Extracted

• • Target
    2026-09-11_a3d78f7312d7dffd997602fb31b41bda_amadey_elex_luca-stealer_lynx_njrat_play
  • Size 1.8MB
  • SHA256 232f951c47642c04d774f7e5f9fdee5c749dda4f5d9c60611ae30c9c6d640d7a
  • MD5 a3d78f7312d7dffd997602fb31b41bda
  • SHA1 0a4129479087143bcb2e402694c591d4605386c8
  • SHA512 ecf9fe189f4f2beeb492dffaa8b44e32dc2685ac0b0e967afc5ff40b8c7aaddd7f3b8d6dc448cd25c069792bd8e51669fa18c22f4c6972ad2c1534fed0ec6210
  • SSDEEP 24576:vQiB11LgDhMAmbvJ4AYKRxjMPGBbUe8g6hZ7ce4HqCLJ2gO5vNr8GyWgF:Ii0GIgpe47TO5vNr8My
  • TLSH
    T142956CA03A6C9750D3FDBA7789DD44F1B9298057CA341DEB1718809F03BA8DF195E0AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionprivateloaderriseproloaderpersistenceprivilege_escalationstealer

  • Family: PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Family: RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2