2026-10-22_7525eca6fe0516a87bc01a6cb1e6aa24_amadey_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_7525eca6fe0516a87bc01a6cb1e6aa24_amadey_elex_luca-stealer_mespinoza_njrat
Size 2.7MB
Sample261024-kcy2jagy3w
SHA256 80e361f6a14fd1616ecb0027477aa256a6f5d3659f679520e84ed2675e255118
MD5 7525eca6fe0516a87bc01a6cb1e6aa24
SHA1 bfbf42391380faba90b2d562965f96d973d6a2fb
SHA512 3c7215554224f05ea68bd4da0f5e587d0bfa73874bd7b69ef140871e7ed9a40b5ad16206b0547462a60f80e9b31e87f4457bf5e4b9931f3c129cd8c3b02bba6c
SSDEEP 49152:ZkUEdVX4wnBRpl+57RGAe+2fZcOW/d8I96plGwBIIuzSYnduDi+Ow4rW4Zf2krbG:GUCXLvplQ7R/IZcOW/v96awBIIuz9kpv
TLSH
T187D5E042F64298B7D487233064CDE738553D6E094BDD8EEBC398BCACD9722C355326A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_7525eca6fe0516a87bc01a6cb1e6aa24_amadey_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-10-22_7525eca6fe0516a87bc01a6cb1e6aa24_amadey_elex_luca-stealer_mespinoza_njrat

.exe 2.7MB

2026-10-22_7525eca6fe0516a87bc01a6cb1e6aa24_amadey_elex_luca-stealer_mespinoza_njrat

IMPHASH abe86b9654514c5c296a93a051a09ea3
SHA256 80e361f6a14fd1616ecb0027477aa256a6f5d3659f679520e84ed2675e255118
MD5 7525eca6fe0516a87bc01a6cb1e6aa24
SHA1 bfbf42391380faba90b2d562965f96d973d6a2fb
SHA512 3c7215554224f05ea68bd4da0f5e587d0bfa73874bd7b69ef140871e7ed9a40b5ad16206b0547462a60f80e9b31e87f4457bf5e4b9931f3c129cd8c3b02bba6c
SSDEEP 49152:ZkUEdVX4wnBRpl+57RGAe+2fZcOW/d8I96plGwBIIuzSYnduDi+Ow4rW4Zf2krbG:GUCXLvplQ7R/IZcOW/v96awBIIuz9kpv
TLSH
T187D5E042F64298B7D487233064CDE738553D6E094BDD8EEBC398BCACD9722C355326A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

926784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

app_shell_launcher.exe.pdb

advapi32

CreateProcessAsUserW DuplicateToken GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath SetCurrentProcessExplicitAppUserModelID ShellExecuteA ShellExecuteExW

user32

AllowSetForegroundWindow CallNextHookEx CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW FindWindowExW FindWindowW GetActiveWindow GetDC GetDesktopWindow GetDlgItem GetMessageW GetSystemMetrics GetWindow GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW KillTimer LoadCursorW LoadIconW LoadStringW MessageBoxW PostMessageW PostQuitMessage RegisterClassExW ReleaseDC ScreenToClient SetDlgItemTextW SetProcessDPIAware SetTimer SetWindowLongW SetWindowPos SetWindowsHookExW ShowWindow TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateLayeredWindow

winmm

timeGetTime

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DosDateTimeToFileTime DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeResource GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTickCount64 GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLocaleName GetVersionExW GetWindowsDirectoryW HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleFileNameExW LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetPriorityClass SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableCS SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CLSIDFromString CoCreateInstance CoInitialize CoSetProxyBlanket CoTaskMemFree CoUninitialize IIDFromString

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipDisposeImage GdipDrawImageRectI GdipFree GdipGetImageGraphicsContext GdipGetImagePixelFormat GdiplusShutdown GdiplusStartup

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathMatchSpecW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

174B

Characteristics

Name

.rsrc

Size

771KB

Virtual Size

770KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

795KB

Virtual Size

796KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_7525eca6fe0516a87bc01a6cb1e6aa24_amadey_elex_luca-stealer_mespinoza_njrat

advapi32

gdi32

shell32

user32

winmm

kernel32

ole32

winhttp

gdiplus

userenv

shlwapi

oleaut32

netapi32

iphlpapi

generic