2026-06-25_7ae77d7d0491c6b48634b2e7c7a2864a_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-25_7ae77d7d0491c6b48634b2e7c7a2864a_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat
Size 1.5MB
Sample260629-1ef7hagy6r
SHA256 6aea348a0b5ba0609f438fc1c4285e9277612571832a2ea4747ca0b049f75b9f
MD5 7ae77d7d0491c6b48634b2e7c7a2864a
SHA1 67791d045c0a3aca582b68dcb6b69f6f95e84a7d
SHA512 d0e69cf031c9235ae51e807fb006ad2738eec2317960878fe40e6cb3319de94c6480450636c2493350385695d441de978996f3a1e99e875318db991b2942a4d0
SSDEEP 24576:3KP2pH7efRtJ3YeEAYOnwj1+M57Ef85PNMLasvqiac:3KKe1YeEAYOW1+M5A83M+svqiac
TLSH
T1B375081177E95A29F1FB2B71AEB851604A7B7C615F31C7CF13802A5E2970AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-25_7ae77d7d0491c6b48634b2e7c7a2864a_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat

File Explorer

2026-06-25_7ae77d7d0491c6b48634b2e7c7a2864a_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat

.exe 1.5MB

2026-06-25_7ae77d7d0491c6b48634b2e7c7a2864a_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat

IMPHASH 5bf7e763ccf9c352a68ccdf335b6cd41
SHA256 6aea348a0b5ba0609f438fc1c4285e9277612571832a2ea4747ca0b049f75b9f
MD5 7ae77d7d0491c6b48634b2e7c7a2864a
SHA1 67791d045c0a3aca582b68dcb6b69f6f95e84a7d
SHA512 d0e69cf031c9235ae51e807fb006ad2738eec2317960878fe40e6cb3319de94c6480450636c2493350385695d441de978996f3a1e99e875318db991b2942a4d0
SSDEEP 24576:3KP2pH7efRtJ3YeEAYOnwj1+M57Ef85PNMLasvqiac:3KKe1YeEAYOW1+M5A83M+svqiac
TLSH
T1B375081177E95A29F1FB2B71AEB851604A7B7C615F31C7CF13802A5E2970AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ff:14:34:b9:a5:d2:4b:04:f0:f9:30:9a:a2:18:ff:9e:7c:43:62:1d:34:a2:bd:a5:30:df:26:e8:fb:2d:8d:bd

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 25, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1a:34:0f:78:d7:d0:00:e0:89:fd:ba:ad:65:22:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

441904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARM.pdb

msi

ord114 ord16 ord120 ord123 ord205 ord159 ord160 ord141 ord8 ord118 ord171 ord92 ord116 ord115 ord119 ord88 ord240 ord131 ord150 ord78 ord70 ord181 ord195 ord32 ord281

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses GetModuleFileNameExW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW HttpQueryInfoW InternetReadFile InternetCrackUrlW InternetOpenW InternetConnectW HttpOpenRequestW HttpSendRequestW InternetErrorDlg InternetSetOptionW InternetCloseHandle

sensapi

IsNetworkAlive

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer

kernel32

GlobalLock GlobalUnlock GlobalFree MulDiv FlushFileBuffers GetFullPathNameW LockFile UnlockFile DuplicateHandle LoadLibraryExW LoadLibraryA GetCurrentThreadId GetVersionExW FreeLibrary GlobalDeleteAtom SetThreadPriority SuspendThread ResumeThread GetPrivateProfileIntW GlobalAddAtomW EncodePointer GetSystemDirectoryW GlobalFindAtomW GetModuleHandleA FileTimeToLocalFileTime FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW GetFileSizeEx GetFileTime InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc SetErrorMode GetCurrentDirectoryW GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags GetUserDefaultLCID ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleFileNameW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetACP ExpandEnvironmentStringsW GetCurrentProcessId ProcessIdToSessionId GlobalMemoryStatusEx GetEnvironmentVariableW GetSystemInfo WideCharToMultiByte DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionEx Module32NextW Module32FirstW GetNativeSystemInfo Process32NextW GetLongPathNameW Process32FirstW CreateToolhelp32Snapshot LoadLibraryW FindResourceExW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy lstrcmpA lstrcmpW LocalAlloc GetExitCodeProcess CreateProcessW GetFileInformationByHandle OpenMutexW CreateMutexW SystemTimeToFileTime SetEndOfFile RemoveDirectoryW GetFileSize SetFilePointer GetThreadLocale GetPrivateProfileSectionNamesW MoveFileW WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ReadFile LocalFree GetUserDefaultLangID UnmapViewOfFile OpenFileMappingW MapViewOfFile FormatMessageW GetLocalTime GetModuleHandleW GetProcAddress GetVolumeInformationW GetPrivateProfileStringW WritePrivateProfileStringW MoveFileExW CreateFileW GetCurrentThread GetCurrentProcess OpenProcess CopyFileW GetTickCount64 GetTempPathW SetLastError WaitForSingleObject SetEvent OpenEventW CloseHandle CreateEventW Sleep GetThreadPriority MultiByteToWideChar FindClose FindFirstFileW DeleteFileW lstrlenW SetFileAttributesW SetFileTime WriteFile GetLastError GlobalAlloc CreateDirectoryW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource OutputDebugStringW GetStringTypeW LCMapStringW GetCPInfo RtlUnwind GetDriveTypeW SetEnvironmentVariableW SetCurrentDirectoryW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA GetCommandLineW SetStdHandle GetFileType HeapQueryInformation GetStdHandle ExitProcess GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW CompareStringW

