2026-10-02_ebc8905f1348d25ade4b20bc9fac0497_amadey_elex_luca-stealer_lynx_njrat_spyloan

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_ebc8905f1348d25ade4b20bc9fac0497_amadey_elex_luca-stealer_lynx_njrat_spyloan
Size 11.3MB
Sample261002-28dtxaaa46
SHA256 e45c2c854d8dd12633e5e6c66a4ffc279cee3742dfa031cec8e06fabfd95b58a
MD5 ebc8905f1348d25ade4b20bc9fac0497
SHA1 75c31b4a789e188cb6bce5f1f93eb5e745453d4a
SHA512 26e0ae1fa29a9db48d14bb853adbba72c853c756b65d487ecb6fa1104b6be623e43e685ae73e49cf87296a3fd39ea625f18e60f6cbbae11ce579553e2c4018b9
SSDEEP 196608:0fyH2NjNCUOO9qC+JUkyeeVo2MnRjIyhTIqdKItvKM2jDRg/6bGtZMwSipsM2jsb:0fyHGZCUOOwqkyeuYpbh/dK4YgSbGbMU
TLSH
T14AC633E2BE85B0A3C57285347280AD3E067F7D241F1A4A67736ABED6BB300435D35A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_ebc8905f1348d25ade4b20bc9fac0497_amadey_elex_luca-stealer_lynx_njrat_spyloan

File Explorer

2026-10-02_ebc8905f1348d25ade4b20bc9fac0497_amadey_elex_luca-stealer_lynx_njrat_spyloan

.exe 11.3MB

2026-10-02_ebc8905f1348d25ade4b20bc9fac0497_amadey_elex_luca-stealer_lynx_njrat_spyloan

IMPHASH 981a275bce22f656f306ebaaaa886c29
SHA256 e45c2c854d8dd12633e5e6c66a4ffc279cee3742dfa031cec8e06fabfd95b58a
MD5 ebc8905f1348d25ade4b20bc9fac0497
SHA1 75c31b4a789e188cb6bce5f1f93eb5e745453d4a
SHA512 26e0ae1fa29a9db48d14bb853adbba72c853c756b65d487ecb6fa1104b6be623e43e685ae73e49cf87296a3fd39ea625f18e60f6cbbae11ce579553e2c4018b9
SSDEEP 196608:0fyH2NjNCUOO9qC+JUkyeeVo2MnRjIyhTIqdKItvKM2jDRg/6bGtZMwSipsM2jsb:0fyHGZCUOOwqkyeuYpbh/dK4YgSbGbMU
TLSH
T14AC633E2BE85B0A3C57285347280AD3E067F7D241F1A4A67736ABED6BB300435D35A17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

141149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\devel\ark7\bin.win32\bdzsfx.x86.pdb

kernel32

MultiByteToWideChar lstrcmpW MulDiv SetFilePointerEx GetFileSizeEx SetFileAttributesW DeleteFileW SetFileTime SetEndOfFile WriteFile GetVersion lstrlenW GetFullPathNameW lstrcatW WaitForSingleObject InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventW SetEvent ResetEvent lstrcpyW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW CreateHardLinkW RemoveDirectoryW CreateSymbolicLinkW VirtualAlloc VirtualFree GetModuleFileNameW GetFileAttributesW GetCurrentThread FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime Sleep IsNormalizedString NormalizeString GlobalMemoryStatusEx CompareStringW CreateFileA GetDriveTypeW FlushFileBuffers GetTickCount FindClose GlobalFree LocalFree WideCharToMultiByte GetModuleHandleW lstrcmpiW RaiseException InitializeCriticalSectionEx SetLastError GetCurrentThreadId GetUserDefaultLangID DecodePointer GetConsoleOutputCP GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetStdHandle GetConsoleMode LCMapStringW GetStdHandle GetCommandLineW GetCommandLineA ExitProcess GetFileType GetModuleHandleExW FreeLibraryAndExitThread WriteConsoleW ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount LoadLibraryExA IsProcessorFeaturePresent GetLastError GetProcAddress CloseHandle CreateFileW lstrcpynW ReadFile GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetSystemDirectoryW FreeLibrary LoadLibraryExW LoadLibraryW FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent

user32

GetDlgItem CreateWindowExW GetWindowRect SendMessageW SystemParametersInfoW ScreenToClient SetFocus EndDialog KillTimer EnableWindow SetTimer SetDlgItemTextW PostMessageW MessageBoxW GetWindow MonitorFromWindow GetMonitorInfoW GetClientRect LoadIconW GetWindowTextW DialogBoxParamW UnregisterClassW GetActiveWindow CharNextW PeekMessageW DispatchMessageW TranslateMessage RegisterWindowMessageW MoveWindow EnumChildWindows SetWindowLongW GetWindowLongW FindWindowExW GetClassNameW MapWindowPoints GetDlgCtrlID GetParent SetWindowPos MonitorFromPoint SetProcessDPIAware ReleaseDC GetDC SetWindowTextW InvalidateRect GetWindowTextLengthW

gdi32

GetDeviceCaps CreateFontIndirectW GetObjectW GetStockObject DeleteObject CreateFontW

advapi32

RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW AreAllAccessesGranted AccessCheck OpenThreadToken RevertToSelf ImpersonateSelf GetFileSecurityW

shell32

SHBrowseForFolderW CommandLineToArgvW SHGetPathFromIDListW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoInitialize CoUninitialize CoCreateInstance

oleaut32

VarUI4FromStr

shlwapi

PathIsDirectoryW PathCanonicalizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_ebc8905f1348d25ade4b20bc9fac0497_amadey_elex_luca-stealer_lynx_njrat_spyloan

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

generic