2026-08-03_cd2505f031d6e51fbfdfddb5b268d95d_amadey_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_cd2505f031d6e51fbfdfddb5b268d95d_amadey_elex_luca-stealer_njrat_smoke-loader
Size 2.1MB
Sample260804-lmx3naswe1
SHA256 6b64f97bb67054f66f743f3a0a6361f0c83b8c5817ef56426cd2ead6f6f61e34
MD5 cd2505f031d6e51fbfdfddb5b268d95d
SHA1 4c752c5c94cdfd2a6c505354515520423808601e
SHA512 c6f3bb5d46c4cabb577d469586871bcb27ad4ef9bde33cf49ec71566c0090d55db61dcb86fe6247e81fd46fa9bbb3272bdf8c6097c1a6e8218563dd0f3a1e2e7
SSDEEP 49152:ohfejJdDLQmRjYqMcf8O02VdThCfJaRgA7tB3nDq7tLm8ZZH:ohmjzImR8qzv0MdThCfAeWtB3wtLm2
TLSH
T1D6A52310B5918876C5320A3408F5EAF45A69FF304F3089EF6B58773D6F362D19732AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-03_cd2505f031d6e51fbfdfddb5b268d95d_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 2.1MB

2026-08-03_cd2505f031d6e51fbfdfddb5b268d95d_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH 017eff29c582ddd5f5cca420a61ce83c
SHA256 6b64f97bb67054f66f743f3a0a6361f0c83b8c5817ef56426cd2ead6f6f61e34
MD5 cd2505f031d6e51fbfdfddb5b268d95d
SHA1 4c752c5c94cdfd2a6c505354515520423808601e
SHA512 c6f3bb5d46c4cabb577d469586871bcb27ad4ef9bde33cf49ec71566c0090d55db61dcb86fe6247e81fd46fa9bbb3272bdf8c6097c1a6e8218563dd0f3a1e2e7
SSDEEP 49152:ohfejJdDLQmRjYqMcf8O02VdThCfJaRgA7tB3nDq7tLm8ZZH:ohmjzImR8qzv0MdThCfAeWtB3wtLm2
TLSH
T1D6A52310B5918876C5320A3408F5EAF45A69FF304F3089EF6B58773D6F362D19732AA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

7a:40:6f:ed:95:45:d7:89:7d:35:28:99:95:d0:a9:1b:4f:42:2a:a1:fb:dd:c0:76:3c:75:3e:ae:db:9b:bd:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Intel(R) pGFX 2020,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Chains

Aug 20, 2020

CN=Intel(R) pGFX 2020,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Intel(R) pGFX 2020,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Serial Number

56:00:00:0c:3b:f9:a3:68:22:89:a0:6f:40:00:00:00:00:0c:3b

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2020 - Jun 17, 2021

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Serial Number

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 28, 2015 - Jun 17, 2021

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

61:18:54:86:00:00:00:00:00:24

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 11, 2011 - Apr 11, 2021

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Serial Number

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2014 - Mar 17, 2021

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Serial Number

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 20, 2018 - Mar 17, 2021

Minor OS version

Major OS version

Entry point

30078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jenkins\workspace\Installer\Src\LPSS\Wrapper\Release\Wrapper.pdb

shlwapi

PathAppendW PathRemoveFileSpecW

kernel32

GetCPInfo HeapSize SetStdHandle SizeofResource WriteFile SetFileTime CreateFileW SetFileAttributesW MultiByteToWideChar LocalFileTimeToFileTime GetLastError LockResource CloseHandle LoadResource FindResourceW GetProcAddress GetModuleHandleW DosDateTimeToFileTime GetSystemDirectoryW FormatMessageW LoadLibraryW LocalFree FreeLibrary CreateDirectoryW GetTempPathW WaitForSingleObject DeleteFileW CreateProcessW GetTempFileNameW GetExitCodeProcess GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW WriteConsoleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP

user32

MessageBoxW

shell32

SHCreateDirectoryExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_cd2505f031d6e51fbfdfddb5b268d95d_amadey_elex_luca-stealer_njrat_smoke-loader

shlwapi

kernel32

user32

shell32

generic