2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat

General

Target
2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat
Size 1.7MB
Sample261011-dew7dscg33
SHA256 40d096d5663d12e993ce098a19d392e1660d11a8a18d6f38b9de1e63134a2e55
MD5 c51a79e5c6dac5659a15720e1a3d56b8
SHA1 6778a7f7a75aa54b7e7354046b8481b145f88287
SHA512 ff5f5d1897ac58bba3a3b4e34faf4202efc605a59853228b1fa438eb72c230bd377df26825817a62294bc1f52ad35311346316b710cd2000a69fac00ba57ea38
SSDEEP 49152:0k46/fl+CrLR+ft983Dl3gEe8xA+y+bHNvPZumqUIWPLXFKo:r/f0CvR+l9EDl3VxA+y6umqU1LVKo
TLSH
T131851210FC41E032D0A205B0DB65DAF35938AD61AB5494C3F3E07DB6BA349E1663DB6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat

.exe 1.7MB

2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 1df7cfa71495a8d5833182c6005b7af9
SHA256 40d096d5663d12e993ce098a19d392e1660d11a8a18d6f38b9de1e63134a2e55
MD5 c51a79e5c6dac5659a15720e1a3d56b8
SHA1 6778a7f7a75aa54b7e7354046b8481b145f88287
SHA512 ff5f5d1897ac58bba3a3b4e34faf4202efc605a59853228b1fa438eb72c230bd377df26825817a62294bc1f52ad35311346316b710cd2000a69fac00ba57ea38
SSDEEP 49152:0k46/fl+CrLR+ft983Dl3gEe8xA+y+bHNvPZumqUIWPLXFKo:r/f0CvR+l9EDl3VxA+y6umqU1LVKo
TLSH
T131851210FC41E032D0A205B0DB65DAF35938AD61AB5494C3F3E07DB6BA349E1663DB6E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\Harlan\Ventoy\Plugson\vs\VentoyPlugson\Release\VentoyPlugson.pdb

kernel32

GetLogicalDrives CreateMutexA WaitForSingleObject ReleaseMutex DeleteFileA CloseHandle ReadFile GetFileInformationByHandleEx WriteFile DeviceIoControl GetUserDefaultUILanguage GetVolumeInformationA CreateFileW GetFileAttributesW MultiByteToWideChar CopyFileA GetLastError GetFileAttributesA CreateFileA SetEvent CreateThread SetFilePointerEx GetFileSize WideCharToMultiByte CreateEventA FlushFileBuffers CreateDirectoryW FindFirstFileW SetHandleInformation TlsSetValue SetLastError EnterCriticalSection FindNextFileW GetLongPathNameW GetCurrentProcess TerminateProcess SetThreadPriority LeaveCriticalSection InitializeCriticalSection GetFullPathNameA FindClose GetCurrentThreadId DuplicateHandle GetVersion Sleep GetFileAttributesExW GetCurrentThread TlsAlloc QueryPerformanceFrequency DeleteFileW RaiseException LoadLibraryW GetProcAddress DeleteCriticalSection FreeLibrary TlsGetValue CreateProcessA GetSystemTimeAsFileTime TlsFree QueryPerformanceCounter MoveFileA LoadLibraryExA GetModuleFileNameW GetCurrentDirectoryA SetCurrentDirectoryA SetDllDirectoryA GetCurrentDirectoryW SetCurrentDirectoryW CreateDirectoryA WriteConsoleW SetEndOfFile HeapSize GetProcessHeap GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFullPathNameW DecodePointer GetExitCodeProcess HeapReAlloc GetConsoleOutputCP RemoveDirectoryW GetFileSizeEx LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation HeapAlloc HeapFree GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryExW SetStdHandle GetFileType ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleMode ReadConsoleW CreateProcessW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreatePipe GetCommandLineA GetCommandLineW GetStdHandle ExitProcess

user32

GetDlgItem LoadIconA SendMessageA DialogBoxParamA SetWindowTextW EndDialog MessageBoxW EnableWindow

ws2_32

WSAStartup getsockname send socket ntohs shutdown htons ioctlsocket getnameinfo setsockopt listen ntohl select closesocket bind accept __WSAFDIsSet WSACleanup recv htonl

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat

kernel32

user32

ws2_32

generic