ae8b4c1d921eec004fc72329a9390b00b2cb170577bfa80dbfd2916e0d8956c2

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Size 633KB
Sample260418-e99xeagx7v
SHA256 ae8b4c1d921eec004fc72329a9390b00b2cb170577bfa80dbfd2916e0d8956c2
MD5 b7ad4606d9e4ece86e7c38bff0314ffb
SHA1 0511f9341934360f63fb5b9ec26a0107fc6505e2
SHA512 334cf0831abbf3d27f8c49ee2a2a820c91d0d6cc5f86be2ac88811ae8e3960f8efb2518c05b82cd4b8be29b860cd384ad47517fe39a7d1d43b4bef1274a07a53
SSDEEP 12288:u6bXAh5glNu042nPAnFosGSutfIwPk2K7g5oW6S8Ky7kwSs3cGU48pNuWR01HEyD:pnP5ohS8z7BSBGU48pAWRkTqne38K1zP
TLSH
T1D5D4AE23F5A1807AD132143016AAAB314DFFFA21097199DB67C8189C5F716E1AE3F367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4340	2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
4340	2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_b7ad4606d9e4ece86e7c38bff0314ffb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KHUupSrkJj8p.zip

Path C:\Users\Admin\AppData\Local\Temp\Pcl8mVBcD2fs\KHUupSrkJj8p.zip
Size 474KB
SHA256 2208f55cbac2116b929c9a6d61baf06979e395044db22e185f97e6b16c80581a
MD5 867b0d0b6faf79a0d2973c0774572db6
SHA1 ead0cfdbe9ac9008f485314392ffb2ee5b8937eb
SHA512 38ae3daa0c712df6e128b56f97e929154796eb498841390ed7e04986e43d6221274c690af316749fec6ac4bc8343ca7d3462ff2c95c1e3a631e881a9112e2db7
SSDEEP 12288:EOI43Wg10XpbI6gi/pbVPouGiIa1/YP5KTCixzg/6:pIiY66gqbUiIa1wh4TkC
TLSH
T18FA42366481DD6F363CDB103D569602C042516DFFFE8EA833DDEA19E312C19EAD9831A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YXMgXuKNkzLNX.zip

Path C:\Users\Admin\AppData\Local\Temp\Pcl8mVBcD2fs\YXMgXuKNkzLNX.zip
Size 474KB
SHA256 a36fc07adbef54bb638b1de2f9f6a91cad78120baa120423c491919ed5b6972a
MD5 24cf89fcea9786797c6c9b84c25aa1db
SHA1 ff6a78b1f671a87096d7151c59fb403116ce4fc2
SHA512 ab14bdefa13aa7dfa3e8f999a4700eace69fa81878f6c9b48fdd677b3c6947cc63044eaa28a7d37a88eaaf702e38c8c5879d14eeff32f395f6d9f1c21006fbd2
SSDEEP 12288:yOI43Wg10XpbI6gi/pbVPouGiIa1/YP5KfCixzg/9:PIiY66gqbUiIa1whkTkF
TLSH
T143A42366480DD6B363CDB103D569603C042516DFFFA4EA833DDEB29E316C19EAC98719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockMerge.txt

