2026-11-01_8b039670629511535dda3813032c2605_amadey_elex_luca-stealer_lynx_metamorfo_njrat_play_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_8b039670629511535dda3813032c2605_amadey_elex_luca-stealer_lynx_metamorfo_njrat_play_smoke-loader
Size 1.4MB
Sample261102-swmrlsfe43
SHA256 d6108335a774f1580dd79d28a36252148c6005a0fb6a15abc063da1ffdcd5bde
MD5 8b039670629511535dda3813032c2605
SHA1 9542ff009e7d817e44783cd2768e4255ea842038
SHA512 dc8bbb49dc428b47dee0a32b6cfe2c22702703e2f9f3d1c6fa8095f3e33d1ceac269afbdd00503884087e2e88c5796161f732bd1553aad48c4635c5cf2c2d56e
SSDEEP 24576:by1q/2SVYh+6KjxxjzABgioiNV99L5S1fd0b:f2SVYh+6K1xjzQgilV995S1V0
TLSH
T1DF65021270E1C4F6E176093089E4AA755DBEBC700E20AE7F93D84B2E5F75AC18516BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_8b039670629511535dda3813032c2605_amadey_elex_luca-stealer_lynx_metamorfo_njrat_play_smoke-loader

File Explorer

2026-11-01_8b039670629511535dda3813032c2605_amadey_elex_luca-stealer_lynx_metamorfo_njrat_play_smoke-loader

.exe 1.4MB

2026-11-01_8b039670629511535dda3813032c2605_amadey_elex_luca-stealer_lynx_metamorfo_njrat_play_smoke-loader

IMPHASH cd883dddf3785cd1ef7446b9037842d8
SHA256 d6108335a774f1580dd79d28a36252148c6005a0fb6a15abc063da1ffdcd5bde
MD5 8b039670629511535dda3813032c2605
SHA1 9542ff009e7d817e44783cd2768e4255ea842038
SHA512 dc8bbb49dc428b47dee0a32b6cfe2c22702703e2f9f3d1c6fa8095f3e33d1ceac269afbdd00503884087e2e88c5796161f732bd1553aad48c4635c5cf2c2d56e
SSDEEP 24576:by1q/2SVYh+6KjxxjzABgioiNV99L5S1fd0b:f2SVYh+6K1xjzQgilV995S1V0
TLSH
T1DF65021270E1C4F6E176093089E4AA755DBEBC700E20AE7F93D84B2E5F75AC18516BB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39765

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CocCocUpdateCore_unsigned.pdb

kernel32

GetModuleHandleW GetProcAddress GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA RaiseException MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetFileType SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW WriteConsoleW SizeofResource LockResource FindResourceExW LoadResource FindResourceW lstrlenW lstrcmpiW CreateDirectoryW GetEnvironmentVariableW WaitForSingleObject ReleaseMutex GetTickCount CreateProcessW TryEnterCriticalSection InitializeCriticalSection CreateMutexW Sleep GetSystemDirectoryW VirtualQuery SetFilePointer GetFileAttributesExW MoveFileExW GetPrivateProfileIntW OutputDebugStringA GetPrivateProfileStringW GetLocalTime lstrcmpW GetVersionExW VerSetConditionMask VerifyVersionInfoW lstrcpynW GlobalAlloc GlobalFree GlobalLock GlobalUnlock VirtualProtect VirtualAlloc GetSystemInfo CloseHandle HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount GetCommandLineW HeapFree

ole32

StringFromGUID2 CoInitializeEx CoUninitialize

user32

MessageBoxW SetClipboardData EmptyClipboard CloseClipboard OpenClipboard wsprintfW CharUpperW CharLowerW wvsprintfW

advapi32

TraceEvent GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey GetTokenInformation MakeAbsoluteSD MakeSelfRelativeSD GetSecurityDescriptorLength GetLengthSid InitializeAcl InitializeSecurityDescriptor OpenProcessToken AddAce IsValidSid GetSecurityDescriptorOwner InitializeSid CopySid GetSecurityDescriptorControl SetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup EqualSid GetAclInformation GetSecurityDescriptorDacl SetSecurityDescriptorDacl GetSecurityDescriptorSacl

shell32

SHGetFolderPathW

netapi32

NetApiBufferFree NetGetJoinInformation

shlwapi

PathRemoveExtensionW PathRemoveFileSpecW PathIsRelativeW PathStripPathW PathAppendW PathCanonicalizeW SHQueryValueExW

userenv

UnloadUserProfile

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_8b039670629511535dda3813032c2605_amadey_elex_luca-stealer_lynx_metamorfo_njrat_play_smoke-loader

kernel32

ole32

user32

advapi32

shell32

netapi32

shlwapi

userenv

version

generic