2026-10-22_920f65603840d6e8914d007dfb9399b6_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_920f65603840d6e8914d007dfb9399b6_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos
Size 1.5MB
Sample261024-e9nzyahx6p
SHA256 feff766a9899c1960610a26e9fd5337435cd8ba0095e92aabc66479519fbac66
MD5 920f65603840d6e8914d007dfb9399b6
SHA1 bcb759cb9c394fd5b7a57d563102569917ae4113
SHA512 12f4be5d4a7ebe4f9a1f3a6815b236ee5d90e0d328f955b93f2f08cf8c5a3463a700c82f451e8a75497bb91db6da832d489bdee68101bdcaba6648c15091c35d
SSDEEP 24576:YYbzp/vuoQZ38ABthwEB6t72HEi/+IYB1/l7b9Qz1ZRU97ufI5:RBPQZP+EBaKHEBF1/lH9QZjU9wI5
TLSH
T10E659CB02C9183ADD1D2023F3D359B6B79BDEA21A63C489632506EF95923081DF7FD16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_920f65603840d6e8914d007dfb9399b6_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos

File Explorer

2026-10-22_920f65603840d6e8914d007dfb9399b6_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos

.exe 1.5MB

2026-10-22_920f65603840d6e8914d007dfb9399b6_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos

IMPHASH c05108bbcc70b453013a2fc58ae6c10b
SHA256 feff766a9899c1960610a26e9fd5337435cd8ba0095e92aabc66479519fbac66
MD5 920f65603840d6e8914d007dfb9399b6
SHA1 bcb759cb9c394fd5b7a57d563102569917ae4113
SHA512 12f4be5d4a7ebe4f9a1f3a6815b236ee5d90e0d328f955b93f2f08cf8c5a3463a700c82f451e8a75497bb91db6da832d489bdee68101bdcaba6648c15091c35d
SSDEEP 24576:YYbzp/vuoQZ38ABthwEB6t72HEi/+IYB1/l7b9Qz1ZRU97ufI5:RBPQZP+EBaKHEBF1/lH9QZjU9wI5
TLSH
T10E659CB02C9183ADD1D2023F3D359B6B79BDEA21A63C489632506EF95923081DF7FD16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

89123

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\_dev\MigrationService\Release\MigrationService.pdb

kernel32

WideCharToMultiByte FindNextVolumeW GetTickCount GetExitCodeProcess InitializeCriticalSectionEx RaiseException DecodePointer DeleteCriticalSection QueryDosDeviceW LoadLibraryW GetCurrentDirectoryW SetCurrentDirectoryW GetModuleHandleW CreateNamedPipeW WaitForMultipleObjects DisconnectNamedPipe CreateEventW SetEvent GetOverlappedResult ExitProcess ConnectNamedPipe TerminateProcess OutputDebugStringW lstrcmpiW GetPrivateProfileStringW GetProcessHeap FindVolumeClose GetProcAddress GetWindowsDirectoryW GetLocalTime HeapAlloc CloseHandle CreateFileA GetLastError Sleep MultiByteToWideChar GetVersionExW CreateFileW WaitForSingleObject FindClose SetFilePointer GetModuleFileNameW DeviceIoControl WriteFile GetCurrentProcess FindNextFileW HeapFree FindFirstVolumeW GetVolumeInformationW ReadFile FreeLibrary CreateDirectoryW WriteConsoleW HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW HeapReAlloc SetStdHandle ReadConsoleW GetOEMCP GetACP IsValidCodePage CreateProcessW GetFileSizeEx GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle SetEnvironmentVariableW GetFileType GetCommandLineW GetCommandLineA GetModuleHandleExW ExitThread lstrcpynW lstrcatW lstrcpyW lstrlenW GetFileSize GetStringTypeW FindFirstFileExW GetFileAttributesExW SetFilePointerEx EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead LocalFree CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind

user32

wsprintfW TranslateMessage PeekMessageW DispatchMessageW GetMessageW

advapi32

CreateServiceW CloseServiceHandle OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceW StartServiceCtrlDispatcherW OpenServiceW QueryServiceStatusEx SetSecurityDescriptorDacl AllocateAndInitializeSid CopySid FreeSid InitializeSecurityDescriptor InitializeAcl GetLengthSid AddAccessAllowedAce RegCloseKey RegOpenKeyExW RegQueryValueExW RegFlushKey RegDeleteKeyW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity

oleaut32

SysFreeString SafeArrayGetUBound VariantInit SafeArrayDestroy VariantClear SysAllocString SafeArrayGetLBound SafeArrayGetElement

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

HttpQueryInfoW HttpOpenRequestW InternetOpenW InternetCloseHandle InternetConnectW HttpSendRequestW HttpAddRequestHeadersW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_920f65603840d6e8914d007dfb9399b6_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos

kernel32

user32

advapi32

ole32

oleaut32

version

wininet

generic