2026-08-07_4181faac2b01471facab2c471cee12ac_amadey_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_4181faac2b01471facab2c471cee12ac_amadey_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi
Size 1.7MB
Sample260808-bwvnsaxelf
SHA256 b3876300e6fda5e8d3bed25b2725269854f6e508716dd33ec1a7a385bfb27d47
MD5 4181faac2b01471facab2c471cee12ac
SHA1 0b408dda9ed2933e893fd40ccd41941e5864f2bb
SHA512 7e1031650219d44f2ff6d7410a2ed14a8c9514080f946d401af6cef8917c98cebee930a1d1fa201e12e021047eb4ff1c21d35c11db158f0bbb916538b0f7cbb5
SSDEEP 24576:BU4mSSxV7dZP45KmXaAwzKZ01JLrwQZNim6sKTh8wfU8ypyxknw4FYnshx8OfVep:BUASxjDK61JL0UD6XTm8ysx4x8EVep
TLSH
T16585BE203706C43AFF8242331669D65A923DAAA50F7349CF57C87E3DA9715E20B3E917
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_4181faac2b01471facab2c471cee12ac_amadey_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi

File Explorer

2026-08-07_4181faac2b01471facab2c471cee12ac_amadey_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi

.exe 1.7MB

2026-08-07_4181faac2b01471facab2c471cee12ac_amadey_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi

IMPHASH 9ebaea2db50cedd50326bde390fedf46
SHA256 b3876300e6fda5e8d3bed25b2725269854f6e508716dd33ec1a7a385bfb27d47
MD5 4181faac2b01471facab2c471cee12ac
SHA1 0b408dda9ed2933e893fd40ccd41941e5864f2bb
SHA512 7e1031650219d44f2ff6d7410a2ed14a8c9514080f946d401af6cef8917c98cebee930a1d1fa201e12e021047eb4ff1c21d35c11db158f0bbb916538b0f7cbb5
SSDEEP 24576:BU4mSSxV7dZP45KmXaAwzKZ01JLrwQZNim6sKTh8wfU8ypyxknw4FYnshx8OfVep:BUASxjDK61JL0UD6XTm8ysx4x8EVep
TLSH
T16585BE203706C43AFF8242331669D65A923DAAA50F7349CF57C87E3DA9715E20B3E917
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1773568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\DFFoundationCplusplus\Core\out\build\x86-release\bin\WsidService.pdb

wsidclient

?get@Worker@@SAAAV1@XZ ?cancelThirdLogin@Worker@@QAEXXZ ?isLogined@Worker@@QAE_NXZ ?getUserInfo@Worker@@QAE?AV?$shared_ptr@UUserInfo@@@std@@XZ ?getUserToken@Worker@@QAE?AV?$shared_ptr@UTokenInfo@@@std@@XZ ?setWsidURL@Worker@@QAEXPAD@Z ?getRemovePasswordErrorTimesURL@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@0AAV43@@Z ?mobileCaptchaLogin@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@0AAUUserInfo@@@Z ?sendMobileCaptcha@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@W4CaptchaType@@@Z ?sendEmailCaptcha@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@W4EmaiCaptchaType@@@Z ?queryCreateLimit@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@AAV?$vector@UUserCreateAuthLimitInfo@@V?$allocator@UUserCreateAuthLimitInfo@@@std@@@3@@Z ?queryLimit@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@AAV?$vector@UUserAuthLimitInfo@@V?$allocator@UUserAuthLimitInfo@@@std@@@3@@Z ?consume@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@HV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z ?regist@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@URegistInfo@@AAUUserInfo@@@Z ?checkAuth@Worker@@QAE?AW4ErrorCode@@HV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z ?thirdLogin@Worker@@QAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?getThirdList@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@W4Site@@AAV?$vector@UThirdInfo@@V?$allocator@UThirdInfo@@@std@@@3@@Z ?logout@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@XZ ?login@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@0AAUUserInfo@@@Z ?checkUserMobileexsits@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z ?checkUserEmailexsits@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z ?setRegistPid@Worker@@QAEXH@Z ?init@Worker@@QAEXUProductInfo@@@Z

iphlpapi

GetAdaptersInfo

ws2_32

closesocket WSARecv shutdown WSASocketW WSASend WSAGetLastError WSASetLastError WSACleanup WSAStartup setsockopt listen htons ioctlsocket bind

kernel32

HeapFree GetCommandLineW GetCommandLineA ExitProcess SetStdHandle FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW GetFileType CloseHandle GetLastError SetEvent WaitForSingleObject CreateEventW GetStdHandle GetCurrentProcess GetCurrentProcessId TerminateProcess GetStartupInfoW LocalFree FormatMessageW ReadFile WriteFile GetCurrentDirectoryW GetLongPathNameW GetTempPathW GetSystemDirectoryW WideCharToMultiByte CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetEndOfFile GetDateFormatW Sleep MoveFileExW HeapAlloc GetEnvironmentVariableW SetEnvironmentVariableW GetSystemInfo GetVersionExW GetComputerNameW EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary GetProcAddress LoadLibraryW VerSetConditionMask SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetWaitableTimer QueueUserAPC TerminateThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleA FormatMessageA VerifyVersionInfoA MultiByteToWideChar GetModuleFileNameA GetFileAttributesA GetCurrentThreadId GetDynamicTimeZoneInformation WriteConsoleW GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute LoadLibraryExW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale OutputDebugStringW GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetTimeZoneInformation FlushFileBuffers ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap HeapSize SetThreadPriority SetFilePointer InterlockedPushEntrySList RtlUnwind GetLocaleInfoEx WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetModuleHandleW GetStringTypeW GetCPInfo InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent RaiseException

advapi32

ReportEventW RegisterEventSourceW DeregisterEventSource RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey OpenServiceW OpenSCManagerW DeleteService CreateServiceW CloseServiceHandle ChangeServiceConfigW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW

mswsock

AcceptEx GetAcceptExSockaddrs

Name

.text

Size

772KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

282KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

616KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

��+��u|

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_4181faac2b01471facab2c471cee12ac_amadey_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi

wsidclient

iphlpapi

ws2_32

kernel32

advapi32

mswsock

generic