General
- Target 2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat
- Size 633KB
- Sample260322-cd8y5ad131
- SHA256 77601325bab4dd55ecb1d27d4cfefaeaf96e98c586816e1547214cb6522bac51
- MD5 60b1805e8ac8fd920f3d6a68b856b9d9
- SHA1 984f22d06833d413de1a2cb7a3b7c4e7ae753194
- SHA512 713fd85a62740b9209aef63e67959f0754e3f31a084d4aa1faada27815e4e63730ef0dd1335440a3d656ac5e3589f3721c0d998fc11e1ab013840f2536126774
- SSDEEP 12288:N6bXAh5glNu042nPAnFosGSutfIwM0hKiI57G6S8ZaXsQClnMNYkkSS1ZCJlXUCc:g/K57xS8oXZCWNYkkS+ZC/jqLOHciNH4
- TLSH T1F9D4AF23B5E1807AD132143016AAAB315DFFFA21097199DB67C8189C4F716E1AE3F367
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
cryptbot
C2
-
afrodeei26.top
Attributes
-
payload_url
http://weloadhh03.top/download.php?file=lv.exe
Targets
-
- Target 2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat
- Size 633KB
- SHA256 77601325bab4dd55ecb1d27d4cfefaeaf96e98c586816e1547214cb6522bac51
- MD5 60b1805e8ac8fd920f3d6a68b856b9d9
- SHA1 984f22d06833d413de1a2cb7a3b7c4e7ae753194
- SHA512 713fd85a62740b9209aef63e67959f0754e3f31a084d4aa1faada27815e4e63730ef0dd1335440a3d656ac5e3589f3721c0d998fc11e1ab013840f2536126774
- SSDEEP 12288:N6bXAh5glNu042nPAnFosGSutfIwM0hKiI57G6S8ZaXsQClnMNYkkSS1ZCJlXUCc:g/K57xS8oXZCWNYkkS+ZC/jqLOHciNH4
- TLSH T1F9D4AF23B5E1807AD132143016AAAB315DFFFA21097199DB67C8189C4F716E1AE3F367
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.