2026-10-19_330468026c30984318a8964556b2c402_amadey_elex_luca-stealer_mespinoza_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_330468026c30984318a8964556b2c402_amadey_elex_luca-stealer_mespinoza_njrat_smoke-loader
Size 1.8MB
Sample261020-3xhjdsgv21
SHA256 22da7d55c6b6342bf0c91fcde08bbb0caf6f5e78fe1d29c5d6811fd9973ab7fd
MD5 330468026c30984318a8964556b2c402
SHA1 4b93ba50a47480b76f858f1f93cec99f638ea984
SHA512 c44eadb69c6782e880838025f0d0b4453ffcce4dedd9633422c2ab0526737c44d49fa4900324f6a4bc70e52b88f1341fe3973918a25ac29897feb2b36c560555
SSDEEP 12288:JE+SVmuPkzv2Urmc0ZJiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9M:JnJzecmpjCMO//35gUKSJozCh9bEG
TLSH
T1DF8502107A41C072D4B110360A79AA66653C7AB00FA55AEFA7D92B2DDE742C0FF31F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_330468026c30984318a8964556b2c402_amadey_elex_luca-stealer_mespinoza_njrat_smoke-loader

File Explorer

2026-10-19_330468026c30984318a8964556b2c402_amadey_elex_luca-stealer_mespinoza_njrat_smoke-loader

.exe 1.8MB

2026-10-19_330468026c30984318a8964556b2c402_amadey_elex_luca-stealer_mespinoza_njrat_smoke-loader

IMPHASH 52a76508907c6c9f32e6d684415b4afd
SHA256 22da7d55c6b6342bf0c91fcde08bbb0caf6f5e78fe1d29c5d6811fd9973ab7fd
MD5 330468026c30984318a8964556b2c402
SHA1 4b93ba50a47480b76f858f1f93cec99f638ea984
SHA512 c44eadb69c6782e880838025f0d0b4453ffcce4dedd9633422c2ab0526737c44d49fa4900324f6a4bc70e52b88f1341fe3973918a25ac29897feb2b36c560555
SSDEEP 12288:JE+SVmuPkzv2Urmc0ZJiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9M:JnJzecmpjCMO//35gUKSJozCh9bEG
TLSH
T1DF8502107A41C072D4B110360A79AA66653C7AB00FA55AEFA7D92B2DDE742C0FF31F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82153

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\DUOWAN_BUILD\build\Build_Src\dwinternal\AudioFit_1.1rel_mb\bin\Release\AudioFitExt.pdb

kernel32

GetProcAddress GetModuleHandleW CloseHandle GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar LoadLibraryW DecodePointer HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection CreateFileW GetFileAttributesW DeleteFileW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId SetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameA ResetEvent ReleaseMutex WaitForSingleObject GetFileSize WriteFile ReadFile SetEndOfFile SetFilePointer GetLocalTime MapViewOfFile UnmapViewOfFile CreateMutexW CreateEventW CreateFileMappingW GetCommandLineW GetEnvironmentVariableW CopyFileW MoveFileW HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID GetLastError SetStdHandle WriteConsoleW FlushFileBuffers SetEvent IsValidLocale GetConsoleCP ReadConsoleW GetConsoleMode GetFileType GetACP ExitProcess GetStdHandle FreeLibraryAndExitThread ExitThread CreateThread WideCharToMultiByte GetStringTypeW EncodePointer GetCPInfo LCMapStringW GetLocaleInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead OutputDebugStringW RtlUnwind FreeLibrary LoadLibraryExW

user32

LoadStringW LoadCursorW MsgWaitForMultipleObjects CreateWindowExW RegisterClassExW DefWindowProcW SendMessageW PeekMessageW DispatchMessageW TranslateMessage

advapi32

RegEnumKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW ord165 CommandLineToArgvW

ole32

CoUninitialize CoInitialize CoCreateInstance CLSIDFromString

shlwapi

PathFindFileNameW PathAppendW

Name

.text

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

400B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_330468026c30984318a8964556b2c402_amadey_elex_luca-stealer_mespinoza_njrat_smoke-loader

kernel32

user32

advapi32

shell32

ole32

shlwapi

generic