2026-09-24_d04629cb8746cada95069ad5b927d3e2_amadey_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-09-24_d04629cb8746cada95069ad5b927d3e2_amadey_elex_luca-stealer_njrat_smoke-loader
Size 1.6MB
Sample260924-dfa1jscd99
SHA256 10121bba379647253631a25f76004c39f6cb80755208f35b9a4ba8f864c25e5f
MD5 d04629cb8746cada95069ad5b927d3e2
SHA1 ffa447adda8c6deb4e51c1a11072470ad3daac44
SHA512 d43f20bb94de1a34e18d9933956f35782fe0878cb613a6c82d1213cfe7a0dd733bcfeff75d51d5f4a7516711cc36c8865e317e122ac00ed54782b82556f369a8
SSDEEP 24576:38f8owRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:38f81sb5+Pl6bJTIZ5jdgpd
TLSH
T15675020179D28073D567493588E8DB38AA3EFD918F616AD793D40FBF8A346C0AB35706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_d04629cb8746cada95069ad5b927d3e2_amadey_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-24_d04629cb8746cada95069ad5b927d3e2_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 1.6MB

2026-09-24_d04629cb8746cada95069ad5b927d3e2_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH a47ecc3693e9083d9c886f464ef6d80d
SHA256 10121bba379647253631a25f76004c39f6cb80755208f35b9a4ba8f864c25e5f
MD5 d04629cb8746cada95069ad5b927d3e2
SHA1 ffa447adda8c6deb4e51c1a11072470ad3daac44
SHA512 d43f20bb94de1a34e18d9933956f35782fe0878cb613a6c82d1213cfe7a0dd733bcfeff75d51d5f4a7516711cc36c8865e317e122ac00ed54782b82556f369a8
SSDEEP 24576:38f8owRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:38f81sb5+Pl6bJTIZ5jdgpd
TLSH
T15675020179D28073D567493588E8DB38AA3EFD918F616AD793D40FBF8A346C0AB35706
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

26784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\src\debugpy\_vendored\pydevd\pydevd_attach_to_process\windows\inject_dll_x86.pdb

kernel32

CloseHandle GetLastError WaitForSingleObject CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleA GetProcAddress WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo CreateFileW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_d04629cb8746cada95069ad5b927d3e2_amadey_elex_luca-stealer_njrat_smoke-loader

kernel32

generic