2026-06-27_9bbec8b6f5df1fd56e89f82139b64961_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_9bbec8b6f5df1fd56e89f82139b64961_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 1.1MB
Sample260629-fa67xaev5p
SHA256 472536782eb03c001ea39586dcbfb05dc7392ab10922dcb2f2ab4bc09b7beea7
MD5 9bbec8b6f5df1fd56e89f82139b64961
SHA1 1529b5950530958aa402fbaad6996758e740bab8
SHA512 edbdb7f4647a6479fa74580c7131b05aa18c6c309c6492f71ebb5b77cc810cfc35b6e93fa4bbc5018e313f2db4656f5e5625974820af7cce12c9e90ff44a823d
SSDEEP 24576:KiJ4c0ree3ry/dsqVqO3cdAJAndN1u/tuK4VaT5sKrHpXd2J0vdYx6uL2Z:KiWNee3ry/dWFGAndeL4VatXJXd2Jkdb
TLSH
T1DC458D31F502D033F8E30076D6BE8B7AD92CA570036A54D7E3C458A95AB59D1BB3A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-06-27_9bbec8b6f5df1fd56e89f82139b64961_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-06-27_9bbec8b6f5df1fd56e89f82139b64961_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 1.1MB

2026-06-27_9bbec8b6f5df1fd56e89f82139b64961_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH aad07bc88163860a522fb28542fe116b
SHA256 472536782eb03c001ea39586dcbfb05dc7392ab10922dcb2f2ab4bc09b7beea7
MD5 9bbec8b6f5df1fd56e89f82139b64961
SHA1 1529b5950530958aa402fbaad6996758e740bab8
SHA512 edbdb7f4647a6479fa74580c7131b05aa18c6c309c6492f71ebb5b77cc810cfc35b6e93fa4bbc5018e313f2db4656f5e5625974820af7cce12c9e90ff44a823d
SSDEEP 24576:KiJ4c0ree3ry/dsqVqO3cdAJAndN1u/tuK4VaT5sKrHpXd2J0vdYx6uL2Z:KiWNee3ry/dWFGAndeL4VatXJXd2Jkdb
TLSH
T1DC458D31F502D033F8E30076D6BE8B7AD92CA570036A54D7E3C458A95AB59D1BB3A70B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8b:72:3e:62:35:c8:a1:a6:a8:e1:5f:7b:2a:7a:50:4e:93:d5:7a:2a:ad:01:c7:ad:6a:99:76:38:a0:07:9d:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Work Product Inc.,O=Work Product Inc.,L=Golden,ST=Colorado,C=US

Chains

Jan 1, 0001

Subject

CN=Work Product Inc.,O=Work Product Inc.,L=Golden,ST=Colorado,C=US

Serial Number

0e:f9:0b:20:6a:1b:07:82:e0:d0:fd:33:88:24:ec:42

Issuer

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 17, 2025 - Dec 16, 2026

Subject

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Serial Number

07:84:3d:ad:01:c1:15:c2:74:ee:41:a7:28:22:46:79

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 23, 2022 - Jun 22, 2032

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

789956

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerQueryValueW GetFileVersionInfoW

crypt32

CertOpenStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertCloseStore

ws2_32

gethostname recvfrom freeaddrinfo getaddrinfo listen htonl select ioctlsocket WSAIoctl WSASetLastError setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt __WSAFDIsSet sendto

wldap32

ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143 ord200 ord301

kernel32

IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ExitProcess SetFilePointerEx GetConsoleOutputCP ReadConsoleW GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW GetProcAddress GetModuleHandleW IsProcessorFeaturePresent LoadLibraryA GetModuleHandleA CreateThread CloseHandle GetUserDefaultLCID HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource EnumSystemLocalesW FindResourceW FindResourceExW WideCharToMultiByte GetModuleFileNameW MultiByteToWideChar GetFileSize ReadFile GetCurrentProcess IsWow64Process GetBinaryTypeW LocalFree CreateProcessW Sleep GetFileTime GetWindowsDirectoryW CreateToolhelp32Snapshot QueryFullProcessImageNameW FindFirstFileW FindClose GetTickCount CreateFileW WriteFile GetCommandLineA CreateMutexA GetLastError DeleteFileW OpenEventA CreateEventW SetEvent GetCurrentProcessId TerminateProcess InitializeCriticalSectionEx DecodePointer DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection QueryPerformanceFrequency SleepEx QueryPerformanceCounter GetFullPathNameW WriteConsoleW MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW FormatMessageW CreateFileA GetFileSizeEx CreateDirectoryW GetTimeZoneInformation SetLastError SetStdHandle SetEndOfFile GetCurrentDirectoryW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineW LoadResource GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapDestroy SetLastError GetSystemTimeAsFileTime IsDebuggerPresent OutputDebugStringW RaiseException GetCurrentThreadId EncodePointer LCMapStringEx TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA OpenServiceW OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RegOpenKeyExW RegQueryValueExW ConvertSidToStringSidW GetTokenInformation OpenProcessToken

shell32

SHGetKnownFolderPath SHGetFolderPathW

shlwapi

PathRemoveFileSpecA PathRemoveFileSpecW SHSetValueA PathAppendW PathFileExistsW SHDeleteValueA

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_9bbec8b6f5df1fd56e89f82139b64961_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat

PE Signature issue

version

crypt32

ws2_32

wldap32

kernel32

advapi32

shell32

shlwapi

generic