2026-08-14_06e89a3d3c2553915b3d87d898fa1b8d_amadey_elex_floxif_luca-stealer_magniber_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_06e89a3d3c2553915b3d87d898fa1b8d_amadey_elex_floxif_luca-stealer_magniber_njrat_smoke-loader
Size 1.5MB
Sample260815-aschcswaph
SHA256 b9c2e9b9c4d3fe5a963f89845d42a0fc242ce069b7ac465df27674af9b89acf9
MD5 06e89a3d3c2553915b3d87d898fa1b8d
SHA1 558c9b71e784521ed08ab85792494fc2d9619224
SHA512 de439f22c73064e5813e98ee224e4b30fd61cd8e4496356d39f6d9ab96cb4d36b67f45690772a5b9af0f6162c741794476cdbfe6eddff98c06e15750144fcb77
SSDEEP 24576:ES85T46ep1AIkJs9FQGaGDAympW88D248xauBl50ZZweZ1TfyigK/srEH76:ESGUfAhornDAyilxFBl50LZpfyM/m
TLSH
T1CF756B01A7618139F8F715F59AFE10AC993CBDA01B2990D752C47EEE9B35AE03C3161B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_06e89a3d3c2553915b3d87d898fa1b8d_amadey_elex_floxif_luca-stealer_magniber_njrat_smoke-loader

File Explorer

2026-08-14_06e89a3d3c2553915b3d87d898fa1b8d_amadey_elex_floxif_luca-stealer_magniber_njrat_smoke-loader

.exe 1.5MB

2026-08-14_06e89a3d3c2553915b3d87d898fa1b8d_amadey_elex_floxif_luca-stealer_magniber_njrat_smoke-loader

IMPHASH 67ee83b80fe4b05a9b7a277ef11d2415
SHA256 b9c2e9b9c4d3fe5a963f89845d42a0fc242ce069b7ac465df27674af9b89acf9
MD5 06e89a3d3c2553915b3d87d898fa1b8d
SHA1 558c9b71e784521ed08ab85792494fc2d9619224
SHA512 de439f22c73064e5813e98ee224e4b30fd61cd8e4496356d39f6d9ab96cb4d36b67f45690772a5b9af0f6162c741794476cdbfe6eddff98c06e15750144fcb77
SSDEEP 24576:ES85T46ep1AIkJs9FQGaGDAympW88D248xauBl50ZZweZ1TfyigK/srEH76:ESGUfAhornDAyilxFBl50LZpfyM/m
TLSH
T1CF756B01A7618139F8F715F59AFE10AC993CBDA01B2990D752C47EEE9B35AE03C3161B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

401040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\IDA_Pro_v7.5_Portable\plugins\InjectorCLIx86.pdb

ntdll

RtlUnwind NtQuerySystemInformation RtlGetVersion RtlEqualString RtlInitAnsiString LdrFindResource_U LdrAccessResource RtlImageNtHeader RtlFreeHeap RtlAllocateHeap NtOpenThread NtClose NtResumeThread NtSuspendThread NtSetInformationThread NtQueryInformationProcess

kernel32

GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode CreateFileW GetFileSize ReadFile CloseHandle WaitForSingleObject GetCurrentProcess GetCurrentProcessId CreateRemoteThread SetThreadPriority GetExitCodeThread ResumeThread OpenProcess VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx FreeLibrary GetModuleHandleA GetOEMCP GetProcAddress LoadLibraryW ReadProcessMemory VirtualAlloc VirtualFree LoadLibraryA CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualProtect LoadLibraryExW GetNativeSystemInfo IsWow64Process WriteFile GetFileAttributesW GetModuleFileNameW LocalFree FormatMessageW lstrlenW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionNamesW GetConsoleCP FlushFileBuffers HeapQueryInformation HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID FreeEnvironmentStringsW GetEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetModuleHandleW InitializeConditionVariable IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetFileInformationByHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitOnceExecuteOnce SetEndOfFile WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetFileInformationByHandleEx CreateSymbolicLinkW EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException GetStartupInfoW InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery InterlockedPushEntrySList InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW HeapValidate GetSystemInfo ExitProcess GetStdHandle GetCommandLineA GetCommandLineW GetCurrentThread GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler GetDateFormatW GetTimeFormatW

user32

MessageBoxW GetWindowTextLengthW GetWindowTextW GetDlgItem MessageBoxA

comdlg32

GetOpenFileNameW

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

psapi

GetModuleFileNameExW EnumProcessModules

Name

.text

Size

1013KB

Virtual Size

1013KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1024B

Virtual Size

738B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_06e89a3d3c2553915b3d87d898fa1b8d_amadey_elex_floxif_luca-stealer_magniber_njrat_smoke-loader

ntdll

kernel32

user32

comdlg32

advapi32

psapi

generic