Path C:\Users\Admin\AppData\Local\Temp\Pcl8mVBcD2fs\_Files\_Files\UnblockMerge.txt
Size 427KB
SHA256 c6167de1dd4ad55ac4f85b21db6bb1ab109d36d600eba89b16f1bf0550a6c690
MD5 d67a6b83da646330dd4205d5287dde73
SHA1 51fbca100fa3d4fc91c0d83d1c58a6af43eb90fc
SHA512 d2146aa2b6f4936334853abf9f3d9b2534154924986c28959d428c6548549d9fad3f383e5a0eb94ad3da16fa46534cd77d4df0523ebbfdcefc2c015d0140f7b1
SSDEEP 12288:YOI43Ag1CXdbI+gi/tbVPsuG+I+Z/0PDKz:FIic2+gqno+I+Z8LU
TLSH
T1D6942367481CD6B3678DA503D569A43C083515DFFFA8DA833AEFB25E306C09ABC58319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\Pcl8mVBcD2fs\_Files\_Information.txt
Size 1KB
SHA256 243b8d2477907be302c29d5556933dd2e2c4de6fa87d882c6bbce7d8bea345b8
MD5 a9770ca2745c48ab2c2b6479356ffacb
SHA1 b56d14687b02e0e79fa90b5ea0dcec249d5b2ac5
SHA512 a8f79857b6a9cd1157ae8157c940216e0c145984ee0f3655137aa7437914595cded381e53f542b19a8ba600e7e61ea7db33495404011d059ec80b6e5d0b70ae0
TLSH
T1673126165BE50104F1B7AF426EF641279BBB7DA02C34D95D10CC860D4BF3925D824BAF
MD5 SHA1 SHA512 TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\Pcl8mVBcD2fs\_Files\_Information.txt
Size 3KB
SHA256 fdeb802ee06b81aa1e3b77b8999b8ab40edb7509bff9efec2932b3c99372dc95
MD5 e0649a9e4dc830267f2fdc1f248cd86f
SHA1 553677962d3509e5109753776bbede8b1be46567
SHA512 13503e7949de78620a9fda2d8ddf544cd4d6dd7f8a627caf59b9383508f8c8012b496971864f351bfe1793819231f38dde0970eb68b97aa909ca7430e85e3339
TLSH
T1AF7112290BE44315E5B6AB11ADF10923B67B3851ED74CB4D01EC624E87A3D21E874F9F
MD5 SHA1 SHA512 TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\Pcl8mVBcD2fs\_Files\_Information.txt
Size 8KB
SHA256 dfd1169431614098b2b49d8c79e9f80b281aeb6d5a9efd34518fe31c47682372
MD5 c522758422f0f975fe12e2ef92de032c
SHA1 90dc8b1e72cd9d83d58e98f1449910380ec606ad
SHA512 3009e0b357fe107d81707951ade1e45650136ebf4dc5ffc835b12571d898941878bc7babe58ff4e8fb1f5d5e8c2559e90a454e6975d4c74a51dac7f188eefa59
SSDEEP 96:sI/dUbOteBKn3QyDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsoByYs:LdUbds3Q795NlTUbT
TLSH
T1D902032C0BE48B15D1B2EB11ADE00853B57B7856ED74CB8901E8634E87A7D12E874F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\Pcl8mVBcD2fs\_Files\_Screen_Desktop.jpeg
Size 67KB
SHA256 616bb8d6423963de7e561d73ce08df38e6afd2fd57e77267e711ab47e2659b6b
MD5 fb66763d5e26af5ec733156cbe7c5ee1
SHA1 dd7acc8497c21f0fbe21af84dd19fc046db51efc
SHA512 626dc8acfeaa65b479ef1fa0c846b28884d69b97f7638a192fdc4ab9cffa97ad75a1f81c61c49445c282626d0d864fd76789ca161e7c7ba8610f8f895bc8f301
SSDEEP 768:Jnm0dRfHbUh/VLd0i3N9jxGKoZ+c+9lYQFnCqIwu1Qw0rG45Tl2L37lin8jFOW9O:Jnmeb4tR0iL8Hwc+Uqhtw0C4+LQjH
TLSH
T14D63C1178D089B83A46587E8FE074E9D2F093B1DE99636FF50265ECB3E305261C5E06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\Pcl8mVBcD2fs\files_\system_info.txt
Size 1KB
SHA256 95b92229cef4b7414967e5c9869dd69e7abc870eb6cb639bbeea6e9942fdf4e1
MD5 4b9967803062e00227eb65514a33de2a
SHA1 2abab158c3c60cc2328fa6f5d3f20a64fde7deea
SHA512 0a94d7bae16153b2b228b49761318420ab9d9e6b28998044b57b490e8180f5249cdc53b24712b72a1831c79f7af215484be3ae16ff21039d9af08dd9e9f5f9fb
TLSH
T1943100161BE80104F5BBAE426DF681635BBB7DA02D35D41C11CC960D0BF3E15E825BAF
MD5 SHA1 SHA512 TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\Pcl8mVBcD2fs\files_\system_info.txt
Size 8KB
SHA256 032acd9f5a0b38468593bea562f51dceb94eae5349b02e1588f56a44542fd700
MD5 8e8c3cfb39982c0caf44146100ef3b34
SHA1 1fa85c353119d064bd31e03dcf7ccbdf0031bde8
SHA512 eb07bc09b7b3d9ff866814155dcd8b7f0abcb668db07b395af299db1c48f8787a0a0c6df82ecf398c545d73bf8e2ad3f159cafec9acc6473922718abf97fbf68
SSDEEP 96:3/dUbBtewZTgKDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsoByYs:PdUbC0TgD95NlTUbT
TLSH
T10902132C0BE44B15E1B2EB11ADF00853B5BB7856ED74CB8901E8634E87A7D11E864F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads