2026-11-01_aa02b6ea42c3a51e8d2211e4b95d9c77_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

General

Target
2026-11-01_aa02b6ea42c3a51e8d2211e4b95d9c77_amadey_elex_luca-stealer_lynx_njrat_smoke-loader
Size 1.3MB
Sample261102-pegmgshv8s
SHA256 0dc47c54ef2e58b8340054a4cc74f939fbc91189adb1eb56ee46806d03f14329
MD5 aa02b6ea42c3a51e8d2211e4b95d9c77
SHA1 c06e272b45f8b5a303d03d308cf7479ea032e3d8
SHA512 805e80303ee26abd5a0bb0053b32957a5ef1f83da3019cf072a1b735add256b3299698bcc798a41d0c2f6c2ed5cd6466eb3b2bb0fdb0e5c262554e0c3dae3789
SSDEEP 24576:tE6UbllcBJgYxT5WezNyBo4kx929bL3Hnx:zMlcLgUwecB+kn3Hnx
TLSH
T15A5559F26389E8ADD07317331B3692FC863DAC310871D55A6E90365E9A78FC27523B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_aa02b6ea42c3a51e8d2211e4b95d9c77_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-11-01_aa02b6ea42c3a51e8d2211e4b95d9c77_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 1.3MB

2026-11-01_aa02b6ea42c3a51e8d2211e4b95d9c77_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 5950a73bd89d5f0762988fe4a394f6ab
SHA256 0dc47c54ef2e58b8340054a4cc74f939fbc91189adb1eb56ee46806d03f14329
MD5 aa02b6ea42c3a51e8d2211e4b95d9c77
SHA1 c06e272b45f8b5a303d03d308cf7479ea032e3d8
SHA512 805e80303ee26abd5a0bb0053b32957a5ef1f83da3019cf072a1b735add256b3299698bcc798a41d0c2f6c2ed5cd6466eb3b2bb0fdb0e5c262554e0c3dae3789
SSDEEP 24576:tE6UbllcBJgYxT5WezNyBo4kx929bL3Hnx:zMlcLgUwecB+kn3Hnx
TLSH
T15A5559F26389E8ADD07317331B3692FC863DAC310871D55A6E90365E9A78FC27523B52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

88034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\updater\bin\Release\Update.pdb

kernel32

FindNextFileW OpenMutexW CreateMutexW FindFirstFileW GetTempFileNameW HeapSize GetModuleHandleW GetModuleFileNameW ReadFile CloseHandle GetLastError GetCommandLineW CreateFileW SetStdHandle FormatMessageW WideCharToMultiByte CreateDirectoryW FindClose FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx CopyFileW CreateHardLinkW MultiByteToWideChar QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW SetEnvironmentVariableW RemoveDirectoryW MoveFileExW DeleteFileW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetFileType GetFileSizeEx FlushFileBuffers GetConsoleCP GetConsoleMode HeapFree HeapAlloc ReadConsoleW GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap WriteConsoleW

advapi32

CryptDestroyHash CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextW CryptGetHashParam

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_aa02b6ea42c3a51e8d2211e4b95d9c77_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

kernel32

advapi32

shell32

generic