General
- Target 2026-07-31_1a869f9385ae10f07f0d5216210cf34d_amadey_elex_luca-stealer_mespinoza_njrat_smoke-loader
- Size 1.1MB
- Sample260731-1s85fasbkd
- SHA256 66925d3c725e0b81bb0f53c91c886fe513c4039b7250e8fb426300c851a910ba
- MD5 1a869f9385ae10f07f0d5216210cf34d
- SHA1 1b4869a25e609cb75e36e12e2aab1d40fe7f8c2b
- SHA512 93c40555495ba3e03adba1172250d791a877abb1e5f5a4c977da775f6243ec7ca007ecc715b3352e55662e4de3833146f9c147cd7c96a15b87bc84ba45a714ec
- SSDEEP 24576:fgW2zDC6rlhU7TfU2CrywiD+8JT4fCVSPIIUIn0d9Uq6gr09N4yn:fUDCWlhqTfU2CryXDNJTOiEIIUIS9UqS
- TLSH T1DE350246F0C2C073F7A36070263AE5685D3EEA6397381DC76294EA794975DE20B32637
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_1a869f9385ae10f07f0d5216210cf34d_amadey_elex_luca-stealer_mespinoza_njrat_smoke-loader.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_1a869f9385ae10f07f0d5216210cf34d_amadey_elex_luca-stealer_mespinoza_njrat_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_1a869f9385ae10f07f0d5216210cf34d_amadey_elex_luca-stealer_mespinoza_njrat_smoke-loader
- Size 1.1MB
- SHA256 66925d3c725e0b81bb0f53c91c886fe513c4039b7250e8fb426300c851a910ba
- MD5 1a869f9385ae10f07f0d5216210cf34d
- SHA1 1b4869a25e609cb75e36e12e2aab1d40fe7f8c2b
- SHA512 93c40555495ba3e03adba1172250d791a877abb1e5f5a4c977da775f6243ec7ca007ecc715b3352e55662e4de3833146f9c147cd7c96a15b87bc84ba45a714ec
- SSDEEP 24576:fgW2zDC6rlhU7TfU2CrywiD+8JT4fCVSPIIUIn0d9Uq6gr09N4yn:fUDCWlhqTfU2CryXDNJTOiEIIUIS9UqS
- TLSH T1DE350246F0C2C073F7A36070263AE5685D3EEA6397381DC76294EA794975DE20B32637
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects Rhadamanthys Payload
-
Family: Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess