2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat
Size 1.8MB
Sample261030-nnqq3sed22
SHA256 67ec6f458e5475501cc75f7b2f25d329dc819fea6be33a9aaadd638a1490c8d0
MD5 029165c44f2199cd5b1f8e7f2fb226bd
SHA1 6725c8d09973ed9cfd805d2c0675d76ef1d70dd5
SHA512 16f2b8411343ecde0584ee42024402fd8840bf3fbbaba5c35998623b50b26682386b3f7dcd2857d8ab06470ffd7292b82d4cb276ad80c33b15f6ef5a0e2a63f2
SSDEEP 49152:nYNwPLKduXQssClWGzKke30jaNf1TWbdz:nowbXQssClWCNU023W
TLSH
T1A38512107882C073E5B241711E3AD7B65A7D6D610F150CDBA7E0BA7D6E306C2AB35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat

File Explorer

2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat

.exe 1.8MB

2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat

IMPHASH 4ea6e928d927f348b0a1f5816c388d13
SHA256 67ec6f458e5475501cc75f7b2f25d329dc819fea6be33a9aaadd638a1490c8d0
MD5 029165c44f2199cd5b1f8e7f2fb226bd
SHA1 6725c8d09973ed9cfd805d2c0675d76ef1d70dd5
SHA512 16f2b8411343ecde0584ee42024402fd8840bf3fbbaba5c35998623b50b26682386b3f7dcd2857d8ab06470ffd7292b82d4cb276ad80c33b15f6ef5a0e2a63f2
SSDEEP 49152:nYNwPLKduXQssClWGzKke30jaNf1TWbdz:nowbXQssClWCNU023W
TLSH
T1A38512107882C073E5B241711E3AD7B65A7D6D610F150CDBA7E0BA7D6E306C2AB35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

149719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\1013152\out\Release\bin\CleanProTray.pdb

kernel32

GetModuleHandleExW lstrcmpiW GetCommandLineW WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage IsValidLocale GetFileType GetStdHandle ExitProcess RtlUnwind GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsSetValue TlsGetValue TlsAlloc HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime QueryPerformanceFrequency GetCPInfo TryEnterCriticalSection FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent SetFilePointerEx SystemTimeToFileTime FindNextFileW FindClose GetPrivateProfileStringW GetPrivateProfileIntW OutputDebugStringW SetFilePointer MapViewOfFile CreateFileMappingW VirtualFree VirtualAlloc GetVersionExW GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GetCurrentThreadId TerminateProcess GetCurrentProcessId GetCurrentProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc ExpandEnvironmentStringsW QueryPerformanceCounter SetLastError GetLastError RaiseException AreFileApisANSI GetFileSizeEx FindResourceW SizeofResource LockResource LoadResource FindResourceExW HeapDestroy DeleteCriticalSection InitializeCriticalSection DeviceIoControl EnumSystemLocalesW GetUserDefaultLCID GetSystemDefaultLCID GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeFormatW GetDateFormatW GetTimeZoneInformation LocalFree GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary UnmapViewOfFile FindFirstFileW CreateFileW GetCurrentDirectoryW GetEnvironmentStringsW

user32

GetMessageW TranslateMessage DispatchMessageW DefWindowProcW PostQuitMessage CreateWindowExW GetWindowLongW SetWindowLongW FindWindowW RegisterClassExW IsWindow PeekMessageW CharNextW DestroyIcon LoadIconW LoadCursorW KillTimer GetClassInfoExW CallWindowProcW RegisterWindowMessageW UnregisterClassW DestroyWindow SetTimer

advapi32

RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegDeleteValueW RegDeleteKeyW

shell32

ShellExecuteW SHGetFolderPathW Shell_NotifyIconW ord165 CommandLineToArgvW

ole32

CoInitialize CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoCreateGuid StringFromGUID2 CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW PathCombineW PathRemoveFileSpecW PathAppendW PathFileExistsW SHGetValueW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

generic