2025-08-03_e4f64e1fdccad59e7ac20bc2db3dc2ef_amadey_black-basta_cryptbot_elex_luca-stealer_lynx

Resubmissions

08/08/2025, 18:28

250808-w4hpeaxtcw8

03/08/2025, 03:58

250803-ejsv7sxsat7

Sharing

Copy URL Twitter E-mail

General

Target
2025-08-03_e4f64e1fdccad59e7ac20bc2db3dc2ef_amadey_black-basta_cryptbot_elex_luca-stealer_lynx
Size 1.9MB
Sample250803-ejsv7sxsat
SHA256 4cd0a2eb8662b5bdacf7f5db62827dd29a0c75d2b3b3f28eefb584e44a1ef2a5
MD5 e4f64e1fdccad59e7ac20bc2db3dc2ef
SHA1 28eea664c6f82dfd47754e83022bcee5484601ef
SHA512 7a307b480e3dd222836b9975f95eca0d54fe43d32e63143146f72d8311003d61a7ca740d271ea6bf86de56aea30e577e29333269294675fab388b8ed6cc6753c
SSDEEP 49152:dYRxABbj0DcLUeAexY9oJh+4NCXg5nQCtVETqWa7Hi9wrn:OQBbHLPCXg5n3tLC9in
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-08-03_e4f64e1fdccad59e7ac20bc2db3dc2ef_amadey_black-basta_cryptbot_elex_luca-stealer_lynx

File Explorer

2025-08-03_e4f64e1fdccad59e7ac20bc2db3dc2ef_amadey_black-basta_cryptbot_elex_luca-stealer_lynx

.exe 1.9MB

2025-08-03_e4f64e1fdccad59e7ac20bc2db3dc2ef_amadey_black-basta_cryptbot_elex_luca-stealer_lynx

IMPHASH 8ac8b66b831bf48525a9bf4aff0652a8
SHA256 4cd0a2eb8662b5bdacf7f5db62827dd29a0c75d2b3b3f28eefb584e44a1ef2a5
MD5 e4f64e1fdccad59e7ac20bc2db3dc2ef
SHA1 28eea664c6f82dfd47754e83022bcee5484601ef
SHA512 7a307b480e3dd222836b9975f95eca0d54fe43d32e63143146f72d8311003d61a7ca740d271ea6bf86de56aea30e577e29333269294675fab388b8ed6cc6753c
SSDEEP 49152:dYRxABbj0DcLUeAexY9oJh+4NCXg5nQCtVETqWa7Hi9wrn:OQBbHLPCXg5n3tLC9in
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

963872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bld_area\Scandium_4_14_0_8\VS141\Bin\Win32\Release.static\NSc.pdb

