2026-08-15_ff4fccd1fb831704a2ca3bc7d20cdcac_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_ff4fccd1fb831704a2ca3bc7d20cdcac_amadey_elex_luca-stealer_lynx_njrat
Size 1.7MB
Sample260815-dhbpvsde47
SHA256 902586a6074b20108edb9a193a9077d1c7a763b75dd81d0c35b3994f9fb34764
MD5 ff4fccd1fb831704a2ca3bc7d20cdcac
SHA1 dc933c543280899420bd9bcdf425d411d5db9de6
SHA512 28f9b26b20229f09fa093b3b6965ee5e9197190962a93ec76adef9c72c6b2d0671ed34e630dd2acb4a0b87a311877844b0079a90c89cd68e2ba8c47dff3a6c20
SSDEEP 24576:2G7CBjpu3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2Gy2LNiXicJFFRGNzj3
TLSH
T15B85E060F8808131DEEA20B946ECBB25145DF8A0472596D352C81FFFD6347D1AE366FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_ff4fccd1fb831704a2ca3bc7d20cdcac_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-08-15_ff4fccd1fb831704a2ca3bc7d20cdcac_amadey_elex_luca-stealer_lynx_njrat

.exe 1.7MB

2026-08-15_ff4fccd1fb831704a2ca3bc7d20cdcac_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 2b2a73a8f023de4b0d5ba2db7b0914f0
SHA256 902586a6074b20108edb9a193a9077d1c7a763b75dd81d0c35b3994f9fb34764
MD5 ff4fccd1fb831704a2ca3bc7d20cdcac
SHA1 dc933c543280899420bd9bcdf425d411d5db9de6
SHA512 28f9b26b20229f09fa093b3b6965ee5e9197190962a93ec76adef9c72c6b2d0671ed34e630dd2acb4a0b87a311877844b0079a90c89cd68e2ba8c47dff3a6c20
SSDEEP 24576:2G7CBjpu3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2Gy2LNiXicJFFRGNzj3
TLSH
T15B85E060F8808131DEEA20B946ECBB25145DF8A0472596D352C81FFFD6347D1AE366FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\buildagent-cd_8811\p4\993441124\services\AMTSW\MEWMIProv\WMIRegistrationService\Release\WMIRegistrationService.pdb

kernel32

QueueUserWorkItem GetModuleFileNameW GetExitCodeProcess RegisterWaitForSingleObject UnregisterWait CreateFileW CreateEventW WaitForSingleObject SetEvent GetLastError CloseHandle SetDefaultDllDirectories OutputDebugStringW DecodePointer ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetProcessHeap SetConsoleCtrlHandler GetFileSizeEx WriteConsoleW

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherW

shell32

ShellExecuteExW SHGetKnownFolderPath

ole32

CoTaskMemFree

shlwapi

PathFileExistsW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

Name

.text

Size

423KB

Virtual Size

422KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_ff4fccd1fb831704a2ca3bc7d20cdcac_amadey_elex_luca-stealer_lynx_njrat

kernel32

advapi32

shell32

ole32

shlwapi

api-ms-win-core-path-l1-1-0

generic