2026-10-01_b0c54b4be3f90bb0cc39f6e3fe047eb0_amadey_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_b0c54b4be3f90bb0cc39f6e3fe047eb0_amadey_elex_luca-stealer_mespinoza_njrat
Size 1.9MB
Sample261003-x49csswbrf
SHA256 7e217ca1d69f87cbcedaa34de93f40d3d155eb91c09a287f6c3b087e42909591
MD5 b0c54b4be3f90bb0cc39f6e3fe047eb0
SHA1 35298831be4699ac9fa8403f99791df23204a9b7
SHA512 20e3c501209b8bb0e8540984986b98061dd97a62000ccd98626da4c0205373588f9190abd320c750996263b143bb950cd62c104571d592ae851b3c88c5769c21
SSDEEP 49152:S5+oKOhnEr+Qu/L1jy4Jul1Z0WCg/FkBhoDeuMgSGc:G+4h5Q6L1j5Jul1Zmx6FOG
TLSH
T1E995E002F141D0B6C8136271605DE33C3B699E4A4F664DC7C7E4FDF96AB05C21A36AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_b0c54b4be3f90bb0cc39f6e3fe047eb0_amadey_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-10-01_b0c54b4be3f90bb0cc39f6e3fe047eb0_amadey_elex_luca-stealer_mespinoza_njrat

.exe 1.9MB

2026-10-01_b0c54b4be3f90bb0cc39f6e3fe047eb0_amadey_elex_luca-stealer_mespinoza_njrat

IMPHASH e1ca66aa95630641de7ed55ec6886368
SHA256 7e217ca1d69f87cbcedaa34de93f40d3d155eb91c09a287f6c3b087e42909591
MD5 b0c54b4be3f90bb0cc39f6e3fe047eb0
SHA1 35298831be4699ac9fa8403f99791df23204a9b7
SHA512 20e3c501209b8bb0e8540984986b98061dd97a62000ccd98626da4c0205373588f9190abd320c750996263b143bb950cd62c104571d592ae851b3c88c5769c21
SSDEEP 49152:S5+oKOhnEr+Qu/L1jy4Jul1Z0WCg/FkBhoDeuMgSGc:G+4h5Q6L1j5Jul1Zmx6FOG
TLSH
T1E995E002F141D0B6C8136271605DE33C3B699E4A4F664DC7C7E4FDF96AB05C21A36AAE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

682832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

app_shell_launcher.exe.pdb

advapi32

CreateProcessAsUserW DuplicateToken GetTokenInformation OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath SetCurrentProcessExplicitAppUserModelID ShellExecuteA ShellExecuteExW

user32

AllowSetForegroundWindow CallNextHookEx FindWindowExW FindWindowW GetActiveWindow GetDesktopWindow GetDlgItem GetWindow GetWindowRect GetWindowTextLengthW GetWindowTextW LoadStringW MessageBoxW ScreenToClient SetDlgItemTextW SetWindowPos SetWindowsHookExW UnhookWindowsHookEx UnregisterClassW

winmm

timeGetTime

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileW CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DosDateTimeToFileTime DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeResource GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLocaleName GetVersionExW GetWindowsDirectoryW HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CLSIDFromString CoCreateInstance CoInitialize CoSetProxyBlanket CoTaskMemFree CoUninitialize IIDFromString

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathMatchSpecW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

Name

.text

Size

827KB

Virtual Size

827KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

174B

Characteristics

Name

.rsrc

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

789KB

Virtual Size

792KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_b0c54b4be3f90bb0cc39f6e3fe047eb0_amadey_elex_luca-stealer_mespinoza_njrat

advapi32

shell32

user32

winmm

kernel32

ole32

winhttp

userenv

shlwapi

oleaut32

netapi32

iphlpapi

generic