b963d9e5ed7fa049a7e8c54bc6db32278ac71cb9af4e1c3c0b1b80c3559e3f6f

General

Target
2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Size 633KB
Sample260425-rh95babs21
SHA256 b963d9e5ed7fa049a7e8c54bc6db32278ac71cb9af4e1c3c0b1b80c3559e3f6f
MD5 5163edd5fa61b7677877562a5582e4cb
SHA1 89f2f66771bec5fa76a66c11a2718e1b14c641e3
SHA512 b4725cfb63898929f62a63ece5c9cfd44cde442eeea3c8fe8f4bc7e12cb50c323861a3aac8721c237e42465731cff394bbdee9b7b082a37c9639708a3bcb052f
SSDEEP 12288:RqjYrsW1KwpEIDEyTeauURgFjAIYh5PjzSS5Imr/lRYVQ3teDRXA/w4Sat9fvK5i:zP3H5Imr9RY+3UDe/w4SatVv6JZDAZle
TLSH
T103D4BE23B5A1807AD132143016AA6B314DFFFA31097199DB67C8189C5F716E1AE3F3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1940	2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
1940	2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5AVvrC7JEyi5G.zip

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\5AVvrC7JEyi5G.zip
Size 411KB
SHA256 e305eb6f16274b571b853579b438d499a56d7ec2a12fd3880717d90d64f046e0
MD5 718b77be6c457a95b1bd172f1387ed7a
SHA1 e6c6fdefeeaa182815ef117aa8578cc04c6e3f72
SHA512 42e77bdc696b71d21a102d3b5fc9cc3b4435a05cc68be26680cfc53ca7d185518598c8c24f7c6630890c3a591fa0bbfd83140b829272f9bb86e07e74e067151b
SSDEEP 12288:bpXr75oZgooyUpvSQ1Ee7wPWPgDx8CTV9P7FDfMZJ6OEL:drto6vScN8PcgqCTV9ZDkjFm
TLSH
T17E9423BDA8B10293C10C26F2D9A3D0519A7EB585DAABEED8342111D806079F64F46FF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinEnter.txt

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\_Files\_Files\JoinEnter.txt
Size 366KB
SHA256 494a38ed6febaeee44d933e2b8fe20fb17c90acadcfa44733b5d72e8d3cb5b03
MD5 2ed09ed61de5e0fc0b0220426357b29d
SHA1 f512163e4adca3e14a2b8f46fee2b5df2200dd80
SHA512 e8eace60c34a31af4e37e1bae0663bff671fec7439e0c28710b133a4c02e4f0175b027c949d6d9edba6eb585242f7ea21439a00dd6467b1d8e85ec09eff945d9
SSDEEP 6144:6xVAontXr735kHoQgi5oKnoQuxHXZvSFknNEe77mPW/j08IZDhzrbFQCE6PkoN34:6fXr75oZgaoQUpvSWNEe7iPWvgDx+CTO
TLSH
T1898423F969A44393C10837F3A5A7D042EA7EB541CAEBFDE8241022D40506AF64F87FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\_Files\_Information.txt
Size 4KB
SHA256 d604fec98b7b50d3a5dbd12a2ed3cf4042e80ce7dc025e2771eb436da884b445
MD5 721c31561a8939f788060ab76363f947
SHA1 3a4231b60c18059abb967c3de50c6c6d2f3fcbbf
SHA512 12c559a22e9d11ac5de941b7568184bed5557aae696dc2776b3c5242f7dbe0e723bc013925c84b7da909b901ed1572b04d64aa42bc597f6b3ddd953d4c6da5f3
SSDEEP 48:sxrQQdUoaFUteXxRaMxaehGYTwTCuDQeDe7iGqXpF88be7HHcBOmjmcn+jYyrJBc:s9ndUbFUteBcn3QyDDMHcVmcnmB4McR
TLSH
T1FB8136290BE44306E5B6AB11ADF00863B57B3855EC74CB4D01EC620E87A3D22E874F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\_Files\_Screen_Desktop.jpeg
Size 64KB
SHA256 e27624ea8ba89d59237963374140072a1f4b1d87f6e7bab783c099ee384d09ef
MD5 d4b373cdcd25adc5797d77a39a9b91dc
SHA1 6431c676013ed3bb1d2f073dc8f844d5e0c7af8e
SHA512 0635a8a74b4be80ba63b0c9c9e13ac756a0ac52aba04e5663828f1482bd915b8c09773c52d71bbceb8363658b2c8d26cc3f65e1328c285fb88b443b0d3df5f6a
SSDEEP 1536:JP/Z5qnnukhkTDywY1AFtbML2p4pKRhOCEaB1:FX4ukgdu2p4pKLOOB1
TLSH
T18C53A4079C099783A42497F9BE171D7D2F0A271CE9923AFF54625ECB3D246221C8F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\files_\system_info.txt
Size 7KB
SHA256 1030d0e435b9e27273e7f7fc2cc29bdd1c2e376f061bfa21bbc4a4a10de04c9b
MD5 dd841170eb3c21154617e17f4de3d055
SHA1 f2ffffa2f6d4963882e54368b8686a640ecdc7d9
SHA512 d8f4a85145d6a1c435cbd8893829128e7760a36fb29a9ff6272df2cc13ee29492148c96c8f7db6381d6de2e8dcf414d59f86b23cd3c24eb481214a853c3fe0e1
SSDEEP 96:endUbGYtewTTgKDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsi:IdUbquTgD95NlTUby
TLSH
T10BF1242C17E44B15E5B2EB119DF00813B57B7856ED74CB8901E8234E87A7D12B864F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oXzAWmVueOoA.zip

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\oXzAWmVueOoA.zip
Size 411KB
SHA256 dfe3f6cfd22cdfe6c6c263d08ef6bd59d6bd7adbd5bc0d63cba09f673f119e96
MD5 f05500dae90b5176e1da5442b64f1a8b
SHA1 5106f0e024d360465db6005339b24b35278b3855
SHA512 8e3121ab06382efd340b4fb1c81dcc420c649e948bc71d7ee806e14480f3173ae88647ce2a8e73358ed80e39bd23d73ee4b02d37cd49b304ed62c8100c80c87c
SSDEEP 12288:lpXr75oZgooyUpvSQ1Ee7wPWPgDx8CTV9P7FDQMZJ6OEj:Hrto6vScN8PcgqCTV9ZD/jFM
TLSH
T1EC9423FD99B10293C10C26F3D9B3D0519A7EB585DAABEED8242021D806076F64F46EF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1940-221-0x0000000004290000-0x0000000004326000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads