2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

General

Target
2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader
Size 1.5MB
Sample260929-vm5bea1tev
SHA256 d91d86fc1b3ee9e9b976202138f91d7f12e73513c0297e33dc3a0064d6907cb2
MD5 c3e84c022ab46541615eba67b8d0ee83
SHA1 a9cac6eeb00513c4ee3cd48758ca815e87e1deb5
SHA512 44ec7c86f838bdad279bd642f3eee9a5aca556d744414171882b029361879404254f37300d01f871a3a04a729abcc049d7d7f9cbca6e3e686167df35e4cfb060
SSDEEP 24576:99bkrEMfJ4yL/tNCJPXUQrP2XcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:ArEMfJ4klKXnOMkYej15VHW
TLSH
T11A652369B9C0C1B2C461193806E0D3705B3C7EB03B69A197E7C22EB57F752921B1CB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 1.5MB

2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 8afe945427c19c226b15a4ce7db8c296
SHA256 d91d86fc1b3ee9e9b976202138f91d7f12e73513c0297e33dc3a0064d6907cb2
MD5 c3e84c022ab46541615eba67b8d0ee83
SHA1 a9cac6eeb00513c4ee3cd48758ca815e87e1deb5
SHA512 44ec7c86f838bdad279bd642f3eee9a5aca556d744414171882b029361879404254f37300d01f871a3a04a729abcc049d7d7f9cbca6e3e686167df35e4cfb060
SSDEEP 24576:99bkrEMfJ4yL/tNCJPXUQrP2XcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:ArEMfJ4klKXnOMkYej15VHW
TLSH
T11A652369B9C0C1B2C461193806E0D3705B3C7EB03B69A197E7C22EB57F752921B1CB7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

20924

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

htonl WSAGetLastError WSAStartup getprotobyname gethostbyname gethostbyaddr socket sendto select recvfrom ntohs ntohl inet_ntoa inet_addr htons bind

kernel32

ExitProcess SetEndOfFile WriteConsoleW HeapReAlloc HeapSize GetFileSizeEx CreateFileW ReadConsoleW ReadFile SetFilePointerEx GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW MultiByteToWideChar RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException DecodePointer GetModuleHandleExW SetConsoleCtrlHandler GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

ws2_32

kernel32

generic