2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader
Size 1.9MB
Sample260910-hgb2fssvct
SHA256 47de83c09339aaa64980034ef5c08fc87fe290f2722baecb2c420645da792e91
MD5 2ec442f6af686f8bc172189c429d5d6c
SHA1 0242c42d3bc67f3b0f0f40b28bd4dcdfc7f0e8c8
SHA512 02a1e0316cbc3d0aa2b2e4bfd6156549246fffc31439003d2b8b20988494aea47c5f9dbb5db7e3797e83c9e20e86bea84c2d180d4cc0306551ff745fdc88943a
SSDEEP 24576:FxRxRFMeR1Ei1iQiYWLg77R0Ryxknw4FYnshx8OfVe247:b7R1Eui2Z77R0Ux4x8EVep
TLSH
T10095F11479A2E076C53242B18D7CE776496EB9204B3245EFB3D89B2D1D708C27B36A37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader

File Explorer

2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader

.exe 1.9MB

2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader

IMPHASH 5c12d7a8a8413e3715e2b103e3ba7b4b
SHA256 47de83c09339aaa64980034ef5c08fc87fe290f2722baecb2c420645da792e91
MD5 2ec442f6af686f8bc172189c429d5d6c
SHA1 0242c42d3bc67f3b0f0f40b28bd4dcdfc7f0e8c8
SHA512 02a1e0316cbc3d0aa2b2e4bfd6156549246fffc31439003d2b8b20988494aea47c5f9dbb5db7e3797e83c9e20e86bea84c2d180d4cc0306551ff745fdc88943a
SSDEEP 24576:FxRxRFMeR1Ei1iQiYWLg77R0Ryxknw4FYnshx8OfVe247:b7R1Eui2Z77R0Ux4x8EVep
TLSH
T10095F11479A2E076C53242B18D7CE776496EB9204B3245EFB3D89B2D1D708C27B36A37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

152350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\AsIO_Driver\AsIO3\Release\AsusCertService.pdb

kernel32

SetEvent WaitForSingleObject CreateEventW Sleep CreateThread OpenProcess lstrcmpW K32EnumProcesses K32GetModuleFileNameExW LocalAlloc LocalFree ReadFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetOverlappedResult LoadLibraryW UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect GetFileAttributesA GetVersionExW GetModuleHandleA GetCommandLineW MultiByteToWideChar lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary LeaveCriticalSection EnterCriticalSection SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode GetDynamicTimeZoneInformation GetCurrentThreadId GetCurrentProcessId DeleteCriticalSection InitializeCriticalSectionEx DeviceIoControl GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue SetEndOfFile WriteConsoleW CreateFileW ReadConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP GetStdHandle GetLastError RaiseException CloseHandle DecodePointer OutputDebugStringW WriteFile CreateFileA VirtualAlloc InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte DuplicateHandle SwitchToThread GetCurrentThread GetExitCodeThread TryEnterCriticalSection SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EncodePointer GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlUnwind InterlockedPushEntrySList InterlockedFlushSList ExitProcess GetModuleHandleExW ExitThread FreeLibraryAndExitThread HeapAlloc HeapFree GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetTimeZoneInformation HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetFileSizeEx SetFilePointerEx DeleteFileW MoveFileExW SetStdHandle CreateDirectoryW FindClose FindFirstFileExW FindNextFileW IsValidCodePage

user32

wsprintfW CharNextW LoadStringW GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW CharUpperW MessageBoxW

advapi32

DeleteService RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW SetSecurityInfo StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW RegCloseKey CreateServiceW ControlService CloseServiceHandle ReportEventW RegisterEventSourceW DeregisterEventSource

shell32

SHGetFolderPathA

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoCreateInstance StringFromGUID2 CoInitializeEx

oleaut32

LoadTypeLi UnRegisterTypeLi RegisterTypeLi SysAllocString SysFreeString LoadRegTypeLi VarUI4FromStr SysStringLen

wintrust

WinVerifyTrust

crypt32

CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

wintrust

crypt32

generic