2026-10-01_20834a679d8b274b22c639202abf48b8_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_20834a679d8b274b22c639202abf48b8_amadey_elex_luca-stealer_lynx_njrat
Size 1.4MB
Sample261002-w75ncavfnc
SHA256 ef9f45d8395a4312c92f056b91e0e18163eac4325eb6c37f9448c584b075cd6b
MD5 20834a679d8b274b22c639202abf48b8
SHA1 bcfd717f292cc70ca21135159a797d5dcefb0760
SHA512 83f2e62b267e35f1f97180ae1e3b239f5b1935edf0b0b21044a4bc33bf067dd18158f8f677f80d854e8bb45f5d90301e8a1e18050839f43c147d920c0b5f335a
SSDEEP 24576:8Mscdopa/xJPlaH0/0TMcuiywhadNNWfIKGTP+XChEeCjRfJCRTgG1VNzLY:8MsmPlaHTTWiywhad2AKkGXReGR4TgIs
TLSH
T17A65E121B682813BDA710031653CDBBB217EFA314FA6A8D793C45FA968745C11F35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_20834a679d8b274b22c639202abf48b8_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-10-01_20834a679d8b274b22c639202abf48b8_amadey_elex_luca-stealer_lynx_njrat

.exe 1.4MB

2026-10-01_20834a679d8b274b22c639202abf48b8_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 5d45bd7311f6c829254fe087edb52959
SHA256 ef9f45d8395a4312c92f056b91e0e18163eac4325eb6c37f9448c584b075cd6b
MD5 20834a679d8b274b22c639202abf48b8
SHA1 bcfd717f292cc70ca21135159a797d5dcefb0760
SHA512 83f2e62b267e35f1f97180ae1e3b239f5b1935edf0b0b21044a4bc33bf067dd18158f8f677f80d854e8bb45f5d90301e8a1e18050839f43c147d920c0b5f335a
SSDEEP 24576:8Mscdopa/xJPlaH0/0TMcuiywhadNNWfIKGTP+XChEeCjRfJCRTgG1VNzLY:8MsmPlaHTTWiywhad2AKkGXReGR4TgIs
TLSH
T17A65E121B682813BDA710031653CDBBB217EFA314FA6A8D793C45FA968745C11F35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

325320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\964624\out\Release\360zipUpdate.pdb

kernel32

HeapDestroy GetFileSize DeleteCriticalSection GetProcessHeap ReadFile GetFileSizeEx GetPrivateProfileIntW DeviceIoControl GetTempPathW FreeResource DeleteFileW GetSystemWindowsDirectoryW GetCPInfoExW ResumeThread OutputDebugStringW ExitProcess SuspendThread FlushInstructionCache SetThreadContext SetEndOfFile MoveFileExW SetThreadLocale LockResource WritePrivateProfileStringW FindResourceW GetTempFileNameW lstrcmpiW GetPrivateProfileStringA InitializeCriticalSection WriteConsoleW ReadConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetConsoleMode GetConsoleOutputCP SetStdHandle IsValidLocale GetStdHandle FreeLibraryAndExitThread ExitThread GetFileType RtlUnwind GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsSetValue TlsGetValue TlsAlloc HeapWalk HeapUnlock HeapLock SetFilePointerEx CreateFileA LocalFileTimeToFileTime GetCPInfo IsDebuggerPresent GetCurrentThread GetVersion FindClose SetFilePointer LoadResource GetPrivateProfileStringW WriteFile FindNextFileW GetCommandLineW SizeofResource EnumSystemLocalesW GetUserDefaultLCID GetSystemDefaultLCID GetThreadLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeZoneInformation SystemTimeToFileTime MulDiv LocalFree GetProcAddress GetModuleHandleW GetModuleFileNameW ExpandEnvironmentStringsW FindResourceExW FreeLibrary UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GetThreadContext CreateProcessW GetCurrentThreadId CreateThread TerminateProcess GetCurrentProcessId GetCurrentProcess WaitForMultipleObjects Sleep CreateEventW CreateMutexW WaitForSingleObject ReleaseMutex SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException AreFileApisANSI FindFirstFileW CreateFileW GetCurrentDirectoryW FlushFileBuffers

user32

MoveWindow GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IntersectRect LoadCursorW LoadMenuW IsWindowVisible SetWindowRgn ScreenToClient GetShellWindow WindowFromPoint TrackPopupMenu GetSubMenu IsWindow OffsetRect GetWindowInfo GetForegroundWindow DestroyMenu LoadIconW DrawTextW KillTimer GetDesktopWindow InvalidateRect GetAncestor GetCursorPos CreateDialogParamW GetWindow SetWindowPos EndDialog SetWindowTextW PeekMessageW CharNextW GetClientRect GetDlgItem DestroyWindow SetTimer MapWindowPoints GetWindowLongW SetWindowLongW FindWindowExW GetSystemMetrics GetDC ReleaseDC GetParent DialogBoxParamW BeginPaint EndPaint GetLastInputInfo MessageBoxW GetActiveWindow ShowWindow SetForegroundWindow wsprintfW UnregisterClassW GetMonitorInfoW MonitorFromWindow LoadImageW GetWindowThreadProcessId GetWindowRect

gdi32

CreateFontW DeleteDC CreateSolidBrush DeleteObject CreateRoundRectRgn SelectObject SetStretchBltMode GetObjectW GetDeviceCaps CreateCompatibleDC CreateDIBSection SetBkMode

advapi32

RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW OpenProcessToken RegQueryInfoKeyW RegEnumKeyExW

shell32

ord165 ShellExecuteW ord680 ShellExecuteExW Shell_NotifyIconW SHGetSpecialFolderPathW CommandLineToArgvW

ole32

CoTaskMemRealloc OleInitialize CoCreateInstance OleUninitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

SysStringByteLen SysFreeString VarUI4FromStr SysStringLen VariantInit SysAllocStringByteLen VariantClear SysAllocString

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW StrCmpIW SHGetValueW PathIsRelativeW SHSetValueW PathAddBackslashW PathFileExistsW PathAppendW StrStrIA PathFindFileNameW

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW GetModuleBaseNameW

Name

.text

Size

505KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

791KB

Virtual Size

792KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_20834a679d8b274b22c639202abf48b8_amadey_elex_luca-stealer_lynx_njrat

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

generic