2026-10-21_6de409ce8cdc4492541366b6e02907ae_amadey_elex_expiro_luca-stealer_njrat_redline-stealer_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_6de409ce8cdc4492541366b6e02907ae_amadey_elex_expiro_luca-stealer_njrat_redline-stealer_smoke-loader
Size 1.4MB
Sample261022-2bbnaays4k
SHA256 b25b8ac60d5725e38a5ab3e083d3a25afef137b650492da3a1222839c8d33fb0
MD5 6de409ce8cdc4492541366b6e02907ae
SHA1 29edb3a4a134393ae160f643c672d58f211535ab
SHA512 9adfbcab44522fd4d738297ad6d7a67fe30761ad809a5c2656e43065d8cf2744f2946376c1489a07e76426d82cb6d5c2f35e630d4cb1f768b02c2fe4129b0eaa
SSDEEP 24576:Payv/M7y6sqjnhMgeiCl7G0nehbGZpbD:iyHM7yODmg27RnWGj
TLSH
T19965F1207581C037E472143249B8EBB6983EBD315F2049DBA3D45EBEDE306D19B35A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_6de409ce8cdc4492541366b6e02907ae_amadey_elex_expiro_luca-stealer_njrat_redline-stealer_smoke-loader

File Explorer

2026-10-21_6de409ce8cdc4492541366b6e02907ae_amadey_elex_expiro_luca-stealer_njrat_redline-stealer_smoke-loader

.exe 1.4MB

2026-10-21_6de409ce8cdc4492541366b6e02907ae_amadey_elex_expiro_luca-stealer_njrat_redline-stealer_smoke-loader

IMPHASH 57e905e000761bf18445a4116ce84827
SHA256 b25b8ac60d5725e38a5ab3e083d3a25afef137b650492da3a1222839c8d33fb0
MD5 6de409ce8cdc4492541366b6e02907ae
SHA1 29edb3a4a134393ae160f643c672d58f211535ab
SHA512 9adfbcab44522fd4d738297ad6d7a67fe30761ad809a5c2656e43065d8cf2744f2946376c1489a07e76426d82cb6d5c2f35e630d4cb1f768b02c2fe4129b0eaa
SSDEEP 24576:Payv/M7y6sqjnhMgeiCl7G0nehbGZpbD:iyHM7yODmg27RnWGj
TLSH
T19965F1207581C037E472143249B8EBB6983EBD315F2049DBA3D45EBEDE306D19B35A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\out\Release\RadminVPN\x86\RvGuiStarter.pdb

kernel32

MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CloseHandle SetEvent ResetEvent WaitForSingleObject SetLastError OpenEventW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTime GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection Sleep CreateEventW WriteConsoleW SetEndOfFile HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW GetTempPathW RtlCaptureContext CreateFileW SetUnhandledExceptionFilter InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW GetCurrentProcess CreateThread GetCurrentThreadId GetProcessId VirtualQueryEx FreeLibrary GetProcAddress LoadLibraryW WriteFile SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW WaitForMultipleObjects GetCurrentProcessId InitializeCriticalSectionEx GetModuleHandleW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle HeapAlloc HeapFree GetFileType HeapReAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx GetLastError

shell32

ShellExecuteW

wininet

HttpAddRequestHeadersW HttpOpenRequestW HttpSendRequestW HttpQueryInfoW InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW InternetCrackUrlW InternetQueryDataAvailable InternetSetOptionW

msi

ord205 ord70

advapi32

RegGetValueW RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_6de409ce8cdc4492541366b6e02907ae_amadey_elex_expiro_luca-stealer_njrat_redline-stealer_smoke-loader

kernel32

shell32

wininet

msi

advapi32

generic