2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader
Size 1.3MB
Sample260901-243bpsyfqh
SHA256 30d0533b3841e2c0d217801a3a5f1cc08f0f2a5a360b8b8d9415ea8a59593a05
MD5 f88ba6727aa6e7692dd5dd9f02015148
SHA1 b3bd754cc7f10f1904a57c55b67a95a6f77bd819
SHA512 d1339e010f6057ce51f7e4f12c055b7caa1adb5721160485f7208d19ed8de641c7914815c53ce2411517f1f9a967dfa3b359f0fb1571f7edd296056380e9b6f5
SSDEEP 24576:1JPq5oUkIxqujKeT/Zvdp/Lrd6jBqmuN0Kebc46vVa4eZwq86QAhhUkXuMDtz6B6:1AoUkI4ujKeT/ZvTDrMjBqmu2KebcFvS
TLSH
T14155BE11739AC039E6B226B099399BA6453EBC717B76DCCB23C4796D48306E15E30B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 1.3MB

2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH 5a99d03856ee9c5125ee42feee942527
SHA256 30d0533b3841e2c0d217801a3a5f1cc08f0f2a5a360b8b8d9415ea8a59593a05
MD5 f88ba6727aa6e7692dd5dd9f02015148
SHA1 b3bd754cc7f10f1904a57c55b67a95a6f77bd819
SHA512 d1339e010f6057ce51f7e4f12c055b7caa1adb5721160485f7208d19ed8de641c7914815c53ce2411517f1f9a967dfa3b359f0fb1571f7edd296056380e9b6f5
SSDEEP 24576:1JPq5oUkIxqujKeT/Zvdp/Lrd6jBqmuN0Kebc46vVa4eZwq86QAhhUkXuMDtz6B6:1AoUkI4ujKeT/ZvTDrMjBqmu2KebcFvS
TLSH
T14155BE11739AC039E6B226B099399BA6453EBC717B76DCCB23C4796D48306E15E30B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

335443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wevtapi

EvtNext EvtClose EvtSubscribe EvtCreateRenderContext EvtRender

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

kernel32

CreateMutexW OpenEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId CreateProcessW OpenProcess GetTickCount GetTickCount64 FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW lstrcmpiW QueryFullProcessImageNameW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW LoadLibraryW ResetEvent CreateEventW LCMapStringEx GetVersionExW IsWow64Process LocalFree OpenMutexW GetProcessTimes ProcessIdToSessionId GetSystemTimeAsFileTime GetWindowsDirectoryW OpenFileMappingW MapViewOfFile UnmapViewOfFile LocaleNameToLCID SetThreadUILanguage GetThreadUILanguage WaitForMultipleObjectsEx CreateFileMappingW DebugBreak ReleaseSemaphore WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetModuleFileNameA GetModuleHandleExW WideCharToMultiByte ExpandEnvironmentStringsW FindFirstChangeNotificationW FindNextChangeNotification GetFileSizeEx GetFileTime MulDiv lstrcmpW SetEnvironmentVariableW GetFileAttributesW GetFileSize SetEndOfFile SetFilePointer WakeAllConditionVariable TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter HeapReAlloc WaitForSingleObject GetStringTypeW QueryPerformanceCounter TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SleepConditionVariableSRW EncodePointer GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA GetCommandLineW ExitProcess GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree ReleaseMutex HeapAlloc SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapDestroy RaiseException DecodePointer ReadFile FindCloseChangeNotification DeleteFileW WritePrivateProfileStringW GetPrivateProfileStringW FormatMessageW GetCurrentThreadId SetLastError GetLastError CloseHandle IsDebuggerPresent WriteFile CreateFileW OutputDebugStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetCPInfo WriteConsoleW VirtualProtect EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW

user32

GetWindowTextLengthW GetWindowTextW DrawTextW EnumWindows IsIconic MonitorFromWindow SystemParametersInfoW LoadImageW GetWindow GetDesktopWindow FillRect GetSysColorBrush GetSysColor SetCursor SetWindowTextW RedrawWindow ReleaseDC GetDlgCtrlID SetDlgItemTextW GetDlgItem IsWindow ChangeWindowMessageFilterEx GetMonitorInfoW MonitorFromPoint IsDialogMessageW GetLastActivePopup GetCursorPos SetForegroundWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu KillTimer SetTimer MsgWaitForMultipleObjectsEx CreateDialogParamW ShowWindow CallWindowProcW PostQuitMessage DefWindowProcW SendMessageW UnregisterHotKey RegisterHotKey RegisterWindowMessageW GetClassNameW EnumChildWindows GetParent GetWindowLongW MapWindowPoints GetWindowRect GetClientRect InvalidateRect GetDC SetWindowPos LoadStringW DestroyIcon LoadCursorW GetWindowThreadProcessId FindWindowW SetWindowLongW MessageBoxW MessageBoxA AllowSetForegroundWindow GetSystemMetrics EnableWindow CharNextW DestroyWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW PostMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW SetUserObjectInformationW IsWindowVisible

gdi32

SelectObject DeleteObject CreatePen CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps DeleteDC Polygon

advapi32

FreeSid RegFlushKey StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx OpenServiceW OpenSCManagerW ControlService CloseServiceHandle ChangeServiceConfigW CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupPrivilegeValueW RegCloseKey CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegDeleteValueW RegCreateKeyExW

shell32

Shell_NotifyIconW SHQueryUserNotificationState ShellExecuteW SetCurrentProcessExplicitAppUserModelID

ole32

CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoInitialize StringFromGUID2 CoUninitialize CoTaskMemAlloc CoCreateGuid IIDFromString

oleaut32

VariantClear VariantInit SysAllocString VarUI4FromStr SysFreeString VarI4FromStr VarR8FromStr VarDateFromStr VarDecFromStr VarDecCmp

comctl32

ord381 ord345

uxtheme

SetWindowTheme

winhttp

WinHttpOpen WinHttpCrackUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpConnect WinHttpSendRequest WinHttpWriteData WinHttpReadData WinHttpCloseHandle WinHttpSetStatusCallback WinHttpOpenRequest WinHttpSetOption WinHttpAddRequestHeaders WinHttpSetCredentials

Name

.text

Size

483KB

Virtual Size

483KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

588KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader

userenv

wevtapi

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

uxtheme

winhttp

generic