2026-08-09_267a4f5b182c25d921de95626ecfbb89_amadey_elex_luca-stealer_njrat_smoke-loader_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_267a4f5b182c25d921de95626ecfbb89_amadey_elex_luca-stealer_njrat_smoke-loader_virut
Size 1.1MB
Sample260809-vmbzvssdlb
SHA256 0dcfc4b3918ef2eb5872ec620c82fbb6ba3c33016117d5377494296b7d647116
MD5 267a4f5b182c25d921de95626ecfbb89
SHA1 aed5fdaff3954813dee836b85e64f1b46df8af3e
SHA512 3395e5ce5babeeb1bb855937fc0129e97791eeb42390e54deb3a2ee812987a564a980c85566cdbdc912b418ea305dae00d75fadccf0aa6447cfd26c3fac2adfe
SSDEEP 24576:3Kwt34Vvci4oWxA2EHfV/0IY7TvJTIALwRp:3Kv/10T7ThTIYwRp
TLSH
T1D7357C217585C032D5610172AA7DDB79813DBF714F72AACBA3D43EAD0AB85C11B32E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_267a4f5b182c25d921de95626ecfbb89_amadey_elex_luca-stealer_njrat_smoke-loader_virut

File Explorer

2026-08-09_267a4f5b182c25d921de95626ecfbb89_amadey_elex_luca-stealer_njrat_smoke-loader_virut

.exe 1.1MB

2026-08-09_267a4f5b182c25d921de95626ecfbb89_amadey_elex_luca-stealer_njrat_smoke-loader_virut

IMPHASH 72264e8f5f03176a3e5c72486e1f3bb1
SHA256 0dcfc4b3918ef2eb5872ec620c82fbb6ba3c33016117d5377494296b7d647116
MD5 267a4f5b182c25d921de95626ecfbb89
SHA1 aed5fdaff3954813dee836b85e64f1b46df8af3e
SHA512 3395e5ce5babeeb1bb855937fc0129e97791eeb42390e54deb3a2ee812987a564a980c85566cdbdc912b418ea305dae00d75fadccf0aa6447cfd26c3fac2adfe
SSDEEP 24576:3Kwt34Vvci4oWxA2EHfV/0IY7TvJTIALwRp:3Kv/10T7ThTIYwRp
TLSH
T1D7357C217585C032D5610172AA7DDB79813DBF714F72AACBA3D43EAD0AB85C11B32E1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

51:c6:2f:29:90:65:e4:f0:35:06:3d:01:be:5c:ff:9d:79:85:88:e7:65:44:7d:c1:f0:e7:80:38:dd:fb:3c:5b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91510100MA7EUJ0408,CN=Chengdu Aishang Office Technology Co.\, Ltd.,O=Chengdu Aishang Office Technology Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#131b5369636875616e205469616e6675204e6577204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Apr 10, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0b:41:cc:5a:c5:d7:73:88:cd:8d:35:d1:46:0a:c3:b2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2025 - Jul 29, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1132040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\work\video_clip\develop\ImageShow\Output\Bin\Release\Win32\PicRunTime.pdb

