2026-09-08_930f563cc7a858ce3e92454526f2b0f0_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_930f563cc7a858ce3e92454526f2b0f0_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader
Size 1.4MB
Sample260910-enakesfk8x
SHA256 9c9206610e116044abb6101171271216ca7e85a80862a3dbb6276ebf459ffa83
MD5 930f563cc7a858ce3e92454526f2b0f0
SHA1 a1dcdf76d27456900dfdb5b73e03db3c2499957b
SHA512 969198568ee8871d50a07288754a2e2d3968b1226acaba0353a6c8b0726f09975da66597f49931a3d8d91d9c7944a356034f045a070f082ed56bb6114e4fd958
SSDEEP 24576:B/Y1RtGiSq2a0eiMvD36Y8rT4V6nOP/tQp7Pgyxknw4FYnshx8OfVe247:u1GTJC6YCNnOP/tQp7Pjx4x8EVep
TLSH
T1B065DF307682C037D66201718978EBBA456FB9344F2926D7A3881B3E5E705D39F35E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_930f563cc7a858ce3e92454526f2b0f0_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader

File Explorer

2026-09-08_930f563cc7a858ce3e92454526f2b0f0_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader

.exe 1.4MB

2026-09-08_930f563cc7a858ce3e92454526f2b0f0_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader

IMPHASH 6ec3cbfff81ce9640c4ea33136be589a
SHA256 9c9206610e116044abb6101171271216ca7e85a80862a3dbb6276ebf459ffa83
MD5 930f563cc7a858ce3e92454526f2b0f0
SHA1 a1dcdf76d27456900dfdb5b73e03db3c2499957b
SHA512 969198568ee8871d50a07288754a2e2d3968b1226acaba0353a6c8b0726f09975da66597f49931a3d8d91d9c7944a356034f045a070f082ed56bb6114e4fd958
SSDEEP 24576:B/Y1RtGiSq2a0eiMvD36Y8rT4V6nOP/tQp7Pgyxknw4FYnshx8OfVe247:u1GTJC6YCNnOP/tQp7Pjx4x8EVep
TLSH
T1B065DF307682C037D66201718978EBBA456FB9344F2926D7A3881B3E5E705D39F35E2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

333954

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\atkexComSvc\Release\atkexComSvc.pdb

atkex

ord3 ord2

winmm

timeGetTime

kernel32

InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleW GetFileAttributesA GetCurrentProcessId GetCurrentThreadId GetDynamicTimeZoneInformation DecodePointer RaiseException InitializeCriticalSectionEx GetModuleHandleW LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW DeleteFileA SetFileAttributesA SetEvent ReleaseMutex WaitForSingleObject CreateMutexW CreateEventW OpenEventW LoadLibraryA SetDllDirectoryW GetCommandLineW DeleteFileW CreateThread lstrcpyW GetCurrentProcess GetCurrentThread GetSystemInfo GetNativeSystemInfo SetThreadAffinityMask SetThreadPriority GetExitCodeThread SuspendThread ResumeThread GetFileAttributesW GetFileAttributesExW LocalFree CreateDirectoryW ResetEvent K32EnumDeviceDrivers K32GetDeviceDriverBaseNameW ReadConsoleW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc HeapSize GetTimeZoneInformation EnumSystemLocalesW GetLastError CloseHandle WriteFile ReadFile FlushFileBuffers CreateFileW CreateFileA WritePrivateProfileStringW WritePrivateProfileStringA GetPrivateProfileStringW GetPrivateProfileStringA GetPrivateProfileIntW GetModuleFileNameA GetModuleHandleA OutputDebugStringW OutputDebugStringA WideCharToMultiByte MultiByteToWideChar GetModuleFileNameW FreeLibrary GetTickCount LoadLibraryW GetProcAddress Sleep GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileSizeEx GetConsoleCP HeapAlloc HeapFree ExitProcess MoveFileExW RemoveDirectoryW SetEnvironmentVariableW GetModuleHandleExW ExitThread GetFileType SetStdHandle RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc GetVersionExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation DuplicateHandle WaitForSingleObjectEx SwitchToThread QueryPerformanceCounter TryEnterCriticalSection FormatMessageW FindClose FindFirstFileExW FindNextFileW SetEndOfFile SetFilePointerEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait GetThreadPriority

user32

GetMessageW TranslateMessage wsprintfW PostThreadMessageW CharUpperW MessageBoxW LoadStringW CharNextW DispatchMessageW MessageBoxA

advapi32

GetNamedSecurityInfoW RegCreateKeyExW RegDeleteKeyW QueryServiceStatus RegOpenKeyExA RegNotifyChangeKeyValue BuildTrusteeWithSidW SetNamedSecurityInfoW RegDeleteValueW GetAce FreeSid EqualSid DeleteAce AllocateAndInitializeSid StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegQueryValueExW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCloseKey

shell32

SHGetFolderPathAndSubDirW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize CoInitializeEx CoRegisterClassObject CoAddRefServerProcess CoReleaseServerProcess CoInitializeSecurity StringFromGUID2 CoResumeClassObjects CoRevokeClassObject

oleaut32

SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen SysAllocStringLen UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantCopy VariantClear VariantInit SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate SysStringLen

shlwapi

PathIsDirectoryW PathFileExistsW ord217

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_930f563cc7a858ce3e92454526f2b0f0_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader

atkex

winmm

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic