2026-10-22_0a7320cb4787c24f8021ffad0e1f84a0_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_0a7320cb4787c24f8021ffad0e1f84a0_amadey_elex_luca-stealer_lynx_njrat
Size 1.4MB
Sample261024-151c3acx2x
SHA256 8bcd7bc2e543c246d953bcb78286c73a73e3593bc3f6c81962fcf57270888aa0
MD5 0a7320cb4787c24f8021ffad0e1f84a0
SHA1 e57bce31893f482b0174b9a7f18eda16b9a5c14f
SHA512 3713c79f5ffd961005b385e7537cdb1d2b102a361d8b502f71d5f566478056ea1597172a0d0f31c26d8f8215aab75930cac70ea7e32c8d5f7e413d57c441a119
SSDEEP 24576:EMscdopa/xJPlaH0/0TMcuiywhabQr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywd:EMsmPlaHTTWiywhayPT7tRIpCcP1IPoT
TLSH
T1E665E020B682813BD9711031656CDBB7653EFA314FA6A8CB93C45FBA58345C12F39B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_0a7320cb4787c24f8021ffad0e1f84a0_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-10-22_0a7320cb4787c24f8021ffad0e1f84a0_amadey_elex_luca-stealer_lynx_njrat

.exe 1.4MB

2026-10-22_0a7320cb4787c24f8021ffad0e1f84a0_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 5d45bd7311f6c829254fe087edb52959
SHA256 8bcd7bc2e543c246d953bcb78286c73a73e3593bc3f6c81962fcf57270888aa0
MD5 0a7320cb4787c24f8021ffad0e1f84a0
SHA1 e57bce31893f482b0174b9a7f18eda16b9a5c14f
SHA512 3713c79f5ffd961005b385e7537cdb1d2b102a361d8b502f71d5f566478056ea1597172a0d0f31c26d8f8215aab75930cac70ea7e32c8d5f7e413d57c441a119
SSDEEP 24576:EMscdopa/xJPlaH0/0TMcuiywhabQr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywd:EMsmPlaHTTWiywhayPT7tRIpCcP1IPoT
TLSH
T1E665E020B682813BD9711031656CDBB7653EFA314FA6A8CB93C45FBA58345C12F39B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

325320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\964624\out\Release\360zipUpdate.pdb

kernel32

HeapDestroy GetFileSize DeleteCriticalSection GetProcessHeap ReadFile GetFileSizeEx GetPrivateProfileIntW DeviceIoControl GetTempPathW FreeResource DeleteFileW GetSystemWindowsDirectoryW GetCPInfoExW ResumeThread OutputDebugStringW ExitProcess SuspendThread FlushInstructionCache SetThreadContext SetEndOfFile MoveFileExW SetThreadLocale LockResource WritePrivateProfileStringW FindResourceW GetTempFileNameW lstrcmpiW GetPrivateProfileStringA InitializeCriticalSection WriteConsoleW ReadConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetConsoleMode GetConsoleOutputCP SetStdHandle IsValidLocale GetStdHandle FreeLibraryAndExitThread ExitThread GetFileType RtlUnwind GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsSetValue TlsGetValue TlsAlloc HeapWalk HeapUnlock HeapLock SetFilePointerEx CreateFileA LocalFileTimeToFileTime GetCPInfo IsDebuggerPresent GetCurrentThread GetVersion FindClose SetFilePointer LoadResource GetPrivateProfileStringW WriteFile FindNextFileW GetCommandLineW SizeofResource EnumSystemLocalesW GetUserDefaultLCID GetSystemDefaultLCID GetThreadLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeZoneInformation SystemTimeToFileTime MulDiv LocalFree GetProcAddress GetModuleHandleW GetModuleFileNameW ExpandEnvironmentStringsW FindResourceExW FreeLibrary UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GetThreadContext CreateProcessW GetCurrentThreadId CreateThread TerminateProcess GetCurrentProcessId GetCurrentProcess WaitForMultipleObjects Sleep CreateEventW CreateMutexW WaitForSingleObject ReleaseMutex SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException AreFileApisANSI FindFirstFileW CreateFileW GetCurrentDirectoryW FlushFileBuffers

user32

MoveWindow GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IntersectRect LoadCursorW LoadMenuW IsWindowVisible SetWindowRgn ScreenToClient GetShellWindow WindowFromPoint TrackPopupMenu GetSubMenu IsWindow OffsetRect GetWindowInfo GetForegroundWindow DestroyMenu LoadIconW DrawTextW KillTimer GetDesktopWindow InvalidateRect GetAncestor GetCursorPos CreateDialogParamW GetWindow SetWindowPos EndDialog SetWindowTextW PeekMessageW CharNextW GetClientRect GetDlgItem DestroyWindow SetTimer MapWindowPoints GetWindowLongW SetWindowLongW FindWindowExW GetSystemMetrics GetDC ReleaseDC GetParent DialogBoxParamW BeginPaint EndPaint GetLastInputInfo MessageBoxW GetActiveWindow ShowWindow SetForegroundWindow wsprintfW UnregisterClassW GetMonitorInfoW MonitorFromWindow LoadImageW GetWindowThreadProcessId GetWindowRect

gdi32

CreateFontW DeleteDC CreateSolidBrush DeleteObject CreateRoundRectRgn SelectObject SetStretchBltMode GetObjectW GetDeviceCaps CreateCompatibleDC CreateDIBSection SetBkMode

advapi32

RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW OpenProcessToken RegQueryInfoKeyW RegEnumKeyExW

shell32

ord165 ShellExecuteW ord680 ShellExecuteExW Shell_NotifyIconW SHGetSpecialFolderPathW CommandLineToArgvW

ole32

CoTaskMemRealloc OleInitialize CoCreateInstance OleUninitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

SysStringByteLen SysFreeString VarUI4FromStr SysStringLen VariantInit SysAllocStringByteLen VariantClear SysAllocString

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW StrCmpIW SHGetValueW PathIsRelativeW SHSetValueW PathAddBackslashW PathFileExistsW PathAppendW StrStrIA PathFindFileNameW

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW GetModuleBaseNameW

Name

.text

Size

505KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

787KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_0a7320cb4787c24f8021ffad0e1f84a0_amadey_elex_luca-stealer_lynx_njrat

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

generic