2026-06-06_b3755efbc3d41e57f35e69f9a5867167_amadey_avoslocker_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-06_b3755efbc3d41e57f35e69f9a5867167_amadey_avoslocker_elex_glassworm_luca-stealer_lynx_njrat
Size 1.0MB
Sample260606-kq6crsbs8w
SHA256 8a06ab1882653184179ba264f200c15662a1c68650ca1cd09f0017d66266fa46
MD5 b3755efbc3d41e57f35e69f9a5867167
SHA1 c4f71dff4f70682f4e7935497223d49e432d8996
SHA512 4fbddaf2d74b52d6685ec29fb6ee74fc61f4bf5031eb90f08dbf158077622c28e0c85e76d4c729bf4d9e13d52d4b3cbe4f72756637c1e161d61c77299bb2758b
SSDEEP 24576:wssssq7hJn+vxJ+KRdT0RA7eMJ6p6Y1A1sny2UJgoxR7j/4sw+ZbVd81N:wssssqFJn+vxNdJavYPgAtw+Zbb81N
TLSH
T18C358D32B842C033D6D101F1A2BDDFB69A6DA5341B7650C3A7E01EB54A305D2BB3DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-06-06_b3755efbc3d41e57f35e69f9a5867167_amadey_avoslocker_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-06-06_b3755efbc3d41e57f35e69f9a5867167_amadey_avoslocker_elex_glassworm_luca-stealer_lynx_njrat

.exe 1.0MB

2026-06-06_b3755efbc3d41e57f35e69f9a5867167_amadey_avoslocker_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 04ee791539ebaddd976916a8765dafb9
SHA256 8a06ab1882653184179ba264f200c15662a1c68650ca1cd09f0017d66266fa46
MD5 b3755efbc3d41e57f35e69f9a5867167
SHA1 c4f71dff4f70682f4e7935497223d49e432d8996
SHA512 4fbddaf2d74b52d6685ec29fb6ee74fc61f4bf5031eb90f08dbf158077622c28e0c85e76d4c729bf4d9e13d52d4b3cbe4f72756637c1e161d61c77299bb2758b
SSDEEP 24576:wssssq7hJn+vxJ+KRdT0RA7eMJ6p6Y1A1sny2UJgoxR7j/4sw+ZbVd81N:wssssqFJn+vxNdJavYPgAtw+Zbb81N
TLSH
T18C358D32B842C033D6D101F1A2BDDFB69A6DA5341B7650C3A7E01EB54A305D2BB3DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

42:61:c9:22:ed:47:73:60:05:50:39:12:ce:50:dd:74:17:32:e2:46:c1:d9:54:8f:98:d4:85:79:fd:c9:93:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Work Product Inc.,O=Work Product Inc.,L=Golden,ST=Colorado,C=US

Chains

Jan 1, 0001

Subject

CN=Work Product Inc.,O=Work Product Inc.,L=Golden,ST=Colorado,C=US

Serial Number

0e:f9:0b:20:6a:1b:07:82:e0:d0:fd:33:88:24:ec:42

Issuer

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 17, 2025 - Dec 16, 2026

Subject

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Serial Number

07:84:3d:ad:01:c1:15:c2:74:ee:41:a7:28:22:46:79

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 23, 2022 - Jun 22, 2032

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

697141

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerQueryValueW GetFileVersionInfoW

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken

crypt32

CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertGetNameStringA CertOpenStore CryptQueryObject

ws2_32

getsockopt send gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl select __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent

wldap32

ord27 ord46 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord217 ord26 ord22 ord41 ord50 ord45 ord60 ord211

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceA

kernel32

LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ExitProcess SetFilePointerEx GetConsoleOutputCP ReadConsoleW GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetLocaleInfoW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW IsValidLocale LoadLibraryExW GetProcAddress GetModuleHandleW IsProcessorFeaturePresent HeapFree EnumSystemLocalesW HeapSize GetLastError LoadLibraryA HeapReAlloc HeapAlloc DecodePointer CreateDirectoryW DeleteCriticalSection GetProcessHeap GetModuleHandleA CreateThread WaitForSingleObject CloseHandle SizeofResource LockResource LoadResource FindResourceW FindResourceExW WideCharToMultiByte GetModuleFileNameW MultiByteToWideChar GetFileSize ReadFile GetCurrentProcess IsWow64Process GetBinaryTypeW LocalFree CreateProcessW Sleep GetFileTime GetWindowsDirectoryW CreateToolhelp32Snapshot QueryFullProcessImageNameW FindFirstFileW FindClose GetTickCount CreateFileW WriteFile GetCommandLineA CreateMutexA DeleteFileW OpenEventA CreateEventW SetEvent GetCurrentProcessId TerminateProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection QueryPerformanceFrequency SleepEx WriteConsoleW SetLastError CreateFileA GetFullPathNameW MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW FormatMessageW GetFileSizeEx GetTimeZoneInformation FlushFileBuffers SetStdHandle SetEndOfFile GetCurrentDirectoryW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetUserDefaultLCID HeapDestroy GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW InitializeCriticalSectionEx QueryPerformanceCounter GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable IsDebuggerPresent OutputDebugStringW RaiseException GetCurrentThreadId EncodePointer LCMapStringEx TryAcquireSRWLockExclusive

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA OpenServiceW OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RegOpenKeyExW RegQueryValueExW ConvertSidToStringSidW GetTokenInformation OpenProcessToken

shell32

SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemFree

shlwapi

PathAppendW SHSetValueA PathFileExistsW PathRemoveFileSpecW SHDeleteValueA PathRemoveFileSpecA

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-06_b3755efbc3d41e57f35e69f9a5867167_amadey_avoslocker_elex_glassworm_luca-stealer_lynx_njrat

PE Signature issue

version

wtsapi32

crypt32

ws2_32

wldap32

iphlpapi

secur32

kernel32

advapi32

shell32

ole32

shlwapi

bcrypt

generic