b963d9e5ed7fa049a7e8c54bc6db32278ac71cb9af4e1c3c0b1b80c3559e3f6f

General

Target
2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Size 633KB
Sample260425-rh95babs21
SHA256 b963d9e5ed7fa049a7e8c54bc6db32278ac71cb9af4e1c3c0b1b80c3559e3f6f
MD5 5163edd5fa61b7677877562a5582e4cb
SHA1 89f2f66771bec5fa76a66c11a2718e1b14c641e3
SHA512 b4725cfb63898929f62a63ece5c9cfd44cde442eeea3c8fe8f4bc7e12cb50c323861a3aac8721c237e42465731cff394bbdee9b7b082a37c9639708a3bcb052f
SSDEEP 12288:RqjYrsW1KwpEIDEyTeauURgFjAIYh5PjzSS5Imr/lRYVQ3teDRXA/w4Sat9fvK5i:zP3H5Imr9RY+3UDe/w4SatVv6JZDAZle
TLSH
T103D4BE23B5A1807AD132143016AA6B314DFFFA31097199DB67C8189C5F716E1AE3F3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3276	2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
3276	2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_5163edd5fa61b7677877562a5582e4cb_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5AVvrC7JEyi5G.zip

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\5AVvrC7JEyi5G.zip
Size 50KB
SHA256 9a5694ee63f41be20d921542735be0146844a212c2dfdc1788ff9905dddf6093
MD5 bfec9d889022a258ca58e60b0c3e0bf3
SHA1 16599ce5a2c39193d26eb2c2dd526a89e36ea5b2
SHA512 9c4b40b19fcd78ceea77b07f724bbd793d7e3d0026456a0016d234a1c29def38ebd903dc3f8728d5c351ca26f0fd8508c5ca1077bae5a121cb0d05c36dafd514
SSDEEP 1536:1HIi9/MK/fjctsTykn70jwbjwqnU4WSlDnhINe:1HIitM2fjctsTz7LwoWSlbae
TLSH
T1003302C5B6864111428DE6FD5404F3E2AB53F8A618939BDF8066E9710DF74027F92A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5IZqYdycoabtM.zip

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\5IZqYdycoabtM.zip
Size 50KB
SHA256 b906899003853891b101a590f26e94e31c71749324f09b72f4c4d50bff57ce46
MD5 76c869c9a84c7403dd19c42c98f06239
SHA1 fb377a17068046c4bde41f84fb85c08c550379c9
SHA512 b94b988ec0979c6b020de1abdedf0715008efba07041b076ec95f85792eb9cab82d072c2a9ade273fcbf86bc60eae1af54621c9f0e7963058a0f2dcb9daf098b
SSDEEP 1536:QHIi9/MK/fjctsTykn70jwbjwqnU4WSlDnhINdzw:QHIitM2fjctsTz7LwoWSlbadzw
TLSH
T13A3301C1F6C24111028AE6FC6406F3E26B53F4BA189357DF80A6A9B50DB74037F96A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\_Files\_Information.txt
Size 1KB
SHA256 237fc334699a0e56bba894707331c5ebdedf891c7580285f165bc00ef44bf9f8
MD5 3386803dcf1552948ac5dce86b3e4507
SHA1 97bb7a3ba9cc419b9761e69e01bc01e579e1d229
SHA512 06e8d0f99ab437944308fbab6f60a652519eaec4f991f46868aa946bebabeac7226373851c4afbd3033abc086b60b840b889c604759db005802d986d3dc2d481
TLSH
T1F531011A1BE40204F5B7EF026DF20522A6B73DA12C34D96C10CD920D47B3D25E828BAF
MD5 SHA1 SHA512 TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\_Files\_Information.txt
Size 2KB
SHA256 dd3d6dcbf6c31b4ef1dba311d5a52ae7ea954ad9c9929c6e79ee616068bc576d
MD5 9fff49dcf49fb14ba234c4c49a791fe1
SHA1 7cc8d27fc62138119737cdf2752bb1b4582f2ac1
SHA512 4c9aec231b410988053f7c83e9422156a2aab5dee77e32adf2e29c1e583c28afc7ae4610b02c730f4bd1c8d96da4415bb6b5f02a1d5c4a4ddfcf48ae84db6532
TLSH
T11951D01A1BE44305E5B6EB026DF10922BA7B3960AC38CA5D11DD521E47B3D21E864F9F
MD5 SHA1 SHA512 TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\_Files\_Information.txt
Size 5KB
SHA256 c1b56715430e7b3e4dc2cbb171560b8551d67e5cd9803e3f1aed26e5a5d1d5d0
MD5 da4d9aecf868f06eb3982ec3bdd96171
SHA1 3c760594bd34cfb1e224a0cc19de4afb5103db11
SHA512 7f3d1bacc8928d8f6058e0bd22ae827b235355bbbf5fc0949aa02dd434c405f42fe5bd314ba0cd71d5152e341ffef74ab82a36c78ba29be79e6cb1a501650652
SSDEEP 96:s9ndUbOteBSn3QyDDMHcVmcnmB4Mcq4he:MdUbdU3Q795ND
TLSH
T15BB146291BE44716E5B2EB11ADF04813B57B7855EC74CB4901EC220E87A7D22A874FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\_Files\_Screen_Desktop.jpeg
Size 70KB
SHA256 2913c32f93a0789d6e9b05f9c20575ce83870b78af89e2eab9f363b961052a72
MD5 74fc5f7fe2260ea76dcf2a34cb3c60d0
SHA1 c99c9fb266ffd6f1a4c68e8946b7f504c4a85412
SHA512 2565bde6002cfd900546931d600ca13ea15902f2258670d3024c25c1e8089b1ad549a67cc31c8708d735f504b823c68f7b08a7c6e6e98286139ed217d6bab92e
SSDEEP 1536:JJ9rXezbCJSe8XRSBqbbEY0DZQmeVFmawepk4zon:nNmb2SeYSBmbR0tQme3mdetz4
TLSH
T1A263AD079D088B83E46997E4BE474DAD2F06675CF9963AFF40225ECB3E202261D5D07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\DTjgHdyuc\files_\system_info.txt
Size 8KB
SHA256 8ff7f61bc2aab97db13c41b19c68285bb1adbca5117c43b2d4def38a512c25c4
MD5 bd3b0b29b12c12d1d4c1c68b83de5195
SHA1 68cbd4a7c6ad7cde2fb300a783c60e964c6b29bd
SHA512 92c39eb9353931ec951df9a35de1bbccbfc7080d1eeefebe6533547bd3c98b683dc5678885391a16fe316b817561458c7e409f7e012fd7d5abebe7af63df95ce
SSDEEP 96:endUbBtewtTgKDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsoByYs:IdUbCATgD95NlTUbT
TLSH
T1C002032C0BE44B15E1B2EB119DF00853B5BB7816ED74CB8901E8634E87A7D12E864F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3276-216-0x0000000006A30000-0x0000000006A7A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads