Extracted

Extracted

• • Target
    2026-08-01_84f7b78c0b8f7d908d86f79dbefb1440_amadey_elex_luca-stealer_lynx_njrat
  • Size 1.6MB
  • SHA256 aa9f6621da7e8adbda9c3c941031bafbb71591e76429871f121cb3f00b7219b1
  • MD5 84f7b78c0b8f7d908d86f79dbefb1440
  • SHA1 71af317f5d6850f3c96917929359837351c238f9
  • SHA512 ce212114c7c42cd7a302dbd445a65ba6cd864d90c8e0c919beefffe71355504fc9198fb710989d608decc7fbb37435543a47e7181c558d36c1374ce5b6315247
  • SSDEEP 49152:71eRAjcbeBPHHY3nttCT8HSYLDlexvWlki:71m0kmRYLDlex
  • TLSH
    T12E752392B9D1C076D8671A7199F5EFB4992DFC214F6018DB63C8073A8F319C09B24E6B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sheet_bmrsbggldtglydiscoveryexecutionlummasheetratpersistenceprivilege_escalationstealertrojan

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2