2026-08-16_b85d334e041ad58a14d7dc571572361a_amadey_elex_luca-stealer_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_b85d334e041ad58a14d7dc571572361a_amadey_elex_luca-stealer_njrat_play
Size 7.3MB
Sample260816-edmr1aba82
SHA256 d8c9a0955567581f84fda2f60c1c4853bc72d69aa35d0b0887cc74345b4a8f69
MD5 b85d334e041ad58a14d7dc571572361a
SHA1 c917950e77d7ca6ac6a89c616ca50e1f5e60ee69
SHA512 7fb9d1673a772a329374dd53cf7c7ae0362b5d15d4dcc29f9b9bb3584442d32ff2e20e4e3a055edf203c50075be23b857b736b3744d6c26b15032af330742d9d
SSDEEP 98304:Au5lpCvd3lqce9Ldkdl2Yec9gSCTrcU7fzmjhrTeMF79nOlwzEeeHdAKmzhfBjM1:AYaTCHc+MN/EeeHdAKmzhfBjMsAJ3
TLSH
T19276BEF0395AF2DFC05E06749096CE13F96E17B147218923EC6D78BEAF93C91128AE54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_b85d334e041ad58a14d7dc571572361a_amadey_elex_luca-stealer_njrat_play

File Explorer

2026-08-16_b85d334e041ad58a14d7dc571572361a_amadey_elex_luca-stealer_njrat_play

.exe 7.3MB

2026-08-16_b85d334e041ad58a14d7dc571572361a_amadey_elex_luca-stealer_njrat_play

SHA256 d8c9a0955567581f84fda2f60c1c4853bc72d69aa35d0b0887cc74345b4a8f69
MD5 b85d334e041ad58a14d7dc571572361a
SHA1 c917950e77d7ca6ac6a89c616ca50e1f5e60ee69
SHA512 7fb9d1673a772a329374dd53cf7c7ae0362b5d15d4dcc29f9b9bb3584442d32ff2e20e4e3a055edf203c50075be23b857b736b3744d6c26b15032af330742d9d
SSDEEP 98304:Au5lpCvd3lqce9Ldkdl2Yec9gSCTrcU7fzmjhrTeMF79nOlwzEeeHdAKmzhfBjM1:AYaTCHc+MN/EeeHdAKmzhfBjMsAJ3
TLSH
T19276BEF0395AF2DFC05E06749096CE13F96E17B147218923EC6D78BEAF93C91128AE54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables packed with Themida
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4989016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

54KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

138KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

10KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_b85d334e041ad58a14d7dc571572361a_amadey_elex_luca-stealer_njrat_play

generic