2026-11-13_c63f13bb657452f4a33e3e45fde754f1_amadey_elex_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-13_c63f13bb657452f4a33e3e45fde754f1_amadey_elex_luca-stealer_njrat
Size 1.1MB
Sample261113-3dch2ah12v
SHA256 0aec6def53dd49c0b69cd688babf5f5e427b42216f7830c6cf72b764391d0fb7
MD5 c63f13bb657452f4a33e3e45fde754f1
SHA1 8d5b3d6956aeabe6c41ee1fd2d5f482bc913c369
SHA512 b06bdd5dc6d5d9bef46e8671c6d385b9c073bd5b98dc3206732ce105b345ca344ab59549fde3fbcb172e3685c086d9ba576dc8fd63de7bf939a60cf125b12d27
SSDEEP 24576:0wTJ6A1eP1Pm9zhTaUe0K9XXVYFEjd6/Gr+AK9hhqgPCS3tMrMyj3F9hIF1SqY5d:X5ra0K9ndjd6/GXKvhqE3tMx3FE1S0W0
TLSH
T141459D1276C580B6E17202309E7D9B368AFDBD240B3186DF67845B2D9F34ED22D36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-13_c63f13bb657452f4a33e3e45fde754f1_amadey_elex_luca-stealer_njrat

File Explorer

2026-11-13_c63f13bb657452f4a33e3e45fde754f1_amadey_elex_luca-stealer_njrat

.exe 1.1MB

2026-11-13_c63f13bb657452f4a33e3e45fde754f1_amadey_elex_luca-stealer_njrat

IMPHASH 2c4f8364dc2c225221cd7dc66caea7e0
SHA256 0aec6def53dd49c0b69cd688babf5f5e427b42216f7830c6cf72b764391d0fb7
MD5 c63f13bb657452f4a33e3e45fde754f1
SHA1 8d5b3d6956aeabe6c41ee1fd2d5f482bc913c369
SHA512 b06bdd5dc6d5d9bef46e8671c6d385b9c073bd5b98dc3206732ce105b345ca344ab59549fde3fbcb172e3685c086d9ba576dc8fd63de7bf939a60cf125b12d27
SSDEEP 24576:0wTJ6A1eP1Pm9zhTaUe0K9XXVYFEjd6/Gr+AK9hhqgPCS3tMrMyj3F9hIF1SqY5d:X5ra0K9ndjd6/GXKvhqE3tMx3FE1S0W0
TLSH
T141459D1276C580B6E17202309E7D9B368AFDBD240B3186DF67845B2D9F34ED22D36726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

390278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Dev\Xenos\build\Win32\Release\Xenos.pdb

shlwapi

SHDeleteKeyW SHSetValueW

dbghelp

MiniDumpWriteDump

kernel32

RaiseException LoadResource FindResourceW DecodePointer GetWindowsDirectoryW DeleteCriticalSection CreateProcessW GetCurrentProcess GetModuleFileNameW WaitForSingleObject GetCurrentThreadId Sleep CreateThread GetLocalTime ExitProcess GetCurrentProcessId SetUnhandledExceptionFilter FlushFileBuffers GetFileAttributesW ResumeThread CloseHandle GetNativeSystemInfo GetModuleHandleW DeleteFileW LockResource GetLastError Wow64RevertWow64FsRedirection CreateFileW InitializeCriticalSectionEx Wow64DisableWow64FsRedirection WriteFile VirtualProtect SetEndOfFile WriteConsoleW ReadConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetTimeZoneInformation SetFilePointerEx EnumSystemLocalesW SizeofResource GetCommandLineW GetCurrentDirectoryW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapFree GetConsoleMode GetConsoleCP EnterCriticalSection LeaveCriticalSection InitializeCriticalSection MultiByteToWideChar FormatMessageW LocalFree WideCharToMultiByte DeviceIoControl GetSystemTimeAsFileTime QueryPerformanceCounter VirtualFree VirtualAlloc TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetExitCodeProcess Thread32Next Thread32First CreateActCtxW GetTempPathW UnmapViewOfFile GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile DuplicateHandle ResetEvent GetTickCount LoadLibraryW GetProcAddress FreeLibrary GetCurrentThread GetSystemInfo VirtualAllocEx VirtualFreeEx ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW ReadFile CreateNamedPipeW TerminateThread GetExitCodeThread OpenProcess IsWow64Process SuspendThread GetThreadTimes OpenThread WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx GetStringTypeW TryEnterCriticalSection WaitForSingleObjectEx SwitchToThread SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitThread GetModuleHandleExW GetStdHandle GetFileType HeapAlloc

user32

GetWindowTextW GetMenu CreateWindowExW DestroyIcon LoadIconW ChangeWindowMessageFilterEx EnableMenuItem wsprintfW GetMessageW CreateDialogParamW CallWindowProcW DestroyWindow MessageBoxW SendMessageW EndDialog SetWindowTextW LoadAcceleratorsW ShowWindow IsWindow DispatchMessageW IsDialogMessageW TranslateAcceleratorW TranslateMessage SendMessageA SetWindowLongW GetDlgItem DialogBoxParamW EnableWindow

comdlg32

GetOpenFileNameW GetSaveFileNameW

shell32

CommandLineToArgvW DragQueryFileW

ole32

CoUninitialize CoCreateInstance CoInitialize

advapi32

RegCreateKeyW RegOpenKeyExW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken RegOpenKeyW OpenProcessToken RegSetValueExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW

