Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_32d4742ac7bd3cc7c4d1ebd9810e72a6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_32d4742ac7bd3cc7c4d1ebd9810e72a6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
General
- Target 2026-07-27_32d4742ac7bd3cc7c4d1ebd9810e72a6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
- Size 1.4MB
- Sample260727-daqh2sgk8s
- SHA256 e8acbcfd36a55451e853b0033a89b61bb796013579b56ab39f4bdf2b68d67a39
- MD5 32d4742ac7bd3cc7c4d1ebd9810e72a6
- SHA1 d39d1772858c7970e9540a3fc37c8b2f630d7fd3
- SHA512 349fdcd0bffe79753483f4cedf13868f6e62a1e69d674b07c2e3d2ff173b1510b639f8a4a39e6d9344ae66df72d3ddb19ba24dbf77e0109e132e71dafadaf0b5
- SSDEEP 24576:dBaItynQMb+MgVWP1lZl1O7VWMElDX8Cnj8Y4m2kxUlYtEjedEeQ16ywqmpv:v5yQQgVK1/OWX8CnwY7uYtO2E8ywqev
- TLSH T1EA65E022FAD14072D563143002B6AF364EBEBA310565D9CFE7D41A4D9A305E1AB3F3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_32d4742ac7bd3cc7c4d1ebd9810e72a6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_32d4742ac7bd3cc7c4d1ebd9810e72a6_amadey_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_32d4742ac7bd3cc7c4d1ebd9810e72a6_amadey_elex_luca-stealer_njrat_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2848