2026-11-03_4c00f2ea3db935c4b115b2fde6f329fe_amadey_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_4c00f2ea3db935c4b115b2fde6f329fe_amadey_elex_luca-stealer_njrat_smoke-loader
Size 3.2MB
Sample261104-1ata9seg39
SHA256 9ea07f9e89f1fc4c63a714812783b6acb6003ed5b3d6db8667a795cf1b17ec22
MD5 4c00f2ea3db935c4b115b2fde6f329fe
SHA1 c7084d23d9b5a85b4bc190c12b448274fc3e298f
SHA512 0dae04d3d59ba10ecb602e331b7dd0840a9c2c9c458fbf1711d6cc1a3ed68892fa1662018b292bd31c54b22b75a648213ed350e58b5f19740af2335ae60d2136
SSDEEP 24576:WdEY3wNf6noZRrOLyO20NUfpA904dzzN0CK6a9DhvhUjhB6Jq:eEY3kfJrOeOckzhc6a3vvq
TLSH
T176F561A077E5570AFDF38ABD55BE62584839BCA6CB14C2DF1980608E4971AD89C30F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_4c00f2ea3db935c4b115b2fde6f329fe_amadey_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-11-03_4c00f2ea3db935c4b115b2fde6f329fe_amadey_elex_luca-stealer_njrat_smoke-loader

.exe 3.2MB

2026-11-03_4c00f2ea3db935c4b115b2fde6f329fe_amadey_elex_luca-stealer_njrat_smoke-loader

IMPHASH c6129066bad5373673fc8f29a5e0d994
SHA256 9ea07f9e89f1fc4c63a714812783b6acb6003ed5b3d6db8667a795cf1b17ec22
MD5 4c00f2ea3db935c4b115b2fde6f329fe
SHA1 c7084d23d9b5a85b4bc190c12b448274fc3e298f
SHA512 0dae04d3d59ba10ecb602e331b7dd0840a9c2c9c458fbf1711d6cc1a3ed68892fa1662018b292bd31c54b22b75a648213ed350e58b5f19740af2335ae60d2136
SSDEEP 24576:WdEY3wNf6noZRrOLyO20NUfpA904dzzN0CK6a9DhvhUjhB6Jq:eEY3kfJrOeOckzhc6a3vvq
TLSH
T176F561A077E5570AFDF38ABD55BE62584839BCA6CB14C2DF1980608E4971AD89C30F37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetProcAddress LoadLibraryA CloseHandle Sleep CreateConsoleScreenBuffer SetConsoleActiveScreenBuffer WriteConsoleOutputCharacterW FreeConsole CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileAttributesExW CreateProcessW RaiseException WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA InitOnceBeginInitialize InitOnceComplete GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW RtlCaptureStackBackTrace IsProcessorFeaturePresent WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency LocalFree GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess HeapValidate GetSystemInfo CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread SetConsoleCtrlHandler HeapReAlloc HeapSize HeapQueryInformation GetFileType OutputDebugStringW WriteConsoleW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WaitForSingleObject GetExitCodeProcess

user32

LoadIconW LoadCursorW EndPaint BeginPaint UpdateWindow TranslateAcceleratorW LoadAcceleratorsW EndDialog DialogBoxParamW ShowWindow DestroyWindow GetAsyncKeyState RegisterClassExW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW CreateWindowExW

ole32

CoGetObjectContext CoGetApartmentType

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

960KB

Virtual Size

960KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

738KB

Virtual Size

738KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_4c00f2ea3db935c4b115b2fde6f329fe_amadey_elex_luca-stealer_njrat_smoke-loader

kernel32

user32

ole32

generic