2026-05-29_044a5cf9f72f18c4cc5bb6ddc54e7666_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-29_044a5cf9f72f18c4cc5bb6ddc54e7666_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys
Size 1.6MB
Sample260529-qrf26acw4w
SHA256 0d8848fdc6fefe4a4092c0c6809715d1961313737a7a959c5e94eea2b569c26d
MD5 044a5cf9f72f18c4cc5bb6ddc54e7666
SHA1 59be9a3fb0b6ea5f206b51b86d3957ccd48f4414
SHA512 92184ff1a4d403d9f17a29e60585a56ef6c25332a69a0c049b9403ea45e396c5c5568a69e55cafa7ebb678f5a11e00fdfc47d06bc2a47231f190ce2fecad63f4
SSDEEP 24576:qg8x+aIwBnuDCaGqEpkHGMXNk7DFO8HbkfFVEQa8EBb6pPtfmiuWXV:P8JuOkHGMXNoFO8Hk3Ezb6pPtfqiV
TLSH
T17B75181177E95A29F5FB2B31AEB851604A7BBC615F31C7CF13801A5E2934AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-29_044a5cf9f72f18c4cc5bb6ddc54e7666_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys

File Explorer

2026-05-29_044a5cf9f72f18c4cc5bb6ddc54e7666_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys

.exe 1.6MB

2026-05-29_044a5cf9f72f18c4cc5bb6ddc54e7666_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys

IMPHASH 4b0b594d68692b0de70c17754d8636d5
SHA256 0d8848fdc6fefe4a4092c0c6809715d1961313737a7a959c5e94eea2b569c26d
MD5 044a5cf9f72f18c4cc5bb6ddc54e7666
SHA1 59be9a3fb0b6ea5f206b51b86d3957ccd48f4414
SHA512 92184ff1a4d403d9f17a29e60585a56ef6c25332a69a0c049b9403ea45e396c5c5568a69e55cafa7ebb678f5a11e00fdfc47d06bc2a47231f190ce2fecad63f4
SSDEEP 24576:qg8x+aIwBnuDCaGqEpkHGMXNk7DFO8HbkfFVEQa8EBb6pPtfmiuWXV:P8JuOkHGMXNoFO8Hk3Ezb6pPtfqiV
TLSH
T17B75181177E95A29F5FB2B31AEB851604A7BBC615F31C7CF13801A5E2934AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b6:17:3e:b4:3c:18:46:42:57:2e:9e:1a:85:02:39:f0:bf:07:d8:dc:89:61:8c:a4:c8:1e:18:cf:3a:67:fd:a4

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 26, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1a:34:0f:78:d7:d0:00:e0:89:fd:ba:ad:65:22:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

434016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARM.pdb

msi

ord114 ord16 ord120 ord123 ord205 ord159 ord160 ord141 ord8 ord118 ord171 ord92 ord116 ord115 ord119 ord88 ord240 ord131 ord150 ord78 ord70 ord181 ord195 ord32 ord281

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses GetModuleFileNameExW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW HttpQueryInfoW InternetReadFile InternetCrackUrlW InternetOpenW InternetConnectW HttpOpenRequestW HttpSendRequestW InternetErrorDlg InternetSetOptionW InternetCloseHandle

sensapi

IsNetworkAlive

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer

kernel32

GlobalLock GlobalUnlock GlobalFree MulDiv FlushFileBuffers GetFullPathNameW LockFile UnlockFile DuplicateHandle LoadLibraryExW LoadLibraryA GetCurrentThreadId GetVersionExW FreeLibrary GlobalDeleteAtom SetThreadPriority SuspendThread ResumeThread GetPrivateProfileIntW GlobalAddAtomW EncodePointer GetSystemDirectoryW GlobalFindAtomW GetModuleHandleA FileTimeToLocalFileTime FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW GetFileSizeEx GetFileTime InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc SetErrorMode GetCurrentDirectoryW GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags GetUserDefaultLCID ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleFileNameW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetACP ExpandEnvironmentStringsW GetCurrentProcessId ProcessIdToSessionId GlobalMemoryStatusEx GetEnvironmentVariableW GetSystemInfo WideCharToMultiByte DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionEx OpenEventW Module32NextW Module32FirstW GetNativeSystemInfo Process32NextW GetLongPathNameW Process32FirstW CreateToolhelp32Snapshot LoadLibraryW FindResourceExW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy lstrcmpA lstrcmpW LocalAlloc GetExitCodeProcess CreateProcessW GetFileInformationByHandle OpenMutexW CreateMutexW SystemTimeToFileTime SetEndOfFile RemoveDirectoryW GetFileSize SetFilePointer GetThreadLocale GetPrivateProfileSectionNamesW MoveFileW WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ReadFile LocalFree GetUserDefaultLangID UnmapViewOfFile OpenFileMappingW MapViewOfFile FormatMessageW GetLocalTime GetModuleHandleW GetProcAddress GetVolumeInformationW GetPrivateProfileStringW WritePrivateProfileStringW MoveFileExW CreateFileW GetCurrentThread GetCurrentProcess GetTempPathW OpenProcess CopyFileW WaitForSingleObject SetEvent GetTickCount64 CloseHandle CreateEventW SetLastError Sleep GetThreadPriority MultiByteToWideChar FindClose FindFirstFileW DeleteFileW lstrlenW SetFileAttributesW SetFileTime WriteFile GetLastError GlobalAlloc CreateDirectoryW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource OutputDebugStringW GetStringTypeW LCMapStringW GetCPInfo RtlUnwind GetDriveTypeW SetEnvironmentVariableW SetCurrentDirectoryW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA GetCommandLineW SetStdHandle GetFileType HeapQueryInformation GetStdHandle ExitProcess GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW CompareStringW

