2026-08-09_4ddbac6f848e2083e7193a9fce8e7d1a_amadey_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_4ddbac6f848e2083e7193a9fce8e7d1a_amadey_elex_luca-stealer_mespinoza_njrat
Size 1.7MB
Sample260809-hm8bvasfpe
SHA256 428c1b79ee9c32edc693956d0debc83c27ce8c471f16461c4db1203e6b444507
MD5 4ddbac6f848e2083e7193a9fce8e7d1a
SHA1 bfc149d3a0498941ce42437b826176c8d669c758
SHA512 13435a280e10e3fc631a45bda043b607c3d4e74791f9eb8d9f6328f80530b7081d0bb4478657089cdfe15549b528edb1ec0f1939507c94aff04b45adbdd58328
SSDEEP 49152:05+oKOhnEr+Qu/L1jy4Jul1Z0WCg/kKIo7T/GN71:c+4h5Q6L1j5Jul1ZmM7T+N71
TLSH
T1F785D002F551D0B6C8526231645DE33C7A299E4A4F664DC7C7E8FCF82A705C21E36ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_4ddbac6f848e2083e7193a9fce8e7d1a_amadey_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-08-09_4ddbac6f848e2083e7193a9fce8e7d1a_amadey_elex_luca-stealer_mespinoza_njrat

.exe 1.7MB

2026-08-09_4ddbac6f848e2083e7193a9fce8e7d1a_amadey_elex_luca-stealer_mespinoza_njrat

IMPHASH e1ca66aa95630641de7ed55ec6886368
SHA256 428c1b79ee9c32edc693956d0debc83c27ce8c471f16461c4db1203e6b444507
MD5 4ddbac6f848e2083e7193a9fce8e7d1a
SHA1 bfc149d3a0498941ce42437b826176c8d669c758
SHA512 13435a280e10e3fc631a45bda043b607c3d4e74791f9eb8d9f6328f80530b7081d0bb4478657089cdfe15549b528edb1ec0f1939507c94aff04b45adbdd58328
SSDEEP 49152:05+oKOhnEr+Qu/L1jy4Jul1Z0WCg/kKIo7T/GN71:c+4h5Q6L1j5Jul1ZmM7T+N71
TLSH
T1F785D002F551D0B6C8526231645DE33C7A299E4A4F664DC7C7E8FCF82A705C21E36ABE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

682832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

app_shell_launcher.exe.pdb

advapi32

CreateProcessAsUserW DuplicateToken GetTokenInformation OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath SetCurrentProcessExplicitAppUserModelID ShellExecuteA ShellExecuteExW

user32

AllowSetForegroundWindow CallNextHookEx FindWindowExW FindWindowW GetActiveWindow GetDesktopWindow GetDlgItem GetWindow GetWindowRect GetWindowTextLengthW GetWindowTextW LoadStringW MessageBoxW ScreenToClient SetDlgItemTextW SetWindowPos SetWindowsHookExW UnhookWindowsHookEx UnregisterClassW

winmm

timeGetTime

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileW CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DosDateTimeToFileTime DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeResource GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLocaleName GetVersionExW GetWindowsDirectoryW HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CLSIDFromString CoCreateInstance CoInitialize CoSetProxyBlanket CoTaskMemFree CoUninitialize IIDFromString

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathMatchSpecW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

Name

.text

Size

827KB

Virtual Size

827KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

174B

Characteristics

Name

.rsrc

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

621KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_4ddbac6f848e2083e7193a9fce8e7d1a_amadey_elex_luca-stealer_mespinoza_njrat

advapi32

shell32

user32

winmm

kernel32

ole32

winhttp

userenv

shlwapi

oleaut32

netapi32

iphlpapi

generic