2026-08-20_69d197d75c5bc80f5771db95a862aebd_amadey_elex_luca-stealer_lynx_njrat

General

Target
2026-08-20_69d197d75c5bc80f5771db95a862aebd_amadey_elex_luca-stealer_lynx_njrat
Size 1.5MB
Sample260820-pr49bacl7s
SHA256 573aa1f840d2d9e8e805c46baa9b81d3813d0fe50adc341b79fead8868b44cfb
MD5 69d197d75c5bc80f5771db95a862aebd
SHA1 b190205f1a250685609bfe35fd77c35ada0d6a90
SHA512 58dbdfb88e8ed9bd55d85e1da2f5d783e4332dbc1fb080fc74072865e8707d4df0909fe47e88876608f047d6ed04326ba40b803fd2cae715a4c1649754868292
SSDEEP 12288:TUUpT2HO/hLxwGrfewmmqV52K8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:hpTAO/hL3fLqB8LwsXYHU9MPxMu
TLSH
T11C650221B6918432D96221329C94DB76993DBC284FA159DBF3841F7ECD301E29E31F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_69d197d75c5bc80f5771db95a862aebd_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-08-20_69d197d75c5bc80f5771db95a862aebd_amadey_elex_luca-stealer_lynx_njrat

.exe 1.5MB

2026-08-20_69d197d75c5bc80f5771db95a862aebd_amadey_elex_luca-stealer_lynx_njrat

IMPHASH e8288d19aa9c564e8f16f3a52bc88d54
SHA256 573aa1f840d2d9e8e805c46baa9b81d3813d0fe50adc341b79fead8868b44cfb
MD5 69d197d75c5bc80f5771db95a862aebd
SHA1 b190205f1a250685609bfe35fd77c35ada0d6a90
SHA512 58dbdfb88e8ed9bd55d85e1da2f5d783e4332dbc1fb080fc74072865e8707d4df0909fe47e88876608f047d6ed04326ba40b803fd2cae715a4c1649754868292
SSDEEP 12288:TUUpT2HO/hLxwGrfewmmqV52K8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:hpTAO/hL3fLqB8LwsXYHU9MPxMu
TLSH
T11C650221B6918432D96221329C94DB76993DBC284FA159DBF3841F7ECD301E29E31F6E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

97280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\vscodium\vscodium\vscode\node_modules\node-pty\build\Release\winpty-agent.pdb

kernel32

GetConsoleCP LoadLibraryW GetProcAddress FreeLibrary SetConsoleMode GetConsoleMode GetTickCount GenerateConsoleCtrlEvent ReadConsoleInputW WaitForMultipleObjects Sleep ReadFile CancelIo WriteFile CreateNamedPipeW CreateFileW CreateEventW ResetEvent GetOverlappedResult ConnectNamedPipe GetConsoleCursorInfo GetConsoleTitleW GetConsoleWindow SetConsoleTitleW GetConsoleScreenBufferInfo GetConsoleOutputCP SetConsoleScreenBufferSize SetConsoleWindowInfo CreateConsoleScreenBuffer FillConsoleOutputCharacterW ReadConsoleOutputW FillConsoleOutputAttribute SetConsoleCursorPosition WriteConsoleOutputW GetCommandLineW GetCurrentThreadId GetModuleFileNameA SetNamedPipeHandleState SetLastError GetEnvironmentVariableA GetCurrentProcessId TransactNamedPipe GetSystemTimeAsFileTime WaitNamedPipeW WideCharToMultiByte LocalAlloc GetCurrentThread LocalFree GetVersionExW GetSystemDirectoryW WriteConsoleW CreateProcessW WriteConsoleInputW CloseHandle GetConsoleProcessList GetLargestConsoleWindowSize GetLastError DuplicateHandle WaitForSingleObject GetStdHandle GetCurrentProcess SetConsoleCtrlHandler SetConsoleTextAttribute GetModuleHandleW DecodePointer HeapReAlloc HeapSize GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind RaiseException EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCommandLineA HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW FlushFileBuffers GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW

advapi32

SetSecurityDescriptorDacl AllocateAndInitializeSid SetEntriesInAclW OpenProcessToken FreeSid InitializeSecurityDescriptor OpenThreadToken GetTokenInformation CryptAcquireContextW CryptGenRandom CryptReleaseContext

shell32

CommandLineToArgvW

user32

CloseDesktop CreateDesktopW SetProcessWindowStation GetUserObjectInformationW PostMessageW CreateWindowStationW MapVirtualKeyW SendMessageW VkKeyScanW GetDoubleClickTime CloseWindowStation GetProcessWindowStation

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_69d197d75c5bc80f5771db95a862aebd_amadey_elex_luca-stealer_lynx_njrat

kernel32

advapi32

shell32

user32

generic