2026-08-14_f9413b90461d6b0a829ee45d1225b946_akira_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_f9413b90461d6b0a829ee45d1225b946_akira_amadey_elex_luca-stealer_lynx_njrat
Size 1.1MB
Sample260814-lb1dmsgq7s
SHA256 420949e1eb6b817f60d58ca2aaf2e1248e71497604ca1071f5dc63502fe3f0e8
MD5 f9413b90461d6b0a829ee45d1225b946
SHA1 00d4f98fe7e0e474cb395a02d76e6f633fa2aa19
SHA512 e2b8f6f56fec1b9c1bf6669698e703646b2ac731c45fd02b58a13432bc0870af2e6d108b95deff0a5feae746c7ae7d721e295ec9ab54d871a314cf8122fe5665
SSDEEP 24576:TwOddISYLR9Pu8hwg8kebsBNc+Gi0187KEDlH2WDAiJp:1ddISYV9PuQtebsB1Gi01xIlH2WT3
TLSH
T1D235E0E17982C032C16603310D74FA7D5ABD6CF01A62C6AB6FD87A6EDF37580DA31616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_f9413b90461d6b0a829ee45d1225b946_akira_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-08-14_f9413b90461d6b0a829ee45d1225b946_akira_amadey_elex_luca-stealer_lynx_njrat

.exe 1.1MB

2026-08-14_f9413b90461d6b0a829ee45d1225b946_akira_amadey_elex_luca-stealer_lynx_njrat

IMPHASH d9bcf6609b2cc71b820e58777223d558
SHA256 420949e1eb6b817f60d58ca2aaf2e1248e71497604ca1071f5dc63502fe3f0e8
MD5 f9413b90461d6b0a829ee45d1225b946
SHA1 00d4f98fe7e0e474cb395a02d76e6f633fa2aa19
SHA512 e2b8f6f56fec1b9c1bf6669698e703646b2ac731c45fd02b58a13432bc0870af2e6d108b95deff0a5feae746c7ae7d721e295ec9ab54d871a314cf8122fe5665
SSDEEP 24576:TwOddISYLR9Pu8hwg8kebsBNc+Gi0187KEDlH2WDAiJp:1ddISYV9PuQtebsB1Gi01xIlH2WT3
TLSH
T1D235E0E17982C032C16603310D74FA7D5ABD6CF01A62C6AB6FD87A6EDF37580DA31616
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

156889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\BOP_agent_release_2.40.3\build\bin\win32-i386-vc143-release\Switcher.pdb

crypt32

CertGetNameStringW CertFreeCertificateContext CryptQueryObject CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose

advapi32

RegGetValueW RegQueryValueExW RegOpenKeyExW OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW AdjustTokenPrivileges DuplicateTokenEx GetTokenInformation SetTokenInformation LookupPrivilegeValueW CreateProcessWithTokenW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceConfigW ConvertSidToStringSidW RegCloseKey

kernel32

LocalFree CreateDirectoryW CreateFileW GetDriveTypeW GetFileAttributesExW ReadFile SetFileAttributesW WriteFile LCMapStringW FileTimeToSystemTime DecodePointer InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject GetCurrentProcessId TerminateProcess GetProcessId OpenProcess GetVersionExW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetModuleFileNameW LocalAlloc GetProcAddress QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW MultiByteToWideChar WideCharToMultiByte SetLastError HeapAlloc HeapFree ExitProcess HeapSize GetFileType SetStdHandle GetModuleHandleExW GetCommandLineA SystemTimeToTzSpecificLocalTime FindFirstFileExW GetFullPathNameW RtlUnwind RaiseException InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TlsFree GetCurrentProcess GetLastError CloseHandle CompareStringW GetModuleHandleW GetLocaleInfoW IsValidLocale QueryPerformanceFrequency GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode ReadConsoleW HeapReAlloc GetProcessHeap IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsGetValue MoveFileExW WriteConsoleW QueryPerformanceCounter SetUnhandledExceptionFilter GetSystemTimeAsFileTime GetTimeZoneInformation GetCurrentDirectoryW FindClose FindNextFileW GetFileAttributesW RemoveDirectoryW DeleteFileW FlushFileBuffers GetFileSizeEx SetEndOfFile SetFilePointerEx FreeLibrary LoadLibraryW GetCurrentThreadId ResumeThread GetStdHandle GetCommandLineW SetHandleInformation CreatePipe SetNamedPipeHandleState CreateProcessW ReleaseSRWLockExclusive AcquireSRWLockExclusive IsDebuggerPresent CreateActCtxW ActivateActCtx DeactivateActCtx SetEnvironmentVariableW LoadLibraryExW OutputDebugStringW InitializeSRWLock TryAcquireSRWLockExclusive WaitForSingleObjectEx EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW UnhandledExceptionFilter TlsSetValue

shell32

ShellExecuteExW CommandLineToArgvW

user32

EnumThreadWindows IsWindowVisible GetWindowThreadProcessId GetWindow SetWindowTextW GetWindowTextW MessageBoxW EnumChildWindows ShowWindow GetShellWindow GetDesktopWindow

ole32

CoUninitialize CoSetProxyBlanket CoCreateInstance CoInitializeEx

oleaut32

VariantInit VariantChangeType SysFreeString SysAllocString VariantClear

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_f9413b90461d6b0a829ee45d1225b946_akira_amadey_elex_luca-stealer_lynx_njrat

crypt32

advapi32

kernel32

shell32

user32

ole32

oleaut32

wintrust

generic