ae8b4c1d921eec004fc72329a9390b00b2cb170577bfa80dbfd2916e0d8956c2

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Size 633KB
Sample260418-e99xeagx7v
SHA256 ae8b4c1d921eec004fc72329a9390b00b2cb170577bfa80dbfd2916e0d8956c2
MD5 b7ad4606d9e4ece86e7c38bff0314ffb
SHA1 0511f9341934360f63fb5b9ec26a0107fc6505e2
SHA512 334cf0831abbf3d27f8c49ee2a2a820c91d0d6cc5f86be2ac88811ae8e3960f8efb2518c05b82cd4b8be29b860cd384ad47517fe39a7d1d43b4bef1274a07a53
SSDEEP 12288:u6bXAh5glNu042nPAnFosGSutfIwPk2K7g5oW6S8Ky7kwSs3cGU48pNuWR01HEyD:pnP5ohS8z7BSBGU48pAWRkTqne38K1zP
TLSH
T1D5D4AE23F5A1807AD132143016AAAB314DFFFA21097199DB67C8189C5F716E1AE3F367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4292	2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
4292	2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2tgTKotjRU.zip

Path C:\Users\Admin\AppData\Local\Temp\cnbXfNjCg\2tgTKotjRU.zip
Size 51KB
SHA256 7b73375659c79a48b5a6653ecd5573556285231471e2ee8ea94e744db0d67f29
MD5 e414e665145fb704aa62af9c9336775a
SHA1 a6a2fb01729da0154bf92591d3773120b6d821a6
SHA512 6bb46486bdd47cf4cf43ed3d3780cc4bcde31480e0a7150bf42eef859704aa5778b1cdf3c75e93dcbb537c7a4733d36763ebbfc468c18bd9e4d078e1cd6abbf5
SSDEEP 1536:SVLq63fyiUpj6pN0YOW+vrUKfbEM37iAkIoXL:AHvyiU0pNHL+TTEMLz/o7
TLSH
T14F33F1EC36DC941B27AD7FA5B30AB45947EA4091B621775C4528FF38A8692A1CFA3C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\cnbXfNjCg\_Files\_Information.txt
Size 1KB
SHA256 4be2d829656778b012036e0d18babe114974057e2b24f2c12253e1ed86b3d516
MD5 cff47488f1bd0b9fb2cc23cb9e380247
SHA1 81c6f72250a4610ef351710e206b6f512e792854
SHA512 00a4f89c51c5fdb7d00f620e7b3e175e17bf4890a66aa6eddb92070babd23395e89d25e3e31f74074d41ec2fa7bd55e58425a0c79fb8b46210da287f0ee52b18
TLSH
T1173134125BE50105F1BB9E466DF645735BBB7DA02D34D86D10CC860D0BF3A15D824BAF
MD5 SHA1 SHA512 TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\cnbXfNjCg\_Files\_Information.txt
Size 4KB
SHA256 8541a34e2836a59dfda58527794beb323eedbf5b898f99b2cd524260be77c241
MD5 750af44e1cdbf2013e63beed06715709
SHA1 1a7bfd1ea69d0dba8288e59f96fd7ef1a78cbd88
SHA512 ab1ec1fd314a91f1db811bfe93e8b8ca5bb830a9050b315f09a85afcea06a432d7c2f84f10c76ba44e7a7166e3a8202f1602158a14a8b8fd8c09c99121a7563e
SSDEEP 96:sI/dUbFUteB2mn3QyDDMHcVmcnmB4Mcq4:LdUblgm3Q795N4
TLSH
T1FFA167290BF44706E4B2AB11ADF14823B57B7851EC74CB4D01EC620E87A7D12A864FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\cnbXfNjCg\_Files\_Screen_Desktop.jpeg
Size 70KB
SHA256 cfe41df4aa2aa6c498a36e6c2c35f8f8696b35fa79c21e74c7e6ddb67cf2cdb7
MD5 5daf48f6e104cff73844dbc758fbe134
SHA1 865701e9d97596250da8e4beed43259f48346a9b
SHA512 c4c002053d5586a7c2ecad08360c3aaa3966cc64aa809cd04702a6f9ea953ad3ad1c3917650a7fdae832e64e71fa6dd08608f56180f59b8176fe42d44a359c7a
SSDEEP 1536:J8JYfTSHtTxcG+SVp7fmJTdux/veed1wTuXqJ2jwz:+JYWkG9VpfmJTdu8evQuasi
TLSH
T11263D2179C098B83A43997E8BE470FAD6F463F18E5523AFB50625FDB3E301161D8E069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\cnbXfNjCg\files_\system_info.txt
Size 8KB
SHA256 56b8968d4d2d72579c2ef3e5a5b1dd1a999640d06fbf520e218c1663fa007b18
MD5 5aeabb9228ba9882c3f9a3dcb82e61d7
SHA1 c3c9774e6f57def3876d34af59df5bbc9ea5d9ae
SHA512 3650e5b581ba1963856670dcf398774ebfb6ea09b16a9a83c653de865f51d984ca099cff335407663cda892ef8728206a5a66c68755f97ccac6e2a8025c556cd
SSDEEP 96:3/dUbGYtewGmTgKDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsoByYs:PdUbqDmTgD95NlTUbT
TLSH
T18D0224280BE44B15E1B2EB11ADF00853B5BB7816ED74CB8901E8634E87A7D11E874F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iAVivN1B5aC.zip

Path C:\Users\Admin\AppData\Local\Temp\cnbXfNjCg\iAVivN1B5aC.zip
Size 51KB
SHA256 3dfe22f10e2217dba1df457784f39de519501a1453d42d76cacf23e1cc189297
MD5 06fd957f5835840d85af1942931bca32
SHA1 849e943f12289b9bd679c99c6439c8390e380716
SHA512 daddbe6af8f03e8f18b80cef42ead462e1d6bf5d98728004510d84e39d6022091088ccf9b503e8c195551357f60492b273450b717f9afb58271c0acd6829893b
SSDEEP 1536:TPVLq63fyiUpj6pN0YOW+vrUKfbEM37iAkIF:T9HvyiU0pNHL+TTEMLz/F
TLSH
T19933F2EC37DC982B23ED6FA5A319A45D47EB4495B2317A5C8518EF34A939291CFB3C00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4292-216-0x00000000015C0000-0x0000000001841000-memory.dmp

Download

memory/4292-232-0x00000000015C0000-0x0000000001841000-memory.dmp

Download

memory/4292-252-0x00000000015C0000-0x0000000001841000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads