avaddon | 2025-12-19_d83fa315fdbc4952a25311ddbf26df97_amadey_avaddon_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2025-12-19_d83fa315fdbc4952a25311ddbf26df97_amadey_avaddon_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 1.1MB
Sample251219-sdde8adn3x
SHA256 4f2d1269f68bd089bf92c6b2983826305615d773ce29a988fd028d430a38ef2e
MD5 d83fa315fdbc4952a25311ddbf26df97
SHA1 8ecdc6066d52ecbc62f507e7c3d7fb0c2f84ef0c
SHA512 481cb9eb270b05ab346883a70607b9c313c072c27cee6760533c261d544802ee800d2f86324963969b1c418d283d4336d84e2ff082a1c2dbd7f7cab701fc9fd1
SSDEEP 24576:SAOtW3nR3bZTbVKaFBRPkdP8XCsG+UN7BgqpIbbbbpcOs8:SztWtbZTbVKEBR8fsGZ7iYIbbbbpcOf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

avaddon

Malware Config

Signatures

Avaddon family
avaddon

Avaddon payload 1 IoCs

resource	yara_rule
sample	family_avaddon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-12-19_d83fa315fdbc4952a25311ddbf26df97_amadey_avaddon_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

File Explorer

2025-12-19_d83fa315fdbc4952a25311ddbf26df97_amadey_avaddon_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 1.1MB

2025-12-19_d83fa315fdbc4952a25311ddbf26df97_amadey_avaddon_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH 84789fed28ecdb34d8ea466d9386a4ec
SHA256 4f2d1269f68bd089bf92c6b2983826305615d773ce29a988fd028d430a38ef2e
MD5 d83fa315fdbc4952a25311ddbf26df97
SHA1 8ecdc6066d52ecbc62f507e7c3d7fb0c2f84ef0c
SHA512 481cb9eb270b05ab346883a70607b9c313c072c27cee6760533c261d544802ee800d2f86324963969b1c418d283d4336d84e2ff082a1c2dbd7f7cab701fc9fd1
SSDEEP 24576:SAOtW3nR3bZTbVKaFBRPkdP8XCsG+UN7BgqpIbbbbpcOs8:SztWtbZTbVKEBR8fsGZ7iYIbbbbpcOf
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Avaddon payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

314628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent WriteFile CreateFileW ReadFile GetFileSizeEx GetFileAttributesW SetFileAttributesW SetFilePointerEx MoveFileExW FindFirstFileW FindNextFileW GetEnvironmentVariableW FindClose GetShortPathNameA ReleaseMutex GetLocaleInfoA GetDiskFreeSpaceA GetComputerNameA WriteConsoleW SetEndOfFile HeapSize ReadConsoleW GetProcessHeap GetThreadContext HeapAlloc CloseHandle Process32FirstW GetCurrentThread GetUserDefaultLCID Process32NextW GetLastError Sleep CreateToolhelp32Snapshot OpenProcess WaitForSingleObject OpenMutexW GetModuleFileNameW TerminateProcess GetCurrentProcess HeapFree WideCharToMultiByte MultiByteToWideChar FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetVolumeMountPointW FindFirstVolumeW QueryDosDeviceW FlushFileBuffers SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc GetConsoleMode GetConsoleCP SetStdHandle DeleteFileW GetFileType EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetStdHandle CopyFileW CreateMutexW ExitProcess RtlUnwind LoadLibraryW UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualFree GetLogicalDrives CreateProcessW VirtualProtect VirtualAlloc GetVersionExW LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread FreeLibrary GetThreadTimes RaiseException GetCurrentThreadId IsProcessorFeaturePresent QueueUserWorkItem GetModuleHandleExW FormatMessageW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress WaitForSingleObjectEx EncodePointer DecodePointer GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter SetEvent ResetEvent GetStartupInfoW GetCurrentProcessId InitializeSListHead LocalFree CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait

user32

SystemParametersInfoW GetKeyboardLayout

advapi32

EnumDependentServicesW OpenServiceW CryptSetKeyParam CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptDuplicateKey CryptExportKey CryptImportKey CryptGenKey CryptReleaseContext OpenProcessToken GetTokenInformation RegCloseKey CloseServiceHandle OpenSCManagerW DeleteService ControlService RegSetValueExW StartServiceW RegOpenKeyExW RegCreateKeyW QueryServiceStatusEx

shell32

SHGetSpecialFolderPathA SHEmptyRecycleBinW

ole32

CoInitializeEx IIDFromString CLSIDFromString CoGetObject CoSetProxyBlanket CoInitializeSecurity CoCreateInstance CoUninitialize

oleaut32

SysAllocStringByteLen SysAllocString SysFreeString VariantInit VariantClear SysStringByteLen

mpr

WNetGetConnectionA WNetGetConnectionW

netapi32

NetApiBufferFree NetShareEnum

iphlpapi

SendARP

ws2_32

gethostbyname WSAStartup gethostname inet_ntoa WSACleanup inet_addr

rstrtmgr

RmShutdown RmRegisterResources RmStartSession RmEndSession RmGetList

crypt32

CryptStringToBinaryA

wininet

InternetReadFile HttpOpenRequestW InternetOpenW HttpSendRequestW HttpSendRequestA InternetConnectW InternetCloseHandle