2026-07-28_06900b759e637e8bf93ecbe9fa5960b5_amadey_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-07-28_06900b759e637e8bf93ecbe9fa5960b5_amadey_elex_luca-stealer_njrat_smoke-loader
Size 1.5MB
Sample260729-cbazbasbnc
SHA256 910ac721f93e66c9b945046ac11ba3fa68f2ff245bade17d7a27a3760f113e2d
MD5 06900b759e637e8bf93ecbe9fa5960b5
SHA1 8e5b6e79362f6f129393d5e44c10335889bc892b
SHA512 e561f9571ff0c4675d19b0fda174db2d459bd8b35c5a3e44c0f59a6789349e15ab805eeaf02dae6840698f5259595618c7a24fa1b3c35e09ce0784b45a9cabcc
SSDEEP 24576:q8f8owRYgV0lde1tl31OBDTwlYnTekwp:q8f81RtV0lM391OBAOn6kO
TLSH
T16475011275D28073C566193548F5D7789A2EFCA00FA0AAD763C41BFBCE34AC09B3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_06900b759e637e8bf93ecbe9fa5960b5_amadey_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-28_06900b759e637e8bf93ecbe9fa5960b5_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 1.5MB

2026-07-28_06900b759e637e8bf93ecbe9fa5960b5_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH a47ecc3693e9083d9c886f464ef6d80d
SHA256 910ac721f93e66c9b945046ac11ba3fa68f2ff245bade17d7a27a3760f113e2d
MD5 06900b759e637e8bf93ecbe9fa5960b5
SHA1 8e5b6e79362f6f129393d5e44c10335889bc892b
SHA512 e561f9571ff0c4675d19b0fda174db2d459bd8b35c5a3e44c0f59a6789349e15ab805eeaf02dae6840698f5259595618c7a24fa1b3c35e09ce0784b45a9cabcc
SSDEEP 24576:q8f8owRYgV0lde1tl31OBDTwlYnTekwp:q8f81RtV0lM391OBAOn6kO
TLSH
T16475011275D28073C566193548F5D7789A2EFCA00FA0AAD763C41BFBCE34AC09B3A755
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

26784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\src\debugpy\_vendored\pydevd\pydevd_attach_to_process\windows\inject_dll_x86.pdb

kernel32

CloseHandle GetLastError WaitForSingleObject CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleA GetProcAddress WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo CreateFileW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_06900b759e637e8bf93ecbe9fa5960b5_amadey_elex_luca-stealer_njrat_smoke-loader

kernel32

generic