2026-11-12_5004381074d0c576a199d6378c3f404c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_5004381074d0c576a199d6378c3f404c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader
Size 1.4MB
Sample261113-drywrafs3w
SHA256 4857a37ca2609f900f564df2ed7229b99fa0b0f2b190b7e57d66b7ca8ec09881
MD5 5004381074d0c576a199d6378c3f404c
SHA1 d70c87ff7c8702443a8e6d3141713eb1a1172113
SHA512 d9306dc57dce12ad77194e90cb2ae654f1f8a12b4b7d978551d3476b898c71f2b87004962eb1ef5f858cc88740e4c6ca1a922a1488c3429aae779c543ddd49cd
SSDEEP 12288:9+V+h7GpuMkhvRr8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:y+BbMARAjzABgioiNV99L5S1fd0b
TLSH
T17065F102B1D1C036E4B215325974DB766A3EBC704B30A9DF97E40A7E9E706C19E31B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_5004381074d0c576a199d6378c3f404c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-11-12_5004381074d0c576a199d6378c3f404c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 1.4MB

2026-11-12_5004381074d0c576a199d6378c3f404c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH f83a0f911f7e132ce7633c91cbe99d2b
SHA256 4857a37ca2609f900f564df2ed7229b99fa0b0f2b190b7e57d66b7ca8ec09881
MD5 5004381074d0c576a199d6378c3f404c
SHA1 d70c87ff7c8702443a8e6d3141713eb1a1172113
SHA512 d9306dc57dce12ad77194e90cb2ae654f1f8a12b4b7d978551d3476b898c71f2b87004962eb1ef5f858cc88740e4c6ca1a922a1488c3429aae779c543ddd49cd
SSDEEP 12288:9+V+h7GpuMkhvRr8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:y+BbMARAjzABgioiNV99L5S1fd0b
TLSH
T17065F102B1D1C036E4B215325974DB766A3EBC704B30A9DF97E40A7E9E706C19E31B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

setupapi

SetupDiGetClassDevsExW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW

advapi32

RegQueryInfoKeyW RegEnumKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW

version

VerQueryValueW

kernel32

SetEvent ReadConsoleW WriteConsoleW SetEndOfFile InitializeCriticalSectionEx GetLastError DecodePointer DeleteCriticalSection CreateMutexW WaitForSingleObject ReleaseMutex CloseHandle HeapFree HeapSize LockResource HeapReAlloc LoadResource FindResourceW HeapAlloc HeapDestroy GetProcessHeap GetLocaleInfoW GetVersionExW GetCurrentProcess GetTempPathW LocalFree GetTempFileNameW IsWow64Process ResumeThread EncodePointer EnterCriticalSection LeaveCriticalSection MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException ReadFile CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW GetConsoleMode FindClose GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx EnumSystemLocalesW FindFirstFileExW InitializeCriticalSectionAndSpinCount GetUserDefaultLCID ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileType CompareStringW LCMapStringW IsValidLocale

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket OleRun CoInitializeEx CoInitialize

oleaut32

SafeArrayGetElement SafeArrayGetLBound VariantInit SysFreeString VariantClear SafeArrayGetUBound GetErrorInfo SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_5004381074d0c576a199d6378c3f404c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader

setupapi

advapi32

version

kernel32

ole32

oleaut32

generic