2026-08-08_81575472cf307535e78954cb92926ff1_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_81575472cf307535e78954cb92926ff1_amadey_elex_luca-stealer_lynx_njrat
Size 1.8MB
Sample260808-tb6veszekf
SHA256 d6d9a57d3536ef812fd8712634e02ce81a0df40cdd4e3dd59ecc01f3af8395e1
MD5 81575472cf307535e78954cb92926ff1
SHA1 4e377bddb8e4f6d8b9100a23fe17b0022c2300fc
SHA512 d0529788934c1cf1f785e1e3f452255b4b063d8661b7beb233e2bddab9a8a9b1873414109c6a4c10e5654dbb09316233be64d6859e78de2107a8a1837403c313
SSDEEP 24576:Q+hpsY+tOfShxxWwpnyp1LBPPs0Z7X0V9sFU4ef3QYM5L3vAnFxnZyPA:jIlyp1FPPs0Z7X0V9sFU4efAYM5kvyPA
TLSH
T15385F51167EA8224F6F37B717E3896A54A7ABEA15F35C4CF4384295C0970AC0DA70B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_81575472cf307535e78954cb92926ff1_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-08-08_81575472cf307535e78954cb92926ff1_amadey_elex_luca-stealer_lynx_njrat

.exe 1.8MB

2026-08-08_81575472cf307535e78954cb92926ff1_amadey_elex_luca-stealer_lynx_njrat

IMPHASH d2e0121bcc503c73fff1e1a690139487
SHA256 d6d9a57d3536ef812fd8712634e02ce81a0df40cdd4e3dd59ecc01f3af8395e1
MD5 81575472cf307535e78954cb92926ff1
SHA1 4e377bddb8e4f6d8b9100a23fe17b0022c2300fc
SHA512 d0529788934c1cf1f785e1e3f452255b4b063d8661b7beb233e2bddab9a8a9b1873414109c6a4c10e5654dbb09316233be64d6859e78de2107a8a1837403c313
SSDEEP 24576:Q+hpsY+tOfShxxWwpnyp1LBPPs0Z7X0V9sFU4ef3QYM5L3vAnFxnZyPA:jIlyp1FPPs0Z7X0V9sFU4efAYM5kvyPA
TLSH
T15385F51167EA8224F6F37B717E3896A54A7ABEA15F35C4CF4384295C0970AC0DA70B37
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

732890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dr-ag-d610f49a-we\_work\1\s\Output\bin\Release\SetupExtensions.pdb

kernel32

FreeConsole GetStdHandle AttachConsole DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GetCommandLineW SetThreadUILanguage FreeLibrary LoadLibraryW CopyFileW GetEnvironmentVariableW GetProcessId GetExitCodeProcess TerminateProcess OpenProcess WaitForMultipleObjects ReadFile GetFileSizeEx CloseHandle DeleteFileW WriteFile CreateFileW FindClose FindFirstFileW GetLastError MultiByteToWideChar WideCharToMultiByte FindResourceW FindResourceExW LoadResource LockResource SizeofResource LocalFree GetCurrentThreadId GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize WriteConsoleW HeapDestroy SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA ReadConsoleW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapCreate OutputDebugStringA SetLastError GetCurrentDirectoryW GetModuleFileNameW GetCurrentProcessId GetLocalTime GetTickCount FormatMessageA GetModuleHandleW GetProcAddress GetCurrentProcess GetVersionExW GetNativeSystemInfo IsDebuggerPresent SetUnhandledExceptionFilter RtlCaptureStackBackTrace ReleaseSRWLockExclusive Sleep RaiseException WaitForSingleObject DuplicateHandle CreateEventW ExpandEnvironmentStringsW TryAcquireSRWLockExclusive AcquireSRWLockExclusive CreateToolhelp32Snapshot Process32FirstW Process32NextW GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter TlsGetValue GetModuleHandleExW LoadLibraryExW TlsAlloc TlsFree TlsSetValue SetFilePointerEx GetFileInformationByHandle SetFileInformationByHandle FlushFileBuffers CreateDirectoryW GetFileAttributesExW SetCurrentDirectoryW FindNextFileW FindFirstFileExW SleepConditionVariableSRW WakeAllConditionVariable SetEvent LocaleNameToLCID GetTickCount64 SetHandleInformation CreatePipe CreateProcessW ProcessIdToSessionId QueryFullProcessImageNameW IsWow64Process lstrcmpA ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW GetOverlappedResult CancelIo GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetLocaleInfoEx DeviceIoControl CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW InitOnceBeginInitialize InitOnceComplete EncodePointer EnterCriticalSection LeaveCriticalSection LCMapStringEx CompareStringEx GetCPInfo OutputDebugStringW UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount GetConsoleOutputCP GetConsoleMode ExitProcess SetStdHandle GetFileType

user32

GetWindowThreadProcessId MessageBoxW PeekMessageW WaitForInputIdle

advapi32

GetTraceLoggerHandle OpenProcessToken GetTokenInformation RegQueryValueExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegSetValueExW InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSidSubAuthority RegDeleteKeyExW EqualSid LookupAccountSidW RegLoadKeyW RegUnLoadKeyW RegDeleteTreeW RegGetValueW ConvertStringSidToSidW AdjustTokenPrivileges LookupPrivilegeValueW AllocateAndInitializeSid CheckTokenMembership FreeSid AddAce CopySid GetAclInformation GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorLength GetSecurityDescriptorOwner GetSecurityDescriptorSacl TraceEvent RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags RegCreateKeyExW RegOpenKeyExW RegCloseKey RegEnumKeyW InitializeSid IsValidSid UnregisterTraceGuids ConvertStringSecurityDescriptorToSecurityDescriptorW MakeSelfRelativeSD MakeAbsoluteSD GetSidLengthRequired

shell32

SHGetKnownFolderPath ShellExecuteExW CommandLineToArgvW ShellExecuteW

oleaut32

SysAllocStringLen SysAllocStringByteLen SysStringLen SysAllocString VariantClear SysFreeString

dbghelp

SymFromAddr SymSetSearchPathW SymGetSearchPathW SymInitialize SymSetOptions SymGetLineFromAddr64

winmm

timeGetTime

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

shlwapi

PathFindExtensionW PathRemoveExtensionW PathRemoveFileSpecW PathCreateFromUrlW PathAppendW PathCombineW PathIsDirectoryW ord437 UrlCreateFromPathW PathFindFileNameW PathFileExistsW

libcurl_x86

curl_slist_free_all curl_easy_setopt curl_easy_getinfo curl_slist_append curl_easy_perform curl_easy_cleanup curl_easy_init curl_global_cleanup curl_global_init

ole32

CoUninitialize CoInitializeEx StringFromGUID2 CoTaskMemFree CLSIDFromProgID CoCreateInstance

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_81575472cf307535e78954cb92926ff1_amadey_elex_luca-stealer_lynx_njrat

kernel32

user32

advapi32

shell32

oleaut32

dbghelp

winmm

version

shlwapi

libcurl_x86

ole32

generic