2026-07-23_49b811a890a8b3a816ba5b58b6be1cae_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_49b811a890a8b3a816ba5b58b6be1cae_amadey_elex_luca-stealer_lynx_njrat
Size 7.8MB
Sample260723-pdvsqayapc
SHA256 c2678d3deb7dfa3163948c504db6c153e46366572c73d269a12d9303c6304796
MD5 49b811a890a8b3a816ba5b58b6be1cae
SHA1 9fecb86ec59461af104a2d7a537549f0729b7fb4
SHA512 ca329c04ba24a9c3a4912a198b7d327e20d8d7a18871f7d404976bb73ae618e420e43c536b288ee6178bea63328f18fb08d35876d98e528ea73efa17ce9c1582
SSDEEP 196608:/e6fKcW0pJ2tC5BS+77StIkLBtdL1RpWWwq:fKcWXou+fSrLBnsWR
TLSH
T1AB863382BF82B432D43210313A15A77DE6BF3C214F17198727B7BE4AAE315D0A639756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_49b811a890a8b3a816ba5b58b6be1cae_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-07-23_49b811a890a8b3a816ba5b58b6be1cae_amadey_elex_luca-stealer_lynx_njrat

.exe 7.8MB

2026-07-23_49b811a890a8b3a816ba5b58b6be1cae_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 366665a8afe76046e7aff35b7aaab5de
SHA256 c2678d3deb7dfa3163948c504db6c153e46366572c73d269a12d9303c6304796
MD5 49b811a890a8b3a816ba5b58b6be1cae
SHA1 9fecb86ec59461af104a2d7a537549f0729b7fb4
SHA512 ca329c04ba24a9c3a4912a198b7d327e20d8d7a18871f7d404976bb73ae618e420e43c536b288ee6178bea63328f18fb08d35876d98e528ea73efa17ce9c1582
SSDEEP 196608:/e6fKcW0pJ2tC5BS+77StIkLBtdL1RpWWwq:fKcWXou+fSrLBnsWR
TLSH
T1AB863382BF82B432D43210313A15A77DE6BF3C214F17198727B7BE4AAE315D0A639756
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

139979

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\devel\ark7\bin.win32\bdzsfx.x86.pdb

kernel32

lstrcmpW MulDiv SetFilePointerEx GetFileSizeEx SetFileAttributesW DeleteFileW SetFileTime SetEndOfFile WriteFile lstrcpyW GetVersion SetFileInformationByHandle DeviceIoControl SetLastError lstrlenW GetFullPathNameW lstrcatW WaitForSingleObject InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventW SetEvent ResetEvent CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW CreateHardLinkW RemoveDirectoryW CreateSymbolicLinkW VirtualAlloc VirtualFree GetModuleFileNameW GetFileAttributesW GetCurrentThread FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime Sleep IsNormalizedString NormalizeString GlobalMemoryStatusEx CompareStringW CreateFileA GetDriveTypeW FlushFileBuffers GetTickCount FindClose GlobalFree GetSystemDirectoryW LoadLibraryW LocalFree MultiByteToWideChar lstrcmpiW InitializeCriticalSectionEx RaiseException GetCurrentThreadId GetUserDefaultLangID DecodePointer GetConsoleOutputCP GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetStdHandle GetConsoleMode LCMapStringW GetStdHandle GetCommandLineW GetCommandLineA ExitProcess GetFileType FreeLibraryAndExitThread ExitThread CreateThread TlsFree WriteConsoleW TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead WideCharToMultiByte ReadFile CreateFileW FindResourceExW LoadResource FindResourceW LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetLastError FreeLibrary lstrcpynW GetModuleHandleExW CloseHandle GetCurrentProcess GetModuleHandleW LoadLibraryExW GetProcAddress EncodePointer OutputDebugStringW IsDebuggerPresent

user32

SendMessageW RegisterWindowMessageW GetDC SetFocus EndDialog KillTimer EnableWindow SetTimer SetDlgItemTextW PostMessageW MessageBoxW GetWindow MonitorFromWindow GetMonitorInfoW GetClientRect LoadIconW GetWindowTextW DialogBoxParamW UnregisterClassW GetActiveWindow CharNextW DispatchMessageW TranslateMessage PostQuitMessage PeekMessageW InvalidateRect ScreenToClient GetDlgItem CreateWindowExW DestroyWindow MoveWindow EnumChildWindows SetWindowLongW GetWindowLongW FindWindowExW GetClassNameW MapWindowPoints SetWindowTextW GetDlgCtrlID GetParent SetWindowPos SystemParametersInfoW MonitorFromPoint SetProcessDPIAware GetWindowRect ReleaseDC GetWindowTextLengthW

gdi32

CreateFontW DeleteObject GetStockObject GetDeviceCaps GetObjectW

advapi32

RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW AreAllAccessesGranted AccessCheck OpenThreadToken RevertToSelf ImpersonateSelf GetFileSecurityW GetTokenInformation OpenProcessToken

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW

ole32

CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathCanonicalizeW PathIsDirectoryW

Name

.text

Size

233KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ve_share

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_49b811a890a8b3a816ba5b58b6be1cae_amadey_elex_luca-stealer_lynx_njrat

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

generic