2026-09-08_8cfb28bbabc242872bc7a4a9c4bb5f32_amadey_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_8cfb28bbabc242872bc7a4a9c4bb5f32_amadey_elex_luca-stealer_njrat_smoke-loader
Size 1.5MB
Sample260910-es2vgaxclc
SHA256 b054f4b1885e9e3b73c34cd2975c0e604070a829c315c43c76532f4227ed4198
MD5 8cfb28bbabc242872bc7a4a9c4bb5f32
SHA1 97249da5f55abbb20e239a60232abc8b649e0d94
SHA512 b982df6750c764536f92361e629163561d53ee20ff653e3bfa705481cd0954fa925786d41e2adca4a618c1d797e219742dd3ee42bd4217d32c63e58edaac38e3
SSDEEP 12288:fXdh+A+02YsPHcfiL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6q0uoyxknw4FYnshx8OfVe247
TLSH
T19D75023476C1C0B2E4B625311AF4D7719A2DBD214F70858FA7A8273EDA704E1A539E37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_8cfb28bbabc242872bc7a4a9c4bb5f32_amadey_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-08_8cfb28bbabc242872bc7a4a9c4bb5f32_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 1.5MB

2026-09-08_8cfb28bbabc242872bc7a4a9c4bb5f32_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH 69ad176ea4b75dab296b77d475327d34
SHA256 b054f4b1885e9e3b73c34cd2975c0e604070a829c315c43c76532f4227ed4198
MD5 8cfb28bbabc242872bc7a4a9c4bb5f32
SHA1 97249da5f55abbb20e239a60232abc8b649e0d94
SHA512 b982df6750c764536f92361e629163561d53ee20ff653e3bfa705481cd0954fa925786d41e2adca4a618c1d797e219742dd3ee42bd4217d32c63e58edaac38e3
SSDEEP 12288:fXdh+A+02YsPHcfiL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6q0uoyxknw4FYnshx8OfVe247
TLSH
T19D75023476C1C0B2E4B625311AF4D7719A2DBD214F70858FA7A8273EDA704E1A539E37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34399

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\AsIO_Driver\AsIO3\Release\InstDrv.pdb

kernel32

GetProcAddress MoveFileExW CreateProcessW CopyFileW CloseHandle MoveFileW WriteConsoleW SetEndOfFile HeapReAlloc DeleteFileW Wow64RevertWow64FsRedirection Sleep GetPrivateProfileStringW SetFileAttributesW GetModuleHandleA WaitForSingleObject GetTempPathW GetModuleFileNameW GetPrivateProfileIntW Wow64DisableWow64FsRedirection GetCurrentProcess CreateDirectoryW OutputDebugStringW lstrcmpW GetLastError HeapSize CreateFileW GetFileSizeEx GetConsoleCP FlushFileBuffers GetStringTypeW SetStdHandle QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException EncodePointer FreeLibrary LoadLibraryExW ReadFile GetTimeZoneInformation GetLocalTime ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc SetFilePointerEx GetConsoleMode ReadConsoleW GetFileType MultiByteToWideChar WideCharToMultiByte GetCPInfo FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetProcessHeap DecodePointer

user32

wsprintfW

advapi32

RegCloseKey RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW EnumServicesStatusW RegQueryValueExW CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService ControlService StartServiceW QueryServiceConfigW OpenServiceW

shell32

SHGetFolderPathAndSubDirW SHGetFolderPathW

shlwapi

PathFileExistsW PathIsDirectoryW ord217

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_8cfb28bbabc242872bc7a4a9c4bb5f32_amadey_elex_luca-stealer_njrat_smoke-loader

kernel32

user32

advapi32

shell32

shlwapi

generic