2026-10-10_2aa9a1791418564e3b0edc7447fb1381_amadey_elex_luca-stealer_lynx_njrat

General

Target
2026-10-10_2aa9a1791418564e3b0edc7447fb1381_amadey_elex_luca-stealer_lynx_njrat
Size 1.5MB
Sample261011-wt84lsvvdv
SHA256 f43c65e18647daa41a77f0c9db46208d5a018126addf99c21667ee5213a49c6f
MD5 2aa9a1791418564e3b0edc7447fb1381
SHA1 92c58a18e634453bf9112f0a4fec776af1300880
SHA512 3d621a9d2e1f04e1bd60bc150fd42e6f039597954564c6012513ed2e659bc84674abf4f5d2a418f0b2166aac67cd6f979747650f625a58c9f719ddaec1655cb8
SSDEEP 49152:ufLqPfASkaA/zZT4RwR+ft983Dl3gEe8xA+:ufmL1A/2iR+l9EDl3VxA+
TLSH
T1D57523223A95C433EA2650750D55DBB3997CD90C5FA028EBE3942F2ECC351E25E31B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_2aa9a1791418564e3b0edc7447fb1381_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-10-10_2aa9a1791418564e3b0edc7447fb1381_amadey_elex_luca-stealer_lynx_njrat

.exe 1.5MB

2026-10-10_2aa9a1791418564e3b0edc7447fb1381_amadey_elex_luca-stealer_lynx_njrat

IMPHASH e8288d19aa9c564e8f16f3a52bc88d54
SHA256 f43c65e18647daa41a77f0c9db46208d5a018126addf99c21667ee5213a49c6f
MD5 2aa9a1791418564e3b0edc7447fb1381
SHA1 92c58a18e634453bf9112f0a4fec776af1300880
SHA512 3d621a9d2e1f04e1bd60bc150fd42e6f039597954564c6012513ed2e659bc84674abf4f5d2a418f0b2166aac67cd6f979747650f625a58c9f719ddaec1655cb8
SSDEEP 49152:ufLqPfASkaA/zZT4RwR+ft983Dl3gEe8xA+:ufmL1A/2iR+l9EDl3VxA+
TLSH
T1D57523223A95C433EA2650750D55DBB3997CD90C5FA028EBE3942F2ECC351E25E31B6E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

97280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\vscodium\vscodium\vscode\node_modules\node-pty\build\Release\winpty-agent.pdb

kernel32

GetConsoleCP LoadLibraryW GetProcAddress FreeLibrary SetConsoleMode GetConsoleMode GetTickCount GenerateConsoleCtrlEvent ReadConsoleInputW WaitForMultipleObjects Sleep ReadFile CancelIo WriteFile CreateNamedPipeW CreateFileW CreateEventW ResetEvent GetOverlappedResult ConnectNamedPipe GetConsoleCursorInfo GetConsoleTitleW GetConsoleWindow SetConsoleTitleW GetConsoleScreenBufferInfo GetConsoleOutputCP SetConsoleScreenBufferSize SetConsoleWindowInfo CreateConsoleScreenBuffer FillConsoleOutputCharacterW ReadConsoleOutputW FillConsoleOutputAttribute SetConsoleCursorPosition WriteConsoleOutputW GetCommandLineW GetCurrentThreadId GetModuleFileNameA SetNamedPipeHandleState SetLastError GetEnvironmentVariableA GetCurrentProcessId TransactNamedPipe GetSystemTimeAsFileTime WaitNamedPipeW WideCharToMultiByte LocalAlloc GetCurrentThread LocalFree GetVersionExW GetSystemDirectoryW WriteConsoleW CreateProcessW WriteConsoleInputW CloseHandle GetConsoleProcessList GetLargestConsoleWindowSize GetLastError DuplicateHandle WaitForSingleObject GetStdHandle GetCurrentProcess SetConsoleCtrlHandler SetConsoleTextAttribute GetModuleHandleW DecodePointer HeapReAlloc HeapSize GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind RaiseException EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCommandLineA HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW FlushFileBuffers GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW

advapi32

SetSecurityDescriptorDacl AllocateAndInitializeSid SetEntriesInAclW OpenProcessToken FreeSid InitializeSecurityDescriptor OpenThreadToken GetTokenInformation CryptAcquireContextW CryptGenRandom CryptReleaseContext

shell32

CommandLineToArgvW

user32

CloseDesktop CreateDesktopW SetProcessWindowStation GetUserObjectInformationW PostMessageW CreateWindowStationW MapVirtualKeyW SendMessageW VkKeyScanW GetDoubleClickTime CloseWindowStation GetProcessWindowStation

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_2aa9a1791418564e3b0edc7447fb1381_amadey_elex_luca-stealer_lynx_njrat

kernel32

advapi32

shell32

user32

generic