732ee04f5b1ee5ffba1556a09da48380b4211c4093ee
MD5 0e01ef59e441c4fdd3462fd8498d2c85
SHA1 f4eec1585c0f348c70aeb7fcc0cd8c4677049c96
SHA512 038e4c5b28036f2a7a1f8af4141bb3482d804b4a3f3fe010909d44bdc6f92d0b35d1694d82bc2479064546dfd08b5cb60ef4f879a53f76f90e529f314aa551cf
SSDEEP 24576:0PyefhnsltoWgrQE2vhSMXl7ho+yLdCN/j2GLl3iFSE33b9I:hltoWx3o+yoN/j2U4FH
TLSH
T17B45F13275B1C033E032827109ACEBA466BDFA714F32068B77D426AD6F745C19B36A57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

232180

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\workspace\p-ad0484fbdfe349d18f6d70b4084a70ba\src\product\win32\pdfext.pdb

shlwapi

PathRemoveFileSpecW PathFileExistsW

kernel32

SetEndOfFile InitializeCriticalSectionEx CreateFileW GetFileAttributesW HeapSize MultiByteToWideChar GetLastError LockResource HeapReAlloc CloseHandle RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetFileSize DeleteCriticalSection GetProcessHeap WideCharToMultiByte SetFilePointer LocalAlloc LocalFree FlushFileBuffers FindNextFileW GetModuleFileNameW FindClose GetCommandLineW WriteFile CompareFileTime GetFileAttributesExW WaitForSingleObject CreateEventW SetEvent GetModuleFileNameA CreateDirectoryA CreateMutexW ReleaseMutex GetStdHandle CancelIoEx Sleep LoadLibraryW GetProcAddress GetOEMCP GetACP IsValidCodePage GetConsoleOutputCP GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx ReadConsoleW GetConsoleMode ExitProcess GetModuleHandleExW FreeLibraryAndExitThread HeapFree SizeofResource ReadFile CreateDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetModuleHandleW ExitThread CreateThread GetFileType GetCommandLineA LoadLibraryExW FormatMessageA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitializeSRWLock EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId WaitForSingleObjectEx WriteConsoleW GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FindFirstFileExW SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount ResetEvent IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead OutputDebugStringW RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary

user32

FindWindowExW DestroyWindow IsWindowVisible DefWindowProcW RegisterClassExW DispatchMessageW SetTimer GetForegroundWindow TranslateMessage FindWindowW SetWindowLongW KillTimer PostQuitMessage GetAncestor GetWindowTextW UnregisterClassW GetMessageW PostMessageW GetWindowLongW CreateWindowExW

advapi32

RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegCloseKey

shell32

ShellExecuteExW ShellExecuteW SHGetFolderPathA SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_0e01ef59e441c4fdd3462fd8498d2c85_amadey_elex_luca-stealer_lynx_njrat

shlwapi

kernel32

user32

advapi32

shell32

generic