2026-09-29_3a567ebd8fd98aecd0ad5fa736f229bc_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_3a567ebd8fd98aecd0ad5fa736f229bc_amadey_elex_luca-stealer_lynx_njrat
Size 1.8MB
Sample260930-detfhaxtdw
SHA256 d2123b739c3b094d720843d025b840a0cfa450d623401878cc337b903dd84ec4
MD5 3a567ebd8fd98aecd0ad5fa736f229bc
SHA1 74c41a6b1aa9089103c57772c5f32aacd07ce36f
SHA512 0e72a239ed8e2a43c1a5654a7c2c197a29846ddf8a7b76a1a2dc27ef6e7a156933f4000b63f2027694e5ecac2b13f8dbbfadcb8bdf418ed7b7805f3e9cf0270b
SSDEEP 24576:A1MaxxLaKngL2jdshRTdG1YxITqvfPkbIcbjLbfJ4yL/tNCJPXUQrPR:A1MOarSj8RoTCCrfJ4klKXn5
TLSH
T182851261748086B1CCE231F903ECF635419EE9F4071656CB4AD81BFEEA606E17F3616A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_3a567ebd8fd98aecd0ad5fa736f229bc_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-09-29_3a567ebd8fd98aecd0ad5fa736f229bc_amadey_elex_luca-stealer_lynx_njrat

.exe 1.8MB

2026-09-29_3a567ebd8fd98aecd0ad5fa736f229bc_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 1bb4708f95f36f786972d5e4576cf676
SHA256 d2123b739c3b094d720843d025b840a0cfa450d623401878cc337b903dd84ec4
MD5 3a567ebd8fd98aecd0ad5fa736f229bc
SHA1 74c41a6b1aa9089103c57772c5f32aacd07ce36f
SHA512 0e72a239ed8e2a43c1a5654a7c2c197a29846ddf8a7b76a1a2dc27ef6e7a156933f4000b63f2027694e5ecac2b13f8dbbfadcb8bdf418ed7b7805f3e9cf0270b
SSDEEP 24576:A1MaxxLaKngL2jdshRTdG1YxITqvfPkbIcbjLbfJ4yL/tNCJPXUQrPR:A1MOarSj8RoTCCrfJ4klKXn5
TLSH
T182851261748086B1CCE231F903ECF635419EE9F4071656CB4AD81BFEEA606E17F3616A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\workspace\p-80ba572eab7846c3a8bc4837b685d41f\src\product\win32\picpreview.pdb

kernel32

DecodePointer RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW FreeLibrary GetModuleFileNameW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW LocalFree FormatMessageW SetDllDirectoryW WriteConsoleW CreateFileW ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx GetConsoleMode IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection CloseHandle InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetConsoleCtrlHandler SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP

user32

UnregisterClassW

shlwapi

PathAddBackslashW PathAppendW PathRemoveFileSpecW

shell32

CommandLineToArgvW

Name

.text

Size

422KB

Virtual Size

421KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

265B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_3a567ebd8fd98aecd0ad5fa736f229bc_amadey_elex_luca-stealer_lynx_njrat

kernel32

user32

shlwapi

shell32

generic