2026-09-29_5870a64b103088d15aa0b73f39a20ef9_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_5870a64b103088d15aa0b73f39a20ef9_amadey_elex_luca-stealer_lynx_njrat
Size 1.7MB
Sample260930-avjz8axyfv
SHA256 94c646488c6b3da1eebfc6fb64d46169fa884e0d8bf3fdd133e21cc14f665ff3
MD5 5870a64b103088d15aa0b73f39a20ef9
SHA1 ce3d36141c092fbd5866e13da22cb9d141a06fd4
SHA512 804a504cbdf3f557cf1b7ca34d11556a535727715074968d8f35e8b0ef6d50e28c80139fdae1a368bb8fee0f62123b3317786ba8375bf6e24fcb9d76acb83415
SSDEEP 49152:2WyHiGdh5GbMAi/5lAi/5qAZOZgz80vn8w/80v6+w:wiGdh5GNi8i8ZBon8w/pvq
TLSH
T10385DF113D81A33DE072217049295A69556EADB70B2948EB73C2BB3D99323F25E31F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_5870a64b103088d15aa0b73f39a20ef9_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-09-29_5870a64b103088d15aa0b73f39a20ef9_amadey_elex_luca-stealer_lynx_njrat

.exe 1.7MB

2026-09-29_5870a64b103088d15aa0b73f39a20ef9_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 1954b9ee3958b39b996d5b3f6d9532c8
SHA256 94c646488c6b3da1eebfc6fb64d46169fa884e0d8bf3fdd133e21cc14f665ff3
MD5 5870a64b103088d15aa0b73f39a20ef9
SHA1 ce3d36141c092fbd5866e13da22cb9d141a06fd4
SHA512 804a504cbdf3f557cf1b7ca34d11556a535727715074968d8f35e8b0ef6d50e28c80139fdae1a368bb8fee0f62123b3317786ba8375bf6e24fcb9d76acb83415
SSDEEP 49152:2WyHiGdh5GbMAi/5lAi/5qAZOZgz80vn8w/80v6+w:wiGdh5GNi8i8ZBon8w/pvq
TLSH
T10385DF113D81A33DE072217049295A69556EADB70B2948EB73C2BB3D99323F25E31F37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

284889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\project_sign_file\WX3d6t\Release\MPHelper.pdb

kernel32

MultiByteToWideChar CreateFileW ReadFile ConnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus InitializeCriticalSectionEx OpenEventW GetTickCount CreateDirectoryW SetFilePointer DecodePointer RaiseException SetLastError SetErrorMode CreateMutexW GetCurrentThread GetCurrentThreadId FreeLibrary GetModuleHandleW LoadLibraryExW LoadResource SizeofResource FindResourceW LoadLibraryW lstrcmpiW HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap CreateThread TerminateThread SuspendThread LocalFree WideCharToMultiByte FindResourceExW LockResource GetFileSize VirtualAlloc VirtualFree DeleteFileW GetLongPathNameW SetFileAttributesW OpenProcess GlobalAlloc GlobalFree MoveFileExW LoadLibraryA Process32FirstW Process32NextW GetSystemTimeAsFileTime GetTempPathW GlobalUnlock GlobalLock GetLongPathNameA GetModuleFileNameA WriteConsoleW SetStdHandle CreateEventW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetStdHandle ExitProcess QueryPerformanceFrequency GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind VirtualQuery VirtualProtect SetThreadContext GetThreadContext ResumeThread GetProcAddress GetModuleFileNameW GetLocalTime TerminateProcess GetCurrentProcessId GetCurrentProcess CreateToolhelp32Snapshot WaitForSingleObject ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError CloseHandle OutputDebugStringW QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetStringTypeW GetLocaleInfoW LCMapStringW GetCPInfo SetEndOfFile TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent Sleep FreeEnvironmentStringsW WriteFile

user32

DispatchMessageW DestroyWindow CharNextW UnregisterClassW GetDesktopWindow PeekMessageW GetClassInfoExW IsWindow SetWindowPos IsWindowVisible GetClientRect GetWindowRect GetMessageW GetWindowLongW SetWindowLongW GetParent GetWindow LoadCursorW MonitorFromWindow GetMonitorInfoW CallWindowProcW UpdateLayeredWindow GetDC ReleaseDC BeginPaint EndPaint TranslateMessage FindWindowW UpdateWindow KillTimer SetTimer ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostThreadMessageW PostMessageW SendMessageTimeoutW MapWindowPoints

gdi32

SelectObject GetDeviceCaps DeleteObject DeleteDC CreateCompatibleDC CreateDIBSection

advapi32

RegOpenKeyExW RegCreateKeyExW RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegCloseKey RegEnumKeyExW RegDeleteValueW RegDeleteKeyW

shell32

SHGetSpecialFolderPathW ShellExecuteW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize CreateStreamOnHGlobal CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathIsPrefixW PathFindFileNameW PathAppendW StrDupW PathRemoveBackslashW SHDeleteKeyW SHGetValueW PathFileExistsW PathCanonicalizeW SHSetValueW StrStrIA

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

crypt32

CryptBinaryToStringA

psapi

GetModuleFileNameExW

wininet

InternetSetOptionW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoA HttpQueryInfoW InternetErrorDlg HttpOpenRequestW HttpAddRequestHeadersA InternetQueryOptionW InternetReadFile InternetOpenUrlW InternetConnectW InternetCloseHandle InternetCrackUrlW InternetOpenW

gdiplus

GdipDrawImageRectRectI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipCreateFromHDC GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromFile GdipLoadImageFromStream GdipCreateSolidFill GdipDeleteFont GdipCloneBrush GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipDrawString GdipSetInterpolationMode GdipSetSmoothingMode GdipSetCompositingMode GdipDeleteGraphics GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipGetImageGraphicsContext GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusStartup GdipSetTextRenderingHint GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipDeleteBrush GdipGraphicsClear

Name

.text

Size

452KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

356KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

784KB

Virtual Size

784KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_5870a64b103088d15aa0b73f39a20ef9_amadey_elex_luca-stealer_lynx_njrat

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

crypt32

psapi

wininet

gdiplus

generic