2026-08-09_b152243fc65dc5c19f9bed742e670568_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_b152243fc65dc5c19f9bed742e670568_amadey_elex_luca-stealer_lynx_njrat_smoke-loader
Size 1.7MB
Sample260809-3s8vsafm81
SHA256 1ece1bcb4559eddfa18c538c47cb6c56e0fcd510b57d744344d9cd45416bfe9f
MD5 b152243fc65dc5c19f9bed742e670568
SHA1 876a463c7f0839a14ac899d0338761a84249c0d1
SHA512 b3feba2b5febcc5d0fd233e74a44b32c42cc7c1b53c4c3dfafaeac5e440403710e36fc5f53127c69590b2ccb664acd3f648584771c5c98802b893ab24a3cb449
SSDEEP 49152:mUASxjRK61JL0UD6XT58yJWuUsSrbNLted:wSxjRK61JAXfSPNLtW
TLSH
T19C85BE203706C43AFF8252331269D65A923DAEA10F6349CF67C87E7C69755E20B3E917
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_b152243fc65dc5c19f9bed742e670568_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-08-09_b152243fc65dc5c19f9bed742e670568_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 1.7MB

2026-08-09_b152243fc65dc5c19f9bed742e670568_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 9ebaea2db50cedd50326bde390fedf46
SHA256 1ece1bcb4559eddfa18c538c47cb6c56e0fcd510b57d744344d9cd45416bfe9f
MD5 b152243fc65dc5c19f9bed742e670568
SHA1 876a463c7f0839a14ac899d0338761a84249c0d1
SHA512 b3feba2b5febcc5d0fd233e74a44b32c42cc7c1b53c4c3dfafaeac5e440403710e36fc5f53127c69590b2ccb664acd3f648584771c5c98802b893ab24a3cb449
SSDEEP 49152:mUASxjRK61JL0UD6XT58yJWuUsSrbNLted:wSxjRK61JAXfSPNLtW
TLSH
T19C85BE203706C43AFF8252331269D65A923DAEA10F6349CF67C87E7C69755E20B3E917
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

435212

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\DFFoundationCplusplus\Core\out\build\x86-release\bin\WsidService.pdb

wsidclient

?get@Worker@@SAAAV1@XZ ?cancelThirdLogin@Worker@@QAEXXZ ?isLogined@Worker@@QAE_NXZ ?getUserInfo@Worker@@QAE?AV?$shared_ptr@UUserInfo@@@std@@XZ ?getUserToken@Worker@@QAE?AV?$shared_ptr@UTokenInfo@@@std@@XZ ?setWsidURL@Worker@@QAEXPAD@Z ?getRemovePasswordErrorTimesURL@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@0AAV43@@Z ?mobileCaptchaLogin@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@0AAUUserInfo@@@Z ?sendMobileCaptcha@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@W4CaptchaType@@@Z ?sendEmailCaptcha@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@W4EmaiCaptchaType@@@Z ?queryCreateLimit@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@AAV?$vector@UUserCreateAuthLimitInfo@@V?$allocator@UUserCreateAuthLimitInfo@@@std@@@3@@Z ?queryLimit@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@AAV?$vector@UUserAuthLimitInfo@@V?$allocator@UUserAuthLimitInfo@@@std@@@3@@Z ?consume@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@HV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z ?regist@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@URegistInfo@@AAUUserInfo@@@Z ?checkAuth@Worker@@QAE?AW4ErrorCode@@HV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z ?thirdLogin@Worker@@QAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?getThirdList@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@W4Site@@AAV?$vector@UThirdInfo@@V?$allocator@UThirdInfo@@@std@@@3@@Z ?logout@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@XZ ?login@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@0AAUUserInfo@@@Z ?checkUserMobileexsits@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z ?checkUserEmailexsits@Worker@@QAE?AV?$shared_ptr@VWSID_Error_V3@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z ?setRegistPid@Worker@@QAEXH@Z ?init@Worker@@QAEXUProductInfo@@@Z

iphlpapi

GetAdaptersInfo

ws2_32

closesocket WSARecv shutdown WSASocketW WSASend WSAGetLastError WSASetLastError WSACleanup WSAStartup setsockopt listen htons ioctlsocket bind

kernel32

HeapFree GetCommandLineW GetCommandLineA ExitProcess SetStdHandle FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW GetFileType CloseHandle GetLastError SetEvent WaitForSingleObject CreateEventW GetStdHandle GetCurrentProcess GetCurrentProcessId TerminateProcess GetStartupInfoW LocalFree FormatMessageW ReadFile WriteFile GetCurrentDirectoryW GetLongPathNameW GetTempPathW GetSystemDirectoryW WideCharToMultiByte CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetEndOfFile GetDateFormatW Sleep MoveFileExW HeapAlloc GetEnvironmentVariableW SetEnvironmentVariableW GetSystemInfo GetVersionExW GetComputerNameW EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary GetProcAddress LoadLibraryW VerSetConditionMask SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetWaitableTimer QueueUserAPC TerminateThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleA FormatMessageA VerifyVersionInfoA MultiByteToWideChar GetModuleFileNameA GetFileAttributesA GetCurrentThreadId GetDynamicTimeZoneInformation WriteConsoleW GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute LoadLibraryExW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale OutputDebugStringW GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetTimeZoneInformation FlushFileBuffers ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap HeapSize SetThreadPriority SetFilePointer InterlockedPushEntrySList RtlUnwind GetLocaleInfoEx WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetModuleHandleW GetStringTypeW GetCPInfo InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent RaiseException

advapi32

ReportEventW RegisterEventSourceW DeregisterEventSource RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey OpenServiceW OpenSCManagerW DeleteService CreateServiceW CloseServiceHandle ChangeServiceConfigW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW

mswsock

AcceptEx GetAcceptExSockaddrs

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_b152243fc65dc5c19f9bed742e670568_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

wsidclient

iphlpapi

ws2_32

kernel32

advapi32

mswsock

generic