kernel32

SetThreadLocale OpenProcess SetFileAttributesW MoveFileExW ResetEvent SetEvent PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateEventW CreateIoCompletionPort GetQueuedCompletionStatus GetLocalTime VirtualAlloc SetUnhandledExceptionFilter IsBadReadPtr VirtualProtect ExitProcess GetCurrentProcessId InitializeCriticalSection K32EnumProcessModules lstrcmpA GetSystemTimeAsFileTime CreateFileMappingW MapViewOfFile UnmapViewOfFile OpenEventW OpenFileMappingW DeviceIoControl SetEndOfFile GetFileSizeEx RemoveDirectoryW GetLongPathNameW InitializeCriticalSectionAndSpinCount SetErrorMode CreateThread FlushFileBuffers WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx GetTimeZoneInformation ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind UnhandledExceptionFilter WakeAllConditionVariable GetCPInfo GetTickCount GetNativeSystemInfo LocalFileTimeToFileTime Process32NextW GlobalFree GlobalAlloc GetSystemInfo lstrlenA SystemTimeToTzSpecificLocalTime Sleep FindClose FindNextFileW FindFirstFileW lstrlenW GetFileAttributesExW GetVersionExW WaitForSingleObject VerifyVersionInfoW VerSetConditionMask GetFileSize DeleteFileW SetProcessShutdownParameters WriteFile SetFilePointer CreateFileW TerminateProcess GetCommandLineW LoadLibraryExW lstrcmpiW GetSystemTime FreeLibrary LoadLibraryW MultiByteToWideChar GetCurrentProcess GetPrivateProfileStringW GetStartupInfoW WritePrivateProfileStringW GetPrivateProfileIntW OutputDebugStringW OutputDebugStringA SetLastError RaiseException GetCurrentThreadId LeaveCriticalSection EnterCriticalSection GetModuleFileNameW SystemTimeToFileTime LocalFree GetWindowsDirectoryW FileTimeToSystemTime WideCharToMultiByte GetModuleHandleW CreateProcessW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW CloseHandle HeapReAlloc LockResource GetLastError HeapSize InitializeCriticalSectionEx LCMapStringEx GetStringTypeW SleepConditionVariableSRW QueryPerformanceFrequency QueryPerformanceCounter TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA VirtualFree IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent GetThreadLocale Process32FirstW CreateToolhelp32Snapshot CreatePipe HeapFree SizeofResource ReadFile GetConsoleOutputCP

user32

CharNextW GetMessageW DispatchMessageW PeekMessageW ShowWindow PostQuitMessage TranslateMessage KillTimer SetTimer SendMessageW PostMessageW CallWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW DestroyWindow IsWindow DefWindowProcW CharLowerBuffW UnregisterClassW wsprintfW MessageBoxW

advapi32

RegOpenKeyExW InitializeSecurityDescriptor RegSetValueExW RegSetKeySecurity RegCreateKeyExW RegEnumKeyW GetUserNameW CloseServiceHandle CreateServiceW OpenSCManagerW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW ConvertSidToStringSidW LookupAccountNameW SetSecurityDescriptorDacl RegCloseKey RegDeleteKeyW RegQueryValueExW

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetMalloc SHChangeNotify SHGetFolderPathW ord165 ShellExecuteW ShellExecuteExW SHCreateDirectoryExW SHGetSpecialFolderPathW

ole32

CoInitializeSecurity OleRun CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoUninitialize CoTaskMemFree CoInitialize

oleaut32

GetErrorInfo SysFreeString SysStringLen LoadTypeLi SysAllocString VariantInit VariantClear VariantCopy VarUI4FromStr LoadRegTypeLi

shlwapi

PathSearchAndQualifyW AssocQueryStringW StrStrIW PathIsDirectoryW PathCombineW PathRemoveExtensionW PathFindFileNameW PathCanonicalizeW PathRemoveBackslashW PathIsPrefixW PathRemoveFileSpecW PathFileExistsW PathAppendW StrCmpIW SHGetValueW SHDeleteValueW

secur32

GetUserNameExW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

InternetReadFile HttpQueryInfoW InternetCrackUrlW InternetOpenW InternetCloseHandle InternetConnectW HttpOpenRequestW HttpSendRequestW InternetSetOptionW

crypt32

CryptBinaryToStringW CryptStringToBinaryW

netapi32

Netbios

iphlpapi

GetIpAddrTable GetAdaptersInfo

Name

.text

Size

616KB

Virtual Size

615KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

185KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_267a4f5b182c25d921de95626ecfbb89_amadey_elex_luca-stealer_njrat_smoke-loader_virut

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

secur32

version

wininet

crypt32

netapi32

iphlpapi

generic