77601325bab4dd55ecb1d27d4cfefaeaf96e98c586816e1547214cb6522bac51

General

Target
2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Size 633KB
Sample260322-cd8y5ad131
SHA256 77601325bab4dd55ecb1d27d4cfefaeaf96e98c586816e1547214cb6522bac51
MD5 60b1805e8ac8fd920f3d6a68b856b9d9
SHA1 984f22d06833d413de1a2cb7a3b7c4e7ae753194
SHA512 713fd85a62740b9209aef63e67959f0754e3f31a084d4aa1faada27815e4e63730ef0dd1335440a3d656ac5e3589f3721c0d998fc11e1ab013840f2536126774
SSDEEP 12288:N6bXAh5glNu042nPAnFosGSutfIwM0hKiI57G6S8ZaXsQClnMNYkkSS1ZCJlXUCc:g/K57xS8oXZCWNYkkS+ZC/jqLOHciNH4
TLSH
T1F9D4AF23B5E1807AD132143016AAAB315DFFFA21097199DB67C8189C4F716E1AE3F367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1540	2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
1540	2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-22_60b1805e8ac8fd920f3d6a68b856b9d9_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NDnyHkZPyh.zip

Path C:\Users\Admin\AppData\Local\Temp\JBXJh1fOI3\NDnyHkZPyh.zip
Size 50KB
SHA256 802bf710dcc779443d84540ca9b2177ce2f78c999d869054c4caf4b5f42b046d
MD5 9b83cf23b0bef6308f9f991ebead1669
SHA1 9a984e3855d597b6b00c5bd8d81433cfced648a5
SHA512 a1de099097a2abdee2e186fa0205baa2ed814cb816d2fe1414bbc77df260d8e9ccaabfdc3e67ce060c8fb781ec7973a497539578118a1fed08bdb4176dfc35d7
SSDEEP 1536:tSkAJGI3uHoULg11g74GBrX3/XT1LT04CNX/:IkAJR3moUE11gp3fTe/
TLSH
T176330242D3FD2C53B94DFA76A1E50ED663DB97C12D3A73BC4678A0048E0901E749EC6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\JBXJh1fOI3\_Files\_Information.txt
Size 5KB
SHA256 d29d83fcd93109995a9c9544dd2244b0d1f4963a33192af6217a2ca239361610
MD5 b9ce6b6092111ab7659d5ace505e5bc9
SHA1 53740c9e34f3455975a0681cc34505093eafb344
SHA512 6482ad51b26ee34853631b8ebb13a2a9f2ef16b1d4511421ca2dd0238efd2a054e62ce109b99a6c1b4e148da7364db4ba4f11a96a43d88aaff906ef869a80b39
SSDEEP 96:s8ldUbOteBgLn3QyDDMHcVmcnmB4Mcq4he:tdUbdo3Q795ND
TLSH
T1A7B136191BE44715E5B2EB11ADF04813B57B7855EC74CB4901EC230E87A7D22A874FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\JBXJh1fOI3\_Files\_Screen_Desktop.jpeg
Size 71KB
SHA256 7430b694ea8c23cd895a93ee153d3a9853864f4aa816a4f59b67f0d7ed59c7f9
MD5 8e3348b95ea64c434791c9277715d82e
SHA1 6ed5095b05a575b6be0af417b1230079c4e257c4
SHA512 cb509656b003c682d95f2f2e2a29fa277ffb8ac3518cc8649e11aacf14a0e1e95392cc00271526d3a2452129fbe7896913125d8133e7d874f611f5c5d1604700
SSDEEP 768:JdnLxFyF+QPZ1JlUSQLFvnFCJvdI7v+q3DRJaKbYMLd1sJ4fe42w0CaTi8o:JDQtPPJlUfZvFCJ+7n1bbUJ4H/0CaOB
TLSH
T17073F4079C08DB83A46897E4BD074EAD2F463B1DE9923AFF55621ECF3D202225C9D06D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\JBXJh1fOI3\files_\system_info.txt
Size 4KB
SHA256 3b90adf51b7e0e6c92b176bc7eda3d7dc9eb5b13ee19addf9ffe112d10501fd2
MD5 89aff8266438a8e77a1ffa46c1b12ded
SHA1 2d88c0498601d935beb03f06916aae2cb50b74ca
SHA512 add15adbf7da31affcc8130d39403f6d22e301fb0a8e46b8ebd1fd6267c088806bab47aa0e78d176271fe8151a271c1377cc2a0f1689cbeff76824870ae72c7d
SSDEEP 48:c2ldUoaBte8xQyfOhGYTQznzg2De7iGqXpF88be7HHcBOmjmcn+jYyrJB4McdZAN:TldUbBtewQsTgKDDMHcVmcnmB4Mci
TLSH
T1789143190BF44711E5B2AB11ADF04823B57B7855EC78CB4D01EC620E87A3D22E864FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mrUHik4ZJTHej.zip

Path C:\Users\Admin\AppData\Local\Temp\JBXJh1fOI3\mrUHik4ZJTHej.zip
Size 50KB
SHA256 610eb55ec75fe27a7b86c3cacf438548127f557b6674ab85755ac6588d6a84b9
MD5 482ef6314aa9596b30128587cd3a758f
SHA1 1c9c43bd1f58b4c01393a17de4af29b36c4d71eb
SHA512 34da0fee42489665d341bf00930cd13863feb47243387d29f3cedfa53ab9a6fe60b6dd221b26f467f402c0a0e25a3d85ec87c85e6d4bdc1f3745a85a38e4a801
SSDEEP 1536:SkAJGI3uHoULg11g74GBrX3/XT1LT04CNXKQ:SkAJR3moUE11gp3fTeKQ
TLSH
T1E4330202D3AE3C92B95DFA76A0D00ED256DB6381283A73BC457DA1049A0E10E74DECA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-216-0x0000000001280000-0x000000000133B000-memory.dmp

Download

memory/1540-232-0x0000000001280000-0x000000000133B000-memory.dmp

Download

memory/1540-257-0x0000000001280000-0x000000000133B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads