2026-10-22_93a7a3f7710e4e6760c3adb0c8526984_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos

General

Target
2026-10-22_93a7a3f7710e4e6760c3adb0c8526984_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos
Size 1.2MB
Sample261024-e1pj4sfx5t
SHA256 cd449d00b43082824358c2066fee1ce6d6e8c1e4f44e1f5b6c8d3ec8c12103f4
MD5 93a7a3f7710e4e6760c3adb0c8526984
SHA1 f34041a974b5483459b82773c83d1b02872f87db
SHA512 d178a72b553f8f2d3fd7ae7ded1d2c77663fd302fce7cd955786a53611751ce033cbc8aa87fa39550f879ccf08a2497283a12d658fa5a6a247bd447368fef098
SSDEEP 24576:joIUZhrny5L9baVl1f4L1rqqvFUPJ3skuMAMrN8HSsJWRE1m7363u:jY0L9baT1f4L1uq9UPRbAMrNqJ91I
TLSH
T1FB45F12075B2C032C57291304D78EBAA057EBE650F368AEBB3D81B2D5E305D16B36977
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_93a7a3f7710e4e6760c3adb0c8526984_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos

File Explorer

2026-10-22_93a7a3f7710e4e6760c3adb0c8526984_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos

.exe 1.2MB

2026-10-22_93a7a3f7710e4e6760c3adb0c8526984_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos

IMPHASH b1d58da623c687af1ef7250faa0e3624
SHA256 cd449d00b43082824358c2066fee1ce6d6e8c1e4f44e1f5b6c8d3ec8c12103f4
MD5 93a7a3f7710e4e6760c3adb0c8526984
SHA1 f34041a974b5483459b82773c83d1b02872f87db
SHA512 d178a72b553f8f2d3fd7ae7ded1d2c77663fd302fce7cd955786a53611751ce033cbc8aa87fa39550f879ccf08a2497283a12d658fa5a6a247bd447368fef098
SSDEEP 24576:joIUZhrny5L9baVl1f4L1rqqvFUPJ3skuMAMrN8HSsJWRE1m7363u:jY0L9baT1f4L1uq9UPRbAMrNqJ91I
TLSH
T1FB45F12075B2C032C57291304D78EBAA057EBE650F368AEBB3D81B2D5E305D16B36977
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

122021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\newwork\leishen8001\leishen\bin\Release\searchgamepath.pdb

kernel32

GetSystemTime GetCurrentProcess TerminateProcess WaitForSingleObject CreateEventW SystemTimeToTzSpecificLocalTime CreateThread MultiByteToWideChar WideCharToMultiByte WriteConsoleW GetCurrentProcessId DeleteFileA GetCurrentThreadId GetModuleFileNameW CloseHandle GetPrivateProfileIntW SetEndOfFile HeapSize GetLastError FormatMessageW GetStringTypeW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle AreFileApisANSI SetLastError GetModuleHandleW GetProcAddress MoveFileExW DuplicateHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount EncodePointer DecodePointer QueryPerformanceCounter CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind RaiseException ReadFile FileTimeToSystemTime ExitThread GetModuleHandleExW GetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW SetFilePointerEx GetConsoleMode ReadConsoleW GetFileType HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx FlushFileBuffers GetConsoleCP HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap

advapi32

RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey

shlwapi

StrStrIW

Name

.text

Size

366KB

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Shared

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

776KB

Virtual Size

780KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_93a7a3f7710e4e6760c3adb0c8526984_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos

kernel32

advapi32

shlwapi

generic