??0Assembler@asmjit@@QAE@PAURuntime@1@@Z ??0CodeGen@asmjit@@QAE@PAURuntime@1@@Z ??0HostRuntime@asmjit@@QAE@XZ ??0JitRuntime@asmjit@@QAE@XZ ??0Runtime@asmjit@@QAE@XZ ??0StaticRuntime@asmjit@@QAE@PAXI@Z ??0VMemMgr@asmjit@@QAE@PAX@Z ??0X86Assembler@asmjit@@QAE@PAURuntime@1@I@Z ??0Zone@asmjit@@QAE@I@Z ??1Assembler@asmjit@@UAE@XZ ??1CodeGen@asmjit@@UAE@XZ ??1HostRuntime@asmjit@@UAE@XZ ??1JitRuntime@asmjit@@UAE@XZ ??1Runtime@asmjit@@UAE@XZ ??1StaticRuntime@asmjit@@UAE@XZ ??1VMemMgr@asmjit@@QAE@XZ ??1X86Assembler@asmjit@@UAE@XZ ??1Zone@asmjit@@QAE@XZ ??_FVMemMgr@asmjit@@QAEXXZ ?_alloc@Zone@asmjit@@QAEPAXI@Z ?_emit@X86Assembler@asmjit@@UAEIIABUOperand@2@000@Z ?_grow@Assembler@asmjit@@QAEII@Z ?_grow@PodVectorBase@asmjit@@IAEIII@Z ?_newLabel@Assembler@asmjit@@QAEIPAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QAEPAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QAEII@Z ?_relocCode@X86Assembler@asmjit@@UBEIPAX_K@Z ?_reserve@Assembler@asmjit@@QAEII@Z ?_reserve@PodVectorBase@asmjit@@IAEIII@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UAEIII@Z ?alloc@VMemMgr@asmjit@@QAEPAXII@Z ?alloc@VMemUtil@asmjit@@SAPAXIPAII@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPAXPAXIPAII@Z ?allocZeroed@Zone@asmjit@@QAEPAXI@Z ?bind@Assembler@asmjit@@UAEIABULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QAEPAXPBXI@Z ?embed@Assembler@asmjit@@UAEIPBXI@Z ?embedLabel@X86Assembler@asmjit@@QAEIABULabel@2@@Z ?emit@Assembler@asmjit@@QAEII@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@00@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@00H@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@0@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@0H@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@H@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@_K@Z ?emit@Assembler@asmjit@@QAEIIH@Z ?emit@Assembler@asmjit@@QAEII_K@Z ?flush@HostRuntime@asmjit@@UAEXPAXI@Z ?getCpuInfo@HostRuntime@asmjit@@UAEPBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SAIXZ ?getPageSize@VMemUtil@asmjit@@SAIXZ ?getStackAlignment@HostRuntime@asmjit@@UAEIXZ ?make@Assembler@asmjit@@UAEPAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KABUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UAEIPAX@Z ?release@StaticRuntime@asmjit@@UAEIPAX@Z ?release@VMemMgr@asmjit@@QAEIPAX@Z ?release@VMemUtil@asmjit@@SAIPAXI@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPAX0I@Z ?relocCode@Assembler@asmjit@@QBEIPAX_K@Z ?reset@Assembler@asmjit@@QAEX_N@Z ?reset@PodVectorBase@asmjit@@QAEX_N@Z ?reset@VMemMgr@asmjit@@QAEXXZ ?reset@Zone@asmjit@@QAEX_N@Z ?sdup@Zone@asmjit@@QAEPADPBD@Z ?setArch@X86Assembler@asmjit@@QAEII@Z ?setError@CodeGen@asmjit@@QAEIIPBD@Z ?setErrorHandler@CodeGen@asmjit@@QAEIPAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QAAPADPBDZZ ?shrink@VMemMgr@asmjit@@QAEIPAXI@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-13_c63f13bb657452f4a33e3e45fde754f1_amadey_elex_luca-stealer_njrat

shlwapi

dbghelp

kernel32

user32

comdlg32

shell32

ole32

advapi32

generic