2026-10-01_171af21148e25cde2b32de6455216a71_amadey_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_171af21148e25cde2b32de6455216a71_amadey_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader
Size 1.9MB
Sample261002-x2rd7sxaqa
SHA256 f55ef5e73e2cffe4946859bba7b1b06619ae9703b68662cffc72dbdbb986427d
MD5 171af21148e25cde2b32de6455216a71
SHA1 cc132937868b621eb440ed99489d9d5eb5b65c1e
SHA512 daa115e10a1bee9d226854492e0fb162bb35e25b8349e4a7eb20bf8bc506e12679ae12a6b368687d834d3afb0e7d5ad4b17ad93537bd135e733eaa778533a003
SSDEEP 49152:UlhMF76wCaWGOPGWVSiyMRYmJzxj8Ze0xj3tX9LoU2pWibFJrt+oH:UlhjwCXVGW+YbJzl8HxTt1Ufp
TLSH
T1D3950120B161C037CAE150714D68DB6A906BAEE80BDF5EDBB7D43D6D5E302C61B31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-01_171af21148e25cde2b32de6455216a71_amadey_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-10-01_171af21148e25cde2b32de6455216a71_amadey_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader

.exe 1.9MB

2026-10-01_171af21148e25cde2b32de6455216a71_amadey_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 2d17ef82b7614c3eb9f984cc3d8a4b3f
SHA256 f55ef5e73e2cffe4946859bba7b1b06619ae9703b68662cffc72dbdbb986427d
MD5 171af21148e25cde2b32de6455216a71
SHA1 cc132937868b621eb440ed99489d9d5eb5b65c1e
SHA512 daa115e10a1bee9d226854492e0fb162bb35e25b8349e4a7eb20bf8bc506e12679ae12a6b368687d834d3afb0e7d5ad4b17ad93537bd135e733eaa778533a003
SSDEEP 49152:UlhMF76wCaWGOPGWVSiyMRYmJzxj8Ze0xj3tX9LoU2pWibFJrt+oH:UlhjwCXVGW+YbJzl8HxTt1Ufp
TLSH
T1D3950120B161C037CAE150714D68DB6A906BAEE80BDF5EDBB7D43D6D5E302C61B31E26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d5:d5:53:fd:53:f1:67:f3:fa:0f:13:7d:71:1e:ba:b8:a2:4d:c8:7a:ff:9e:4c:29:cc:ae:6f:49:30:ba:35:33

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Oct 22, 2024

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2022 - Oct 17, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

252880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\poppyzhu\rep\QQPCMgrPackage\QQPCMgrPacket\bin\binfinal\KPacket.pdb

kernel32

HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetFileSize GetTickCount DeleteFileW MoveFileExW CopyFileW CreateFileMappingW MapViewOfFile UnmapViewOfFile WriteFile CreateDirectoryW GetLastError GetSystemDirectoryW ReadFile GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects MultiByteToWideChar WideCharToMultiByte GetWindowsDirectoryW SetFileTime SetFileAttributesW RemoveDirectoryW GetCurrentDirectoryW GetTempPathW GetTempFileNameW SetFilePointer SetEndOfFile FindNextFileW GetSystemInfo GetProcAddress GetModuleHandleW VirtualFree VirtualAlloc ReleaseSemaphore InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent ResetEvent CreateSemaphoreW GetModuleFileNameW CreateProcessW LoadLibraryW GetCurrentProcessId GetCurrentProcess TerminateProcess lstrcmpW ExpandEnvironmentStringsW GetCommandLineW InitializeCriticalSectionAndSpinCount RaiseException DecodePointer SystemTimeToFileTime LocalFileTimeToFileTime GetConsoleOutputCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA WriteConsoleW GetOEMCP GetACP CloseHandle CreateFileW FindClose FindFirstFileW GetFileAttributesW DeleteCriticalSection IsValidCodePage FindFirstFileExW GetFileSizeEx GetConsoleMode SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileType ExitProcess GetModuleHandleExW FreeLibraryAndExitThread IsDebuggerPresent OutputDebugStringW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetFileAttributesExW CreateThread ExitThread

user32

CharUpperW CharLowerW

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW

ole32

CoUninitialize CoInitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantCopy

shlwapi

PathRemoveFileSpecW PathAddBackslashW PathIsDirectoryW PathAppendW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_171af21148e25cde2b32de6455216a71_amadey_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic