General
- Target 2026-10-06_90d2e0c28fd798dd2d87697be337cd73_amadey_elex_luca-stealer_njrat_play
- Size 4.0MB
- Sample261007-3e33daxtey
- SHA256 8ce037e578b20ca886eef2667c3723f9df77e84fe68528778e1ac6095cd7c999
- MD5 90d2e0c28fd798dd2d87697be337cd73
- SHA1 62e696672757e65d00ecbd2a83300f1c03e5be32
- SHA512 18c498a2c041fd402e44db0c77373c006a04d0e18e9eac3d1cc7a95719c43ff21a273ddb37ec79b040b91bce246d5370c8e94e53d648011a6447274cca15f7cc
- SSDEEP 49152:sVgmGkgXNiypE8+2BFTqpmk6U2ezM0w2Dy2I/CV8ahItL0LMpl7v5Gd5fqShLV8p:Xm04oEaOmk6U2eNwIrqJtLFNv5sfjap
- TLSH T1F616F1213F719D38CD4671760D688BE76619AC313F6F53827E0C7B9298224FF62E4962
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-06_90d2e0c28fd798dd2d87697be337cd73_amadey_elex_luca-stealer_njrat_play.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-06_90d2e0c28fd798dd2d87697be337cd73_amadey_elex_luca-stealer_njrat_play.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-06_90d2e0c28fd798dd2d87697be337cd73_amadey_elex_luca-stealer_njrat_play
- Size 4.0MB
- SHA256 8ce037e578b20ca886eef2667c3723f9df77e84fe68528778e1ac6095cd7c999
- MD5 90d2e0c28fd798dd2d87697be337cd73
- SHA1 62e696672757e65d00ecbd2a83300f1c03e5be32
- SHA512 18c498a2c041fd402e44db0c77373c006a04d0e18e9eac3d1cc7a95719c43ff21a273ddb37ec79b040b91bce246d5370c8e94e53d648011a6447274cca15f7cc
- SSDEEP 49152:sVgmGkgXNiypE8+2BFTqpmk6U2ezM0w2Dy2I/CV8ahItL0LMpl7v5Gd5fqShLV8p:Xm04oEaOmk6U2eNwIrqJtLFNv5sfjap
- TLSH T1F616F1213F719D38CD4671760D688BE76619AC313F6F53827E0C7B9298224FF62E4962
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.