2026-08-10_582003b6218f6b97b18be8f5698aef95_amadey_elex_luca-stealer_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_582003b6218f6b97b18be8f5698aef95_amadey_elex_luca-stealer_njrat_play
Size 3.7MB
Sample260810-kfw2cafa35
SHA256 bcd98c601b6781b7d46ad72fb6aab2819c15993117489424f0f91c3fe0589091
MD5 582003b6218f6b97b18be8f5698aef95
SHA1 a34bfdde72f1a98d46fa37646390bd8ee38ee563
SHA512 ea96ac23f92ac8534e463de102c7c5fc7f08c357e623d703f5d4f88c5c177e60da4ac58c6523ae58bda2ecaa3f0dd0ca80a6eafa57ef20ddb75c711a7a45a7ce
SSDEEP 49152:u9Yj4KZ++uGmIAStLTvW5fDl2BikOABJ8vGsXRtrtwkorSZ9z2nTz3NDfATJi6qY:p/IIAStLTvyR2BiXsAKDfAl4m
TLSH
T1B5066CC7ED72C267C29451B552CD97ECF85C4C688AA834B12388FBB27432E7862955CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_582003b6218f6b97b18be8f5698aef95_amadey_elex_luca-stealer_njrat_play

File Explorer

2026-08-10_582003b6218f6b97b18be8f5698aef95_amadey_elex_luca-stealer_njrat_play

.exe 3.7MB

2026-08-10_582003b6218f6b97b18be8f5698aef95_amadey_elex_luca-stealer_njrat_play

IMPHASH a09c8461557aa027874db759ffaa6512
SHA256 bcd98c601b6781b7d46ad72fb6aab2819c15993117489424f0f91c3fe0589091
MD5 582003b6218f6b97b18be8f5698aef95
SHA1 a34bfdde72f1a98d46fa37646390bd8ee38ee563
SHA512 ea96ac23f92ac8534e463de102c7c5fc7f08c357e623d703f5d4f88c5c177e60da4ac58c6523ae58bda2ecaa3f0dd0ca80a6eafa57ef20ddb75c711a7a45a7ce
SSDEEP 49152:u9Yj4KZ++uGmIAStLTvW5fDl2BikOABJ8vGsXRtrtwkorSZ9z2nTz3NDfATJi6qY:p/IIAStLTvyR2BiXsAKDfAl4m
TLSH
T1B5066CC7ED72C267C29451B552CD97ECF85C4C688AA834B12388FBB27432E7862955CF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

108211

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LockResource LoadResource FindResourceW GetTickCount LoadLibraryW GetProcAddress FreeLibrary CreateDirectoryW SetLastError GetCommandLineW FindNextFileW GetCurrentProcess GetStdHandle FindClose MultiByteToWideChar GlobalFlags GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryW CreateProcessW WideCharToMultiByte VirtualQuery SetEvent CreateThread ResetEvent GetLocalTime GetSystemTimeAsFileTime lstrcmpiW LoadLibraryExW WriteConsoleW InitializeCriticalSection GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetCommandLineA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive OutputDebugStringW SizeofResource MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc TryEnterCriticalSection GetProcessHandleCount HeapFree TerminateProcess OpenProcess GetCurrentProcessId WriteFile EnterCriticalSection LeaveCriticalSection RaiseException GetCurrentThreadId GetModuleHandleW IsDebuggerPresent CreateEventW GetModuleFileNameW FreeResource Sleep CloseHandle CreateFileW ExitProcess GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount FlushFileBuffers

user32

MessageBoxW DestroyWindow DefWindowProcW DispatchMessageW TranslateMessage GetMessageW PeekMessageW ReleaseDC GetDC CharNextW LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW LoadStringW SendMessageW GetWindowLongW MonitorFromWindow WaitForInputIdle

gdi32

CreateDIBSection SetDIBColorTable CreateCompatibleDC GetDeviceCaps DeleteDC GetObjectW DeleteObject SelectObject

advapi32

RegOpenKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW

shell32

SHGetSpecialFolderPathW ShellExecuteW

ole32

CreateStreamOnHGlobal CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc

oleaut32

VarUI4FromStr SystemTimeToVariantTime VariantTimeToSystemTime

comctl32

InitCommonControlsEx ImageList_Destroy ImageList_Create ImageList_AddMasked

ws2_32

WSACleanup

gdiplus

GdipCloneImage GdipBitmapUnlockBits GdipAlloc GdipDrawImageRectI GdipDisposeImage GdipGetImagePixelFormat GdipFree GdipGetImageHeight GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipSetCompositingMode GdipGetImageWidth GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipGetImagePaletteSize GdiplusStartup GdiplusShutdown GdipBitmapLockBits GdipCreateBitmapFromStream

Name

.text

Size

189KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_582003b6218f6b97b18be8f5698aef95_amadey_elex_luca-stealer_njrat_play

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

gdiplus

generic