2026-08-03_18a6de97185e598c30fb73bed1a7a281_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-08-03_18a6de97185e598c30fb73bed1a7a281_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader
Size 1.5MB
Sample260803-fwthyacm6w
SHA256 ea87809ec6b98cb44e8afeb4cc636f1f665bed59755cf3973260737de223ae96
MD5 18a6de97185e598c30fb73bed1a7a281
SHA1 1c93caf99ac076e5f1e4b75ec086bb683166a98e
SHA512 ba9b3581b60ed6fc35cb15835a7361a49f2ca9ee8bddc0b95ed1c1f7845755355460ae02ea5e7df1a8ab182f599f8598c3ffb735d1188225e7f7e17371098887
SSDEEP 24576:uJiaPSrMr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uJiaPlLNiXicJFFRGNzj3
TLSH
T111651292B1C184B1C97B04364875CB35897DBC280E609ADFA3D83A3ADE727D14739A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_18a6de97185e598c30fb73bed1a7a281_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-03_18a6de97185e598c30fb73bed1a7a281_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader

.exe 1.5MB

2026-08-03_18a6de97185e598c30fb73bed1a7a281_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader

IMPHASH 54f9870e328033cc3fa0ad5d0dd5f9be
SHA256 ea87809ec6b98cb44e8afeb4cc636f1f665bed59755cf3973260737de223ae96
MD5 18a6de97185e598c30fb73bed1a7a281
SHA1 1c93caf99ac076e5f1e4b75ec086bb683166a98e
SHA512 ba9b3581b60ed6fc35cb15835a7361a49f2ca9ee8bddc0b95ed1c1f7845755355460ae02ea5e7df1a8ab182f599f8598c3ffb735d1188225e7f7e17371098887
SSDEEP 24576:uJiaPSrMr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uJiaPlLNiXicJFFRGNzj3
TLSH
T111651292B1C184B1C97B04364875CB35897DBC280E609ADFA3D83A3ADE727D14739A5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

38875

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u501\2871\build\windows-i586\jdk\objs\java_objs\java.pdb

advapi32

RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey

user32

CharNextExA MessageBoxA

comctl32

InitCommonControlsEx

kernel32

HeapSize WriteConsoleW GetTimeZoneInformation GetCommandLineW WideCharToMultiByte GetCommandLineA CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject GetExitCodeProcess GetExitCodeThread CreateProcessA FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA LocalFree FormatMessageA FindClose FindFirstFileA FindNextFileA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetFileSizeEx RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException ExitProcess GetModuleHandleExW SetFilePointerEx CreateThread ExitThread FreeLibraryAndExitThread CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle WriteFile GetModuleFileNameW ReadFile GetConsoleMode ReadConsoleW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW SetStdHandle GetConsoleOutputCP HeapReAlloc MultiByteToWideChar SetEnvironmentVariableW GetFileAttributesExW FlushFileBuffers GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetProcessHeap SetEndOfFile DecodePointer

Name

.text

Size

161KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_18a6de97185e598c30fb73bed1a7a281_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader

advapi32

user32

comctl32

kernel32

generic