2026-09-08_8039ccf883ee79690f31445e673f99d2_amadey_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader

General

Target
2026-09-08_8039ccf883ee79690f31445e673f99d2_amadey_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader
Size 1.6MB
Sample260910-e7r9ksxgqe
SHA256 0ef18a88c10a83e4c35a9711a37ed5fa6d5ff79c63b639ea7b83938a54d5f25c
MD5 8039ccf883ee79690f31445e673f99d2
SHA1 742ab649c8a5b302316f884519a2781cad928b9e
SHA512 bd8b57f97e1b8c3a833381c8e77d69728c7cb4d0800983bf4278f7d33ad2ed317e421e14953f6d5f88b61a273c79261463d0581cb5036fa99aea6287bdc528c3
SSDEEP 24576:ooP5VdEsC/sqjnhMgeiCl7G0nehbGZpbD:LvdEsCjDmg27RnWGj
TLSH
T1E285022075E1C173D572053145F8EB7A992EBD314F2059EBA7D41FBE8E302C09A36A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_8039ccf883ee79690f31445e673f99d2_amadey_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader

File Explorer

2026-09-08_8039ccf883ee79690f31445e673f99d2_amadey_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader

.exe 1.6MB

2026-09-08_8039ccf883ee79690f31445e673f99d2_amadey_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader

IMPHASH 870810ea1d1d996da7743cf438651939
SHA256 0ef18a88c10a83e4c35a9711a37ed5fa6d5ff79c63b639ea7b83938a54d5f25c
MD5 8039ccf883ee79690f31445e673f99d2
SHA1 742ab649c8a5b302316f884519a2781cad928b9e
SHA512 bd8b57f97e1b8c3a833381c8e77d69728c7cb4d0800983bf4278f7d33ad2ed317e421e14953f6d5f88b61a273c79261463d0581cb5036fa99aea6287bdc528c3
SSDEEP 24576:ooP5VdEsC/sqjnhMgeiCl7G0nehbGZpbD:LvdEsCjDmg27RnWGj
TLSH
T1E285022075E1C173D572053145F8EB7A992EBD314F2059EBA7D41FBE8E302C09A36A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

26583

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AdobeIPCBrokerCustomHook.pdb

shlwapi

PathAppendW PathRemoveFileSpecW

kernel32

GetCurrentProcessId WriteConsoleW HeapSize TerminateProcess GetModuleFileNameW GetTempPathW WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW Process32FirstW CloseHandle CreateProcessW CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter SetEndOfFile GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException FreeLibrary LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP

user32

FindWindowExW PostMessageW

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_8039ccf883ee79690f31445e673f99d2_amadey_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader

shlwapi

kernel32

user32

shell32

generic