2026-10-10_3f7cc16d908ce12670f1066289cf6ff5_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_3f7cc16d908ce12670f1066289cf6ff5_amadey_elex_luca-stealer_lynx_njrat
Size 1.4MB
Sample261011-tpbw7sda33
SHA256 e1c8bace7d46dbc65617d065e92cd6eb423c35d64d25c516455d497ab3b7c212
MD5 3f7cc16d908ce12670f1066289cf6ff5
SHA1 444ad5747d515aef0bdfff5d2b83af13c3559337
SHA512 8e9b899b2949f11273cf8a6e4b5b3480f5f081290ec24b3337cc585bd965b4af3b05dda180c9971e22f341e70fd2d749a258fefa4f32ef89cc6e82f08877430d
SSDEEP 24576:/Mscdopa/xJPlaH0/0TMcuiywha+NDBLDjgN+sOOEBG3jsxteECG2OSh/WwOVcFj:/MsmPlaHTTWiywha+NBXtXBIus/WHX
TLSH
T10B65E0207682813AD9710171663CDBBB257EFB314F66A8D793C44EBA58745C12F38B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_3f7cc16d908ce12670f1066289cf6ff5_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-10-10_3f7cc16d908ce12670f1066289cf6ff5_amadey_elex_luca-stealer_lynx_njrat

.exe 1.4MB

2026-10-10_3f7cc16d908ce12670f1066289cf6ff5_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 5d45bd7311f6c829254fe087edb52959
SHA256 e1c8bace7d46dbc65617d065e92cd6eb423c35d64d25c516455d497ab3b7c212
MD5 3f7cc16d908ce12670f1066289cf6ff5
SHA1 444ad5747d515aef0bdfff5d2b83af13c3559337
SHA512 8e9b899b2949f11273cf8a6e4b5b3480f5f081290ec24b3337cc585bd965b4af3b05dda180c9971e22f341e70fd2d749a258fefa4f32ef89cc6e82f08877430d
SSDEEP 24576:/Mscdopa/xJPlaH0/0TMcuiywha+NDBLDjgN+sOOEBG3jsxteECG2OSh/WwOVcFj:/MsmPlaHTTWiywha+NBXtXBIus/WHX
TLSH
T10B65E0207682813AD9710171663CDBBB257EFB314F66A8D793C44EBA58745C12F38B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

325320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\964624\out\Release\360zipUpdate.pdb

kernel32

HeapDestroy GetFileSize DeleteCriticalSection GetProcessHeap ReadFile GetFileSizeEx GetPrivateProfileIntW DeviceIoControl GetTempPathW FreeResource DeleteFileW GetSystemWindowsDirectoryW GetCPInfoExW ResumeThread OutputDebugStringW ExitProcess SuspendThread FlushInstructionCache SetThreadContext SetEndOfFile MoveFileExW SetThreadLocale LockResource WritePrivateProfileStringW FindResourceW GetTempFileNameW lstrcmpiW GetPrivateProfileStringA InitializeCriticalSection WriteConsoleW ReadConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetConsoleMode GetConsoleOutputCP SetStdHandle IsValidLocale GetStdHandle FreeLibraryAndExitThread ExitThread GetFileType RtlUnwind GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsSetValue TlsGetValue TlsAlloc HeapWalk HeapUnlock HeapLock SetFilePointerEx CreateFileA LocalFileTimeToFileTime GetCPInfo IsDebuggerPresent GetCurrentThread GetVersion FindClose SetFilePointer LoadResource GetPrivateProfileStringW WriteFile FindNextFileW GetCommandLineW SizeofResource EnumSystemLocalesW GetUserDefaultLCID GetSystemDefaultLCID GetThreadLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeZoneInformation SystemTimeToFileTime MulDiv LocalFree GetProcAddress GetModuleHandleW GetModuleFileNameW ExpandEnvironmentStringsW FindResourceExW FreeLibrary UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GetThreadContext CreateProcessW GetCurrentThreadId CreateThread TerminateProcess GetCurrentProcessId GetCurrentProcess WaitForMultipleObjects Sleep CreateEventW CreateMutexW WaitForSingleObject ReleaseMutex SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException AreFileApisANSI FindFirstFileW CreateFileW GetCurrentDirectoryW FlushFileBuffers

user32

MoveWindow GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IntersectRect LoadCursorW LoadMenuW IsWindowVisible SetWindowRgn ScreenToClient GetShellWindow WindowFromPoint TrackPopupMenu GetSubMenu IsWindow OffsetRect GetWindowInfo GetForegroundWindow DestroyMenu LoadIconW DrawTextW KillTimer GetDesktopWindow InvalidateRect GetAncestor GetCursorPos CreateDialogParamW GetWindow SetWindowPos EndDialog SetWindowTextW PeekMessageW CharNextW GetClientRect GetDlgItem DestroyWindow SetTimer MapWindowPoints GetWindowLongW SetWindowLongW FindWindowExW GetSystemMetrics GetDC ReleaseDC GetParent DialogBoxParamW BeginPaint EndPaint GetLastInputInfo MessageBoxW GetActiveWindow ShowWindow SetForegroundWindow wsprintfW UnregisterClassW GetMonitorInfoW MonitorFromWindow LoadImageW GetWindowThreadProcessId GetWindowRect

gdi32

CreateFontW DeleteDC CreateSolidBrush DeleteObject CreateRoundRectRgn SelectObject SetStretchBltMode GetObjectW GetDeviceCaps CreateCompatibleDC CreateDIBSection SetBkMode

advapi32

RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW OpenProcessToken RegQueryInfoKeyW RegEnumKeyExW

shell32

ord165 ShellExecuteW ord680 ShellExecuteExW Shell_NotifyIconW SHGetSpecialFolderPathW CommandLineToArgvW

ole32

CoTaskMemRealloc OleInitialize CoCreateInstance OleUninitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

SysStringByteLen SysFreeString VarUI4FromStr SysStringLen VariantInit SysAllocStringByteLen VariantClear SysAllocString

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW StrCmpIW SHGetValueW PathIsRelativeW SHSetValueW PathAddBackslashW PathFileExistsW PathAppendW StrStrIA PathFindFileNameW

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW GetModuleBaseNameW

Name

.text

Size

505KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

791KB

Virtual Size

792KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_3f7cc16d908ce12670f1066289cf6ff5_amadey_elex_luca-stealer_lynx_njrat

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

generic