shlwapi

SHDeleteKeyW PathAppendW PathIsUNCServerW PathRemoveFileSpecW PathAddBackslashW

kernel32

TerminateThread SetThreadPriority GetThreadPriority WaitForSingleObject IsDebuggerPresent Sleep ExitThread VerSetConditionMask VerifyVersionInfoW GetCurrentThread GetSystemInfo RegisterWaitForSingleObject UnregisterWaitEx VirtualAlloc VirtualFree FindFirstFileW FindClose FindNextFileW lstrlenA InitializeCriticalSectionAndSpinCount ResumeThread GetTickCount WaitForMultipleObjects FileTimeToSystemTime GetTempPathW DeleteFileW TerminateProcess CreateDirectoryW CreateProcessW GetSystemDefaultUILanguage GetUserDefaultUILanguage SetFilePointer WriteFile FlushFileBuffers SetEndOfFile GetSystemTime ProcessIdToSessionId VirtualQuery GetSystemTimeAsFileTime CreateSemaphoreW ReleaseSemaphore CreateTimerQueue CreateThread GetCurrentDirectoryW WaitForMultipleObjectsEx GetLongPathNameW lstrlenW LoadLibraryW TryEnterCriticalSection InitializeCriticalSection ResetEvent DuplicateHandle WideCharToMultiByte ReadFile GetFileSize DecodePointer GetCommandLineW SetErrorMode GetModuleFileNameW MultiByteToWideChar lstrcmpiW CloseHandle CreateEventW SetEvent RaiseException SetLastError GetCurrentThreadId GetSystemDirectoryW GetStartupInfoW UnhandledExceptionFilter GetLocaleInfoW FindResourceW FindResourceExW LoadResource LockResource SizeofResource LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ExitProcess OpenProcess GetCurrentProcess LCMapStringW CompareStringW GetCPInfo SwitchToThread WaitForSingleObjectEx GetStringTypeW OutputDebugStringW IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer DebugBreak SearchPathW CreateMutexW K32GetModuleInformation GetCurrentProcessId GetModuleHandleW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetLastError CreateFileW GetFileAttributesW QueryDepthSList GetProcAddress FreeLibrary LoadLibraryExW CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask GetThreadTimes FreeLibraryAndExitThread InterlockedFlushSList WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW IsValidLocale ReadConsoleW GetStdHandle SetStdHandle UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteProcThreadAttributeList QueryInformationJobObject CreateJobObjectW CreateRemoteThread CreateNamedPipeW ReadProcessMemory GetConsoleMode GetConsoleCP RtlUnwind VirtualFreeEx VirtualProtectEx VirtualProtect LoadLibraryExA GetLocalTime OutputDebugStringA FormatMessageA LocalFree TryAcquireSRWLockExclusive ReleaseSRWLockExclusive IsWow64Process GetThreadId AcquireSRWLockExclusive GetVersionExW GetProductInfo GetNativeSystemInfo QueryPerformanceFrequency QueryPerformanceCounter SetUnhandledExceptionFilter RtlCaptureStackBackTrace TlsGetValue CreateFileMappingW MapViewOfFile UnmapViewOfFile ExpandEnvironmentStringsW GetUserDefaultLangID HeapSetInformation TlsAlloc TlsFree TlsSetValue SetFilePointerEx GetModuleHandleExW QueryDosDeviceW GetFileAttributesExW SetCurrentDirectoryW GetModuleHandleA FindFirstFileExW InitializeConditionVariable SleepConditionVariableSRW WakeConditionVariable CreateIoCompletionPort PostQueuedCompletionStatus SetInformationJobObject GetQueuedCompletionStatus SetProcessDEPPolicy VirtualQueryEx VirtualAllocEx GetLogicalProcessorInformation UnregisterWait TerminateJobObject GetUserDefaultLCID GetUserDefaultLocaleName EnumSystemLocalesEx InitializeSRWLock GetFileType SetHandleInformation AssignProcessToJobObject WriteProcessMemory GetCurrentProcessorNumber SetThreadAffinityMask GetProcessHandleCount GetProcessHeaps SignalObjectAndWait

gdi32

GetDeviceCaps DeleteDC DeleteObject

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW GetSidSubAuthority SystemFunction036 RevertToSelf RegDisablePredefinedCache GetSecurityDescriptorSacl SetSecurityInfo ConvertStringSidToSidW GetLengthSid SetTokenInformation GetAce SetKernelObjectSecurity GetKernelObjectSecurity DuplicateTokenEx MapGenericMask AccessCheck ImpersonateLoggedOnUser GetNamedSecurityInfoW IsValidSid CreateProcessAsUserW SetThreadToken CreateRestrictedToken DuplicateToken CopySid CreateWellKnownSid InitializeSid GetSecurityInfo GetSecurityDescriptorDacl SetEntriesInAclW AdjustTokenPrivileges LookupPrivilegeValueW FreeSid EqualSid GetTokenInformation OpenProcessToken OpenThreadToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle RegCloseKey RegQueryValueExW RegOpenKeyExW ControlTraceW TraceMessage ConvertSidToStringSidW

ole32

CoTaskMemAlloc CoCreateInstance IIDFromString StringFromGUID2 CoInitializeEx CoUninitialize CLSIDFromString CoCreateGuid CoTaskMemFree CoTaskMemRealloc

oleaut32

VariantCopyInd VarUI4FromStr SysAllocStringByteLen SysStringByteLen VariantClear VariantInit SafeArrayAccessData SafeArrayUnaccessData SafeArrayCreateVector SafeArrayLock SafeArrayPtrOfIndex SafeArrayUnlock SafeArrayCreate

user32

CreateDesktopW SetProcessWindowStation CreateWindowStationW GetProcessWindowStation DispatchMessageA GetMessageA IsWindowUnicode PeekMessageW DispatchMessageW TranslateMessage GetMessageW PostThreadMessageW CharNextW MoveWindow GetWindowRect GetDlgItem SendMessageW IsClipboardFormatAvailable MsgWaitForMultipleObjectsEx CallWindowProcW CreateWindowExW GetWindowLongW SetWindowLongW DefWindowProcW LoadCursorW GetClassInfoExW RegisterClassExW UnregisterClassW PostMessageW DestroyWindow GetClientRect SetWindowPos SetFocus GetFocus EndPaint BeginPaint AllowSetForegroundWindow GetWindowThreadProcessId GetParent MonitorFromWindow GetDesktopWindow IsWindow GetKeyState CloseWindowStation CloseDesktop GetThreadDesktop GetUserObjectInformationW GetDC

winmm

timeGetTime

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2025-08-03_e4f64e1fdccad59e7ac20bc2db3dc2ef_amadey_black-basta_cryptbot_elex_luca-stealer_lynx

shlwapi

kernel32

gdi32

advapi32

ole32

oleaut32

user32

winmm

generic