user32

DestroyMenu GetMonitorInfoW MonitorFromWindow WinHelpW UnhookWindowsHookEx GetTopWindow GetClassNameW GetClassLongW PtInRect MapWindowPoints AdjustWindowRectEx RemovePropW GetPropW SetPropW ShowScrollBar GetScrollPos RedrawWindow TrackPopupMenu SetMenu GetMenu GetCapture EndDeferWindowPos DeferWindowPos BeginDeferWindowPos IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos CopyRect GetSysColor ScreenToClient EndPaint BeginPaint ReleaseDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetDesktopWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IsDialogMessageW SetWindowLongW GetWindowTextLengthW SetFocus GetDlgCtrlID SetDlgItemTextW GetSysColorBrush ShowWindow GetLastActivePopup GetWindowLongW IsWindowEnabled CallNextHookEx SetWindowsHookExW ValidateRect GetKeyState DispatchMessageW TranslateMessage GetMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem PostQuitMessage CharUpperW GetMenuStringW OffsetRect SendDlgItemMessageA UnregisterClassW GetWindow FindWindowW ExitWindowsEx RegisterWindowMessageW RealChildWindowFromPoint InvalidateRect EnumWindows GetWindowTextW IsWindowVisible GetWindowThreadProcessId FindWindowExW SystemParametersInfoW SetActiveWindow DrawAnimatedRects SetForegroundWindow SetMenuDefaultItem ModifyMenuW GetMenuItemID GetMenuItemCount GetSubMenu ClientToScreen GetCursorPos LoadMenuW SetCursor DrawFocusRect InflateRect SetRectEmpty GetParent SetWindowTextW LoadCursorW GetActiveWindow DrawIcon GetClientRect GetSystemMetrics IsIconic PeekMessageW UpdateWindow GetFocus IsWindow SetTimer GetWindowRect SendMessageW LoadIconW EnableWindow PostMessageW SetWindowPos GetForegroundWindow KillTimer MessageBoxW GetDlgItem DestroyWindow

gdi32

ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx CreateBitmap GetDeviceCaps DeleteDC SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetTextColor GetTextExtentPoint32W CreateFontIndirectW GetObjectW SetMapMode SetBkMode SetBkColor SelectObject SaveDC RestoreDC RectVisible PtVisible GetStockObject GetClipBox Escape DeleteObject

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW RegCloseKey RegDeleteTreeW CopySid GetLengthSid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired OpenProcessToken RegQueryValueW RegEnumKeyW RegDeleteKeyW RegFlushKey ConvertSidToStringSidW LookupAccountNameW ControlService QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW CreateWellKnownSid RegCreateKeyW RegDeleteKeyExW LookupAccountSidW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameW RegCreateKeyExW RegQueryValueExW RegSetValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW CheckTokenMembership DuplicateToken OpenThreadToken

shell32

ShellExecuteW SHCreateDirectoryExW ShellExecuteExW SHFileOperationW Shell_NotifyIconW SHAppBarMessage SHGetFolderPathW

comctl32

_TrackMouseEvent InitCommonControlsEx

shlwapi

PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW SHDeleteKeyW

ole32

CoInitialize CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoCreateInstance OleRun CoCreateGuid

oleaut32

SysAllocString SysFreeString VariantClear SysAllocStringByteLen SysStringByteLen VariantInit VariantCopy VariantChangeType GetErrorInfo

urlmon

URLDownloadToFileW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock UnloadUserProfile

crypt32

CryptUnprotectData CryptProtectData CryptDecodeObject CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptQueryObject CryptMsgGetParam

wintrust

WinVerifyTrust

oleacc

LresultFromObject CreateStdAccessibleObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_044a5cf9f72f18c4cc5bb6ddc54e7666_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys

PE Signature issue

msi

psapi

version

wininet

sensapi

secur32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

userenv

crypt32

wintrust

oleacc

generic