2026-08-10_8b40971474d65113f7a42ee3a9a4e778_amadey_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_8b40971474d65113f7a42ee3a9a4e778_amadey_elex_luca-stealer_lynx_medusalocker_njrat
Size 1.1MB
Sample260810-13f7eaan9w
SHA256 cd3c90360a33c7e39d312a353aff9c92f9eb0e4ec6e4184c1f0f4fbad3a3fcef
MD5 8b40971474d65113f7a42ee3a9a4e778
SHA1 0683bdf594bf831f29ee6f111fedafa9efe3401e
SHA512 ad25485e5dbd11fe8b48295bc6e25a5befc55e7ddc3e5eacc8a0f6a73df10b88a765f778f787dc4a1706f74958a90bf99c6b014b0b13ea8ca3a83390aa6dae1d
SSDEEP 24576:3abFbuz5AZKGkZcv2cc6qUkNWg7Zn8BEKpEY9Z/Gq8wWSB:3aJZKGkd6kNWZBf9Z/x8wWSB
TLSH
T165454B31FDC1C036D6A2933199ECE2F505BD6C621832C67B1B88373D2E70EA195566EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-10_8b40971474d65113f7a42ee3a9a4e778_amadey_elex_luca-stealer_lynx_medusalocker_njrat

.exe 1.1MB

2026-08-10_8b40971474d65113f7a42ee3a9a4e778_amadey_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH bbfc9d89c6e312ebf0fedcce30d9be7c
SHA256 cd3c90360a33c7e39d312a353aff9c92f9eb0e4ec6e4184c1f0f4fbad3a3fcef
MD5 8b40971474d65113f7a42ee3a9a4e778
SHA1 0683bdf594bf831f29ee6f111fedafa9efe3401e
SHA512 ad25485e5dbd11fe8b48295bc6e25a5befc55e7ddc3e5eacc8a0f6a73df10b88a765f778f787dc4a1706f74958a90bf99c6b014b0b13ea8ca3a83390aa6dae1d
SSDEEP 24576:3abFbuz5AZKGkZcv2cc6qUkNWg7Zn8BEKpEY9Z/Gq8wWSB:3aJZKGkd6kNWZBf9Z/x8wWSB
TLSH
T165454B31FDC1C036D6A2933199ECE2F505BD6C621832C67B1B88373D2E70EA195566EE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

97:34:bf:23:d4:1e:de:bc:bf:49:a1:fe:28:53:89:98:ca:f5:53:bc:73:88:49:07:00:eb:e0:bd:f3:3d:32:07

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91110106MA0065EG39,CN=Beijing Feishu Technology Co.\,Ltd.,O=Beijing Feishu Technology Co.\,Ltd.,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b5b7e6b780e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 10, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:2e:79:e0:e7:f4:0d:32:e9:54:fd:11:2e:df:a3:d4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 17, 2023 - Oct 17, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

264135

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\ws\image_pkh_vxqpo_mbjh\6524\desktop\packages\builder\apollo-setup\Windows\Packet\Build\UnicodeRelease\LarkLauncher\LarkLauncher.pdb

kernel32

LoadLibraryExA VirtualQuery GetSystemInfo MoveFileExW MoveFileW FormatMessageW LocalFree LoadLibraryW GetProcAddress OpenProcess CreateProcessW GetExitCodeProcess GetCurrentProcess GetProcessTimes Sleep CreateEventW WaitForSingleObject SetEvent GetLastError WriteConsoleW SetEndOfFile HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID CloseHandle FindNextFileW FindFirstFileW FindClose IsValidLocale GetTimeFormatW GetDateFormatW HeapFree ExitProcess GetModuleHandleExW VerSetConditionMask GetStdHandle GetEnvironmentVariableW ExpandEnvironmentStringsW GetCurrentDirectoryW CreateFileW DeleteFileW FlushFileBuffers GetDiskFreeSpaceExW GetFileAttributesW GetFinalPathNameByHandleW GetLogicalDriveStringsW QueryDosDeviceW RemoveDirectoryW SetFileAttributesW WriteFile DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcessId TerminateProcess GetCurrentThreadId GetVersionExW GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW lstrlenW QueryFullProcessImageNameW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte AllocConsole K32EnumProcessModules K32GetModuleFileNameExW K32GetProcessImageFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW WaitForMultipleObjects CopyFileW SetDllDirectoryW GetUserDefaultUILanguage HeapAlloc GetProcessHeap LocalFileTimeToFileTime ReadFile SetFilePointer SetFileTime SystemTimeToFileTime GetStringTypeW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection EncodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx RtlUnwind SetStdHandle GetFileType GetTimeZoneInformation ExitThread ResumeThread RtlCaptureStackBackTrace

user32

GetWindowThreadProcessId GetSystemMetrics MessageBoxW UnregisterClassW GetShellWindow wsprintfW

advapi32

RegDeleteKeyExW RegSetValueExW RegQueryValueExW OpenProcessToken AllocateAndInitializeSid CheckTokenMembership EqualSid FreeSid GetTokenInformation RegCloseKey GetUserNameW RegOpenKeyExW AdjustTokenPrivileges LookupPrivilegeValueW DuplicateTokenEx

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHCreateDirectoryExW ShellExecuteW SHChangeNotify

ws2_32

getsockopt socket WSAStartup WSAGetLastError closesocket

shlwapi

PathIsRelativeW PathIsNetworkPathW SHGetValueW SHDeleteValueW SHDeleteKeyW PathFindFileNameW PathIsDirectoryW PathFindExtensionW SHSetValueW StrStrIW PathFileExistsW

wintrust

CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContext CryptCATAdminCalcHashFromFileHandle WTHelperProvDataFromStateData CryptCATAdminAcquireContext CryptCATAdminReleaseContext WinVerifyTrust

crypt32

CryptDecodeObjectEx CryptStringToBinaryA CertGetNameStringW

bcrypt

BCryptImportKeyPair BCryptEncrypt BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoInitialize CoInitializeSecurity CoUninitialize

oleaut32

SysFreeString VariantInit VariantClear CreateErrorInfo GetErrorInfo VariantChangeType SetErrorInfo SysAllocString

_cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_8b40971474d65113f7a42ee3a9a4e778_amadey_elex_luca-stealer_lynx_medusalocker_njrat

kernel32

user32

advapi32

shell32

ws2_32

shlwapi

wintrust

crypt32

bcrypt

ole32

oleaut32

generic