2025-10-20_61db0c0046478a5c8c91620eda21e395_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2025-10-20_61db0c0046478a5c8c91620eda21e395_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader
Size 376KB
Sample251020-feptesdw5c
SHA256 4e0675d234a7da040e6ee6814cf21b26fdfe49ee30ad30386927dcea074a2d79
MD5 61db0c0046478a5c8c91620eda21e395
SHA1 38941c50042255d8fc318c0a9ab18a848a0e3bff
SHA512 081f94ad3289344575644a05e1cd089e9f52e2631cc7d147e733304b7c072b14b6e49389937edec216b0c614e969b6a81de912c48be621d29c3cd0acee69d4f2
SSDEEP 6144:jwmqh+1uu3RVmPY55eExdAev5wuSiRqAO1iNgLTBs4LhVJqRcelLQMo8:8+1uu3RVmPYaad5wuSiRqLNeRcZMo8
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2025-10-20_61db0c0046478a5c8c91620eda21e395_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader

File Explorer

2025-10-20_61db0c0046478a5c8c91620eda21e395_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader

.exe 376KB

2025-10-20_61db0c0046478a5c8c91620eda21e395_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader

IMPHASH 06a6788e5dd83699db9d4f9024a3c441
SHA256 4e0675d234a7da040e6ee6814cf21b26fdfe49ee30ad30386927dcea074a2d79
MD5 61db0c0046478a5c8c91620eda21e395
SHA1 38941c50042255d8fc318c0a9ab18a848a0e3bff
SHA512 081f94ad3289344575644a05e1cd089e9f52e2631cc7d147e733304b7c072b14b6e49389937edec216b0c614e969b6a81de912c48be621d29c3cd0acee69d4f2
SSDEEP 6144:jwmqh+1uu3RVmPY55eExdAev5wuSiRqAO1iNgLTBs4LhVJqRcelLQMo8:8+1uu3RVmPYaad5wuSiRqLNeRcZMo8
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c7:02:ef:9f:a0:8e:cb:7e:0f:86:e9:3f:4a:ec:67:cd:64:6a:37:8b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=6345115000,CN=K & D KOMPANI d.o.o.,O=K & D KOMPANI d.o.o.,L=Nova Gorica,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349

Chains

Sep 26, 2020

SERIALNUMBER=6345115000,CN=K & D KOMPANI d.o.o.,O=K & D KOMPANI d.o.o.,L=Nova Gorica,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=6345115000,CN=K & D KOMPANI d.o.o.,O=K & D KOMPANI d.o.o.,L=Nova Gorica,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349

Serial Number

0a:1d:c9:9e:4d:52:64:c4:5a:50:90:f9:32:42:a3:0a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2020 - Sep 22, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

27009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Izidu\Source\Repos\RuntimeLibrary\Release\RuntimeLibrary.pdb

kernel32

SetEndOfFile HeapSize CreateFileW HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers CloseHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW VirtualAlloc GetLastError CreateThread GetProcessHeap GetFullPathNameW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree GetModuleHandleExW ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RaiseException RtlUnwind FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW WriteConsoleW

user32

LoadAcceleratorsW SendMessageW LoadStringW GetMessageW TranslateMessage IsDialogMessageW LoadIconW LoadCursorW MessageBoxW MessageBoxA GetWindowRect GetWindowTextW SetWindowTextW EndPaint BeginPaint DispatchMessageW TranslateAcceleratorW UpdateWindow GetDlgItem CreateDialogParamW SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW

gdi32

CreateSolidBrush

comdlg32

GetOpenFileNameW

advapi32

CryptAcquireContextA

ole32

CoUninitialize CoInitializeEx CoCreateInstance StringFromGUID2 CoGetObject

oleaut32

SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

2025-10-20_61db0c0046478a5c8c91620eda21e395_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

generic