2026-10-25_735432ad9d967c9f91cad83c7ddea8a9_amadey_elex_luca-stealer_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_735432ad9d967c9f91cad83c7ddea8a9_amadey_elex_luca-stealer_mespinoza_njrat
Size 1.9MB
Sample261027-aafgasxt5l
SHA256 9777b2a8c3c98d449976dfc2cb11e752312df89f3cf2d98bd4c67b428fb02322
MD5 735432ad9d967c9f91cad83c7ddea8a9
SHA1 8e85cbbe50dbaea87ed449373f80ef73b1bd7517
SHA512 ed797b727e0138dcc39bca99b020fd9dc3121c415408987845e7b7184854a2a3537d7563e563c6a5666a8d74ec80822c4905aec3fa1fd61d9a910fc16845c2fc
SSDEEP 49152:bC+oKOhnEr+Qu/L1jy4Jul1Z0WCw/TaywbhVh0o88+f0j:e+4h5Q6L1j5Jul1Zm2sVhP+8j
TLSH
T18E95E002F151D0B6C9526271645DE73C7B299F0A4F224DC3C7E4BDF86EB05C21A36AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_735432ad9d967c9f91cad83c7ddea8a9_amadey_elex_luca-stealer_mespinoza_njrat

File Explorer

2026-10-25_735432ad9d967c9f91cad83c7ddea8a9_amadey_elex_luca-stealer_mespinoza_njrat

.exe 1.9MB

2026-10-25_735432ad9d967c9f91cad83c7ddea8a9_amadey_elex_luca-stealer_mespinoza_njrat

IMPHASH e1ca66aa95630641de7ed55ec6886368
SHA256 9777b2a8c3c98d449976dfc2cb11e752312df89f3cf2d98bd4c67b428fb02322
MD5 735432ad9d967c9f91cad83c7ddea8a9
SHA1 8e85cbbe50dbaea87ed449373f80ef73b1bd7517
SHA512 ed797b727e0138dcc39bca99b020fd9dc3121c415408987845e7b7184854a2a3537d7563e563c6a5666a8d74ec80822c4905aec3fa1fd61d9a910fc16845c2fc
SSDEEP 49152:bC+oKOhnEr+Qu/L1jy4Jul1Z0WCw/TaywbhVh0o88+f0j:e+4h5Q6L1j5Jul1Zm2sVhP+8j
TLSH
T18E95E002F151D0B6C9526271645DE73C7B299F0A4F224DC3C7E4BDF86EB05C21A36AAE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

682832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

app_shell_launcher.exe.pdb

advapi32

CreateProcessAsUserW DuplicateToken GetTokenInformation OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath SetCurrentProcessExplicitAppUserModelID ShellExecuteA ShellExecuteExW

user32

AllowSetForegroundWindow CallNextHookEx FindWindowExW FindWindowW GetActiveWindow GetDesktopWindow GetDlgItem GetWindow GetWindowRect GetWindowTextLengthW GetWindowTextW LoadStringW MessageBoxW ScreenToClient SetDlgItemTextW SetWindowPos SetWindowsHookExW UnhookWindowsHookEx UnregisterClassW

winmm

timeGetTime

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileW CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DosDateTimeToFileTime DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeResource GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLocaleName GetVersionExW GetWindowsDirectoryW HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CLSIDFromString CoCreateInstance CoInitialize CoSetProxyBlanket CoTaskMemFree CoUninitialize IIDFromString

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathMatchSpecW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

Name

.text

Size

827KB

Virtual Size

827KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

174B

Characteristics

Name

.rsrc

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

793KB

Virtual Size

796KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_735432ad9d967c9f91cad83c7ddea8a9_amadey_elex_luca-stealer_mespinoza_njrat

advapi32

shell32

user32

winmm

kernel32

ole32

winhttp

userenv

shlwapi

oleaut32

netapi32

iphlpapi

generic