2026-08-20_1d20cd927b63806db79517ac716a404d_amadey_elex_luca-stealer_lynx_njrat_redline-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_1d20cd927b63806db79517ac716a404d_amadey_elex_luca-stealer_lynx_njrat_redline-stealer
Size 1.5MB
Sample260820-tcsdesec97
SHA256 af0e22a4d2f6eef19d6994269e1768448e7d125ddf369a4acb644be6a7ab1ea3
MD5 1d20cd927b63806db79517ac716a404d
SHA1 d728b1ae1c387bbe9ce62c8df3753d411759685c
SHA512 375c275ebd56f5849a02748af04beab1d0e0448de4d06c48b22d141c7a2dffc6eb889c116baf982e95e0b364a21a4a793a80c4412da9d9e54b3a26c139174bee
SSDEEP 24576:8kbyxCFMZoxgbnQ/tbw/2Mkjy6Fr7g0oE:8keCFMCx8Q/lFTjN4
TLSH
T1F67502107591E033F87304334E798A699A3DAD511B51A6EBE3C85A3ECF382D1BE3175A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_1d20cd927b63806db79517ac716a404d_amadey_elex_luca-stealer_lynx_njrat_redline-stealer

File Explorer

2026-08-20_1d20cd927b63806db79517ac716a404d_amadey_elex_luca-stealer_lynx_njrat_redline-stealer

.exe 1.5MB

2026-08-20_1d20cd927b63806db79517ac716a404d_amadey_elex_luca-stealer_lynx_njrat_redline-stealer

IMPHASH 2b79aec40b00432dc21da2ef28a8f018
SHA256 af0e22a4d2f6eef19d6994269e1768448e7d125ddf369a4acb644be6a7ab1ea3
MD5 1d20cd927b63806db79517ac716a404d
SHA1 d728b1ae1c387bbe9ce62c8df3753d411759685c
SHA512 375c275ebd56f5849a02748af04beab1d0e0448de4d06c48b22d141c7a2dffc6eb889c116baf982e95e0b364a21a4a793a80c4412da9d9e54b3a26c139174bee
SSDEEP 24576:8kbyxCFMZoxgbnQ/tbw/2Mkjy6Fr7g0oE:8keCFMCx8Q/lFTjN4
TLSH
T1F67502107591E033F87304334E798A699A3DAD511B51A6EBE3C85A3ECF382D1BE3175A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\pc\i4tools80\trunk\libsrc\openNcmInterface\openNcmIf\lib\openhiddenncm_release_mt_Win32.pdb

setupapi

SetupDiRestartDevices SetupDiGetDeviceInstanceIdA SetupDiEnumDeviceInterfaces SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceInstallParamsW SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW CM_Get_Parent SetupDiSetDevicePropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo CM_Get_Device_IDW CM_Get_DevNode_Registry_PropertyW CM_Locate_DevNodeW

kernel32

GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW SetFilePointerEx Wow64DisableWow64FsRedirection DeviceIoControl CreateFileW GetSystemDirectoryW Sleep Wow64RevertWow64FsRedirection FreeEnvironmentStringsW CloseHandle VerSetConditionMask CopyFileW VerifyVersionInfoW GetModuleFileNameW MultiByteToWideChar GetProcAddress GetModuleHandleW WideCharToMultiByte CreateFileA GetOverlappedResult CreateEventA FormatMessageA GetFileSizeEx SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize GetLastError UnhandledExceptionFilter ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WriteConsoleW SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc

advapi32

CloseServiceHandle OpenSCManagerW ChangeServiceConfigW OpenServiceW CreateServiceW

shell32

ShellExecuteW

shlwapi

PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_1d20cd927b63806db79517ac716a404d_amadey_elex_luca-stealer_lynx_njrat_redline-stealer

setupapi

kernel32

advapi32

shell32

shlwapi

generic