f5165411cbcab99a6469925b20f746bbef853c59e0c5455f6dc8adedd45d5e8b

General

Target
2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat
Size 1.7MB
Sample260930-yrdk2a1w7l
SHA256 f5165411cbcab99a6469925b20f746bbef853c59e0c5455f6dc8adedd45d5e8b
MD5 65cea36f547c56fde0de31f0e1a2b126
SHA1 aeb3c1af47c1825fa1b25208d7705b7a52cae622
SHA512 e75b9a72a36f0af942a3e00b8d2db4c167300c83d8a98671627e6102ae20c6eadea9e30e5f3bd1cd72a3c1a22413c4e63d6f8fa9033a51f5e5057d923398637d
SSDEEP 12288:w9ccnNCIvpAtGT8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHi:w9DNC0AtzdCN/j2GLl3iFSE33b9L
TLSH
T13785F121B8D1C073D567093689B8DF795E2DFCB08F606AC797801EFACA30AD19B35616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat
- Size 1.7MB
- SHA256 f5165411cbcab99a6469925b20f746bbef853c59e0c5455f6dc8adedd45d5e8b
- MD5 65cea36f547c56fde0de31f0e1a2b126
- SHA1 aeb3c1af47c1825fa1b25208d7705b7a52cae622
- SHA512 e75b9a72a36f0af942a3e00b8d2db4c167300c83d8a98671627e6102ae20c6eadea9e30e5f3bd1cd72a3c1a22413c4e63d6f8fa9033a51f5e5057d923398637d
- SSDEEP 12288:w9ccnNCIvpAtGT8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHi:w9DNC0AtzdCN/j2GLl3iFSE33b9L
- TLSH
  T13785F121B8D1C073D567093689B8DF795E2DFCB08F606AC797801EFACA30AD19B35616
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution persistence privilege_escalation ransomware spyware stealer
- Detects executables calling ClearMyTracksByProcess
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2