2026-11-03_615a88350610db03872a4146beb40bbd_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_615a88350610db03872a4146beb40bbd_amadey_elex_luca-stealer_lynx_njrat_smoke-loader
Size 1.5MB
Sample261104-xn9cvstyfz
SHA256 f39c4d6d0a97f36da7bdb3d2f31843108456bd12ac62199e450dda8a4665d3c7
MD5 615a88350610db03872a4146beb40bbd
SHA1 5087ca7dbce6dd7018b729eadc980728a8e4de4b
SHA512 fcd3669b1c0b1bee7e623e1d49b33bed9b6c52b200e425025ee0e8460d43497af6d5a67be88a5dc8d27f492018b18f2debda6d5a20c75c34ab00bda8c5d472f7
SSDEEP 24576:2zwkTA3HsLI5I1KK2k0wfl8BYM/eNs27TCe:2kkTAXsLDNhfqBYbNs2
TLSH
T15465021175E1C432D673153208B8D770A67FBD700F218ABBA7D82E6EDE306D19A31A67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_615a88350610db03872a4146beb40bbd_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-11-03_615a88350610db03872a4146beb40bbd_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 1.5MB

2026-11-03_615a88350610db03872a4146beb40bbd_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 4f556c706333dad8a6bc8ea2b6240efd
SHA256 f39c4d6d0a97f36da7bdb3d2f31843108456bd12ac62199e450dda8a4665d3c7
MD5 615a88350610db03872a4146beb40bbd
SHA1 5087ca7dbce6dd7018b729eadc980728a8e4de4b
SHA512 fcd3669b1c0b1bee7e623e1d49b33bed9b6c52b200e425025ee0e8460d43497af6d5a67be88a5dc8d27f492018b18f2debda6d5a20c75c34ab00bda8c5d472f7
SSDEEP 24576:2zwkTA3HsLI5I1KK2k0wfl8BYM/eNs27TCe:2kkTAXsLDNhfqBYbNs2
TLSH
T15465021175E1C432D673153208B8D770A67FBD700F218ABBA7D82E6EDE306D19A31A67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\data\landun\workspace\product\win32\ksdkhelper.pdb

kernel32

HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW CreateFileW GetFileSizeEx SetEndOfFile SetFilePointer WriteFile CloseHandle SetLastError ReleaseMutex WaitForSingleObject CreateMutexW Sleep GetCurrentProcessId GetCurrentThreadId GetLocalTime GetTickCount HeapReAlloc GetCommandLineW GetDiskFreeSpaceExW GetDriveTypeW GetFullPathNameW GetLogicalDriveStringsW OutputDebugStringW DeviceIoControl GetSystemDirectoryW GetModuleHandleW LocalFree lstrlenW MultiByteToWideChar GetConsoleMode GetConsoleOutputCP HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer RemoveDirectoryW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW LoadLibraryW GetProcAddress GetFileAttributesW FreeLibrary WideCharToMultiByte FlushFileBuffers SetFilePointerEx SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetStringTypeW EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle GetFileType WriteConsoleW

user32

DefWindowProcW

advapi32

RegDeleteKeyW RegEnumKeyExW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW PathFindFileNameW PathRemoveExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_615a88350610db03872a4146beb40bbd_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

kernel32

user32

advapi32

shell32

ole32

shlwapi

generic