2026-10-21_8da703358b255a8581bd8f2291662841_amadey_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_8da703358b255a8581bd8f2291662841_amadey_elex_luca-stealer_njrat_smoke-loader
Size 4.1MB
Sample261022-wl6crawv8l
SHA256 6e0738a6956a27877d49e3860b381f4490ff7d16e6fe62997f823163ac895e81
MD5 8da703358b255a8581bd8f2291662841
SHA1 e62f89da6d6ada3773a75ae97d6a4ae9d358c7b7
SHA512 a1d4eb3a4855a3d9386e5bb3f46ae4d79f5e11e208e577bc7368e95e56f51ae97f301ae58db12533b7c4f58e1f9513feaee02351362f5827ec8125355e31a833
SSDEEP 49152:ERLzt6DPwtK5+51K+nI5w+Etqm5BKTXCUOj1U/DAOojgxvasTWvDQ3+qP8qrTJ16:M4JbOpUkfjgxysTWvUA16
TLSH
T196162930EA429029FCF700F79EFE5AAD652CF6A04B5864D791C819CD8A56BE13D312D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_8da703358b255a8581bd8f2291662841_amadey_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-21_8da703358b255a8581bd8f2291662841_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 4.1MB

2026-10-21_8da703358b255a8581bd8f2291662841_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH fb1457dcde25cfa39a71b2b96dd1655b
SHA256 6e0738a6956a27877d49e3860b381f4490ff7d16e6fe62997f823163ac895e81
MD5 8da703358b255a8581bd8f2291662841
SHA1 e62f89da6d6ada3773a75ae97d6a4ae9d358c7b7
SHA512 a1d4eb3a4855a3d9386e5bb3f46ae4d79f5e11e208e577bc7368e95e56f51ae97f301ae58db12533b7c4f58e1f9513feaee02351362f5827ec8125355e31a833
SSDEEP 49152:ERLzt6DPwtK5+51K+nI5w+Etqm5BKTXCUOj1U/DAOojgxvasTWvDQ3+qP8qrTJ16:M4JbOpUkfjgxysTWvUA16
TLSH
T196162930EA429029FCF700F79EFE5AAD652CF6A04B5864D791C819CD8A56BE13D312D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\user\Documents\Project1\NativeCPP\build\msvc-x86-debug\tests\cancel-grace-probe\Debug\ncpp_integration_cancel_grace.pdb

rpcrt4

UuidCreate

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetCurrentDirectoryW GetStdHandle GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCommandLineA

api-ms-win-core-file-l1-1-0

FlushFileBuffers GetFileType DeleteFileW SetFilePointerEx SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW SetFileTime CreateFileW GetFileSizeEx GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW WriteFile ReadFile GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW SetEndOfFile

api-ms-win-core-handle-l1-1-0

SetHandleInformation CloseHandle

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive CreateEventW WaitForSingleObjectEx WaitForSingleObject CreateSemaphoreExW CreateEventExW ReleaseSRWLockExclusive DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetEvent InitializeCriticalSectionAndSpinCount TryAcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive

api-ms-win-core-processthreads-l1-1-0

UpdateProcThreadAttribute SetThreadStackGuarantee GetCurrentProcessId GetCurrentThread GetCurrentProcess TerminateProcess GetExitCodeProcess GetExitCodeThread GetCurrentThreadId DeleteProcThreadAttributeList TlsAlloc TlsGetValue TlsSetValue TlsFree InitializeProcThreadAttributeList SwitchToThread FlushProcessWriteBuffers ResumeThread GetStartupInfoW CreateThread ExitThread CreateProcessW ExitProcess

api-ms-win-core-job-l2-1-0

CreateJobObjectW SetInformationJobObject AssignProcessToJobObject

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo SetConsoleTextAttribute

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter RaiseException UnhandledExceptionFilter SetLastError GetLastError

api-ms-win-core-synch-l1-2-0

Sleep WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitOnceExecuteOnce

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime GetSystemTimeAsFileTime GetSystemInfo GetTickCount64

api-ms-win-core-namedpipe-l1-1-0

CreatePipe PeekNamedPipe

kernel32

TerminateJobObject

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

LCMapStringEx GetACP IsValidCodePage EnumSystemLocalesW GetOEMCP IsValidLocale GetLocaleInfoEx GetLocaleInfoW LCMapStringW FormatMessageA GetUserDefaultLCID GetCPInfo

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetProcAddress FreeLibrary GetModuleHandleExW LoadLibraryExW GetModuleFileNameW FreeLibraryAndExitThread

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l2-1-0

CreateSymbolicLinkW MoveFileExW CreateDirectoryExW CreateHardLinkW GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-string-l1-1-0

CompareStringEx MultiByteToWideChar GetStringTypeW CompareStringW WideCharToMultiByte

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumber IsProcessorFeaturePresent

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWait FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolWait CreateThreadpoolWait SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead InterlockedFlushSList

api-ms-win-core-heap-l1-1-0

HeapReAlloc HeapFree HeapSize HeapQueryInformation HeapValidate GetProcessHeap HeapAlloc

api-ms-win-core-memory-l1-1-0

VirtualProtect VirtualQuery

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP GetConsoleMode SetConsoleCtrlHandler ReadConsoleW WriteConsoleW

api-ms-win-core-fibers-l1-1-0

FlsFree FlsAlloc FlsSetValue FlsGetValue

api-ms-win-core-fibers-l1-1-1

IsThreadAFiber

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

493KB

Virtual Size

492KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

409B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_8da703358b255a8581bd8f2291662841_amadey_elex_luca-stealer_njrat_smoke-loader

rpcrt4

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-job-l2-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

kernel32

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-timezone-l1-1-0

generic