2026-08-09_6cc7f770a6b3cf8bd84d4616bf1b8854_amadey_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_6cc7f770a6b3cf8bd84d4616bf1b8854_amadey_elex_luca-stealer_mespinoza_njrat
Size 1.4MB
Sample260809-t5svnavvdx
SHA256 6efadeb69f888a64ad8eb2d8743f45d10ab3bbf7c818bbe8f6b2beb1898b7e6e
MD5 6cc7f770a6b3cf8bd84d4616bf1b8854
SHA1 62921cac5aa4780df1db2ac076fa4fb32ba3e1e1
SHA512 867757e190bbdbe102dbe66bb778d8a68ca6f0aa5833e74758bc624948f6a53dcfafd72db4ab4231cbd4f302706da97b0fe8b543829e989e7c9d28098e01fe52
SSDEEP 24576:/e4v0JcFpwY9UJNLatr0zAiX90z/F0jsFB3SQkw:/RFpd9UHLaB0zj0yjoB2
TLSH
T10A65018134C082F5C852657A5D30CFAA893E65706F617ED7E3C16E7ECAA01E0837666F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_6cc7f770a6b3cf8bd84d4616bf1b8854_amadey_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-08-09_6cc7f770a6b3cf8bd84d4616bf1b8854_amadey_elex_luca-stealer_mespinoza_njrat

.exe 1.4MB

2026-08-09_6cc7f770a6b3cf8bd84d4616bf1b8854_amadey_elex_luca-stealer_mespinoza_njrat

IMPHASH 5bcd6b3dbcbf7f0d4927c3aa83073523
SHA256 6efadeb69f888a64ad8eb2d8743f45d10ab3bbf7c818bbe8f6b2beb1898b7e6e
MD5 6cc7f770a6b3cf8bd84d4616bf1b8854
SHA1 62921cac5aa4780df1db2ac076fa4fb32ba3e1e1
SHA512 867757e190bbdbe102dbe66bb778d8a68ca6f0aa5833e74758bc624948f6a53dcfafd72db4ab4231cbd4f302706da97b0fe8b543829e989e7c9d28098e01fe52
SSDEEP 24576:/e4v0JcFpwY9UJNLatr0zAiX90z/F0jsFB3SQkw:/RFpd9UHLaB0zj0yjoB2
TLSH
T10A65018134C082F5C852657A5D30CFAA893E65706F617ED7E3C16E7ECAA01E0837666F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

maintenanceservice.pdb

advapi32

AdjustTokenPrivileges ChangeServiceConfig2W ChangeServiceConfigW CloseServiceHandle ControlService CreateServiceW CreateWellKnownSid CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext DeleteService FreeSid GetSecurityDescriptorDacl InitializeSecurityDescriptor LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceObjectSecurity QueryServiceStatus QueryServiceStatusEx RegCloseKey RegEnumKeyExW RegGetValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegisterServiceCtrlHandlerW SetEntriesInAclW SetSecurityDescriptorDacl SetServiceObjectSecurity SetServiceStatus StartServiceCtrlDispatcherW

shlwapi

PathAppendW PathCanonicalizeW PathIsUNCServerShareW PathQuoteSpacesW PathRemoveFileSpecW PathStripPathW PathStripToRootW PathUnquoteSpacesW

user32

LoadStringA wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringA CertGetNameStringW CryptMsgClose CryptMsgGetParam CryptQueryObject

wintrust

WinVerifyTrust

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesW GetFileSize GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MoveFileExW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpiW

Name

.text

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_6cc7f770a6b3cf8bd84d4616bf1b8854_amadey_elex_luca-stealer_mespinoza_njrat

advapi32

shlwapi

user32

version

rpcrt4

shell32

ole32

crypt32

wintrust

kernel32

generic