user32

DestroyMenu GetMonitorInfoW MonitorFromWindow WinHelpW UnhookWindowsHookEx GetTopWindow GetClassNameW GetClassLongW PtInRect MapWindowPoints AdjustWindowRectEx RemovePropW GetPropW SetPropW ShowScrollBar GetScrollPos RedrawWindow TrackPopupMenu SetMenu GetMenu GetCapture EndDeferWindowPos DeferWindowPos BeginDeferWindowPos IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos CopyRect GetSysColor ScreenToClient EndPaint BeginPaint ReleaseDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetDesktopWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IsDialogMessageW SetWindowLongW GetWindowTextLengthW SetFocus GetDlgCtrlID SetDlgItemTextW GetSysColorBrush ShowWindow GetLastActivePopup GetWindowLongW IsWindowEnabled LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem CallNextHookEx SetWindowsHookExW ValidateRect GetKeyState DispatchMessageW TranslateMessage GetMessageW PostQuitMessage CharUpperW GetMenuStringW OffsetRect SendDlgItemMessageA UnregisterClassW GetWindow FindWindowW ExitWindowsEx RegisterWindowMessageW RealChildWindowFromPoint InvalidateRect EnumWindows GetWindowTextW IsWindowVisible GetWindowThreadProcessId FindWindowExW SystemParametersInfoW SetActiveWindow DrawAnimatedRects SetForegroundWindow SetMenuDefaultItem ModifyMenuW GetMenuItemID GetMenuItemCount GetSubMenu ClientToScreen GetCursorPos LoadMenuW SetCursor DrawFocusRect InflateRect SetRectEmpty GetParent SetWindowTextW LoadCursorW GetActiveWindow DrawIcon GetClientRect GetSystemMetrics IsIconic PeekMessageW UpdateWindow GetFocus IsWindow SetTimer GetWindowRect SendMessageW LoadIconW EnableWindow PostMessageW SetWindowPos GetForegroundWindow KillTimer MessageBoxW GetDlgItem DestroyWindow

gdi32

ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx CreateBitmap GetDeviceCaps DeleteDC SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetTextColor GetTextExtentPoint32W CreateFontIndirectW GetObjectW SetMapMode SetBkMode SetBkColor SelectObject SaveDC RestoreDC RectVisible PtVisible GetStockObject GetClipBox Escape DeleteObject

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW RegCloseKey RegDeleteTreeW CopySid GetLengthSid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired OpenProcessToken RegQueryValueW RegEnumKeyW RegDeleteKeyW RegFlushKey ConvertSidToStringSidW LookupAccountNameW ControlService QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW CreateWellKnownSid RegCreateKeyW RegDeleteKeyExW LookupAccountSidW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameW RegCreateKeyExW RegQueryValueExW RegSetValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW CheckTokenMembership DuplicateToken OpenThreadToken

shell32

ShellExecuteW SHCreateDirectoryExW ShellExecuteExW SHFileOperationW Shell_NotifyIconW SHAppBarMessage SHGetFolderPathW

comctl32

_TrackMouseEvent InitCommonControlsEx

shlwapi

PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW SHDeleteKeyW

ole32

CoInitialize CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoCreateInstance OleRun CoCreateGuid

oleaut32

SysAllocString SysFreeString VariantClear SysAllocStringByteLen SysStringByteLen VariantInit VariantCopy VariantChangeType GetErrorInfo

urlmon

URLDownloadToFileW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock UnloadUserProfile

crypt32

CryptUnprotectData CryptProtectData CryptDecodeObject CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptQueryObject CryptMsgGetParam

wintrust

WinVerifyTrust

oleacc

LresultFromObject CreateStdAccessibleObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-25_7ae77d7d0491c6b48634b2e7c7a2864a_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat

PE Signature issue

msi

psapi

version

wininet

sensapi

secur32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

userenv

crypt32

wintrust

oleacc

generic