2026-10-19_35806fbb5ad28a33eea09fa53ca2fee2_amadey_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-10-19_35806fbb5ad28a33eea09fa53ca2fee2_amadey_elex_luca-stealer_njrat_smoke-loader
Size 1.6MB
Sample261020-3mae2agt7x
SHA256 646746bec74f4e47728eeed58b6c41a7dbbcd03c9c86c129cffd6c5ab363f3d0
MD5 35806fbb5ad28a33eea09fa53ca2fee2
SHA1 03c486c98656371d6be4096fe71991997ab8f8aa
SHA512 8d927d455c29ea69a57a3971b64cc61eb6e9f9f5abe93c8af10fecd4c21dc5213780a82a24a25a5fe8697f939f89ade22bff87f54ab7e68f88d312b409bd4e74
SSDEEP 49152:ukBPeer9DWoRGw7uOMkBjxFT6fNarSj8RoTCCW:LV5lWbwqOMkJxFufNJTy
TLSH
T193851212FF81C032D96306705E7AEBB5992EBE740F6154CB63E42E9E85306D25B36B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_35806fbb5ad28a33eea09fa53ca2fee2_amadey_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-19_35806fbb5ad28a33eea09fa53ca2fee2_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 1.6MB

2026-10-19_35806fbb5ad28a33eea09fa53ca2fee2_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH 8d7c7413f201faeef2694eadb233d159
SHA256 646746bec74f4e47728eeed58b6c41a7dbbcd03c9c86c129cffd6c5ab363f3d0
MD5 35806fbb5ad28a33eea09fa53ca2fee2
SHA1 03c486c98656371d6be4096fe71991997ab8f8aa
SHA512 8d927d455c29ea69a57a3971b64cc61eb6e9f9f5abe93c8af10fecd4c21dc5213780a82a24a25a5fe8697f939f89ade22bff87f54ab7e68f88d312b409bd4e74
SSDEEP 49152:ukBPeer9DWoRGw7uOMkBjxFT6fNarSj8RoTCCW:LV5lWbwqOMkJxFufNJTy
TLSH
T193851212FF81C032D96306705E7AEBB5992EBE740F6154CB63E42E9E85306D25B36B07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

141696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32exe.pdb

kernel32

SetLastError GetModuleFileNameW GetLastError GetWindowsDirectoryW LocalFree GetModuleFileNameA LoadLibraryA GetProcAddress FreeLibrary SetWaitableTimer CreateWaitableTimerW CloseHandle OpenMutexW CreateEventW SetEvent WriteFile SetFilePointer CreateMutexW WaitForSingleObject CreateFileW GetCurrentThreadId ReleaseMutex GetLocalTime GetCurrentProcessId GetCommandLineW GetCurrentProcess LoadLibraryExA GetModuleHandleA GetSystemDirectoryA DeviceIoControl LocalAlloc FormatMessageW EnterCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive WideCharToMultiByte FormatMessageA GetFileAttributesW GetSystemDirectoryW LoadLibraryExW VerSetConditionMask VerifyVersionInfoW IsWow64Process SetSearchPathMode SetDllDirectoryW HeapSetInformation SetProcessDEPPolicy RaiseException GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW QueryPerformanceCounter QueryPerformanceFrequency SleepConditionVariableSRW Sleep MultiByteToWideChar GetStringTypeW InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WakeAllConditionVariable IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW

Name

.text

Size

256KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_35806fbb5ad28a33eea09fa53ca2fee2_amadey_elex_luca-stealer_njrat_smoke-loader

kernel32

generic