2026-06-30_54672638d072901c330d141e06bdeb47_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_54672638d072901c330d141e06bdeb47_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat
Size 989KB
Sample260701-flmyeaex3n
SHA256 f39d86ca3acf812924ffe083a95dee5269c4b72125dcee997bcdda13e5d613a6
MD5 54672638d072901c330d141e06bdeb47
SHA1 ea84b3227ecfa7c943cbd2de58f0bbcba3e9f537
SHA512 d9f4ce40b9c8822f84b3fc04f9ee458c756b20ebc38d38741df3ce1d194cfdc8d3ebf5414035ea37aeb187e1ce925bcff9f6893d400ba10d86cf50743e93c310
SSDEEP 12288:QE2JDNnwQd7KqZTOrIub0+DPwVxC3Yeba96ga8nXNBZmJ9W+:Q5nwQTZSMmPwS3Yijg/dBoi+
TLSH
T186250531706D4BB0EA48A07139341676487AAC085753F7B392DDB9A82131B9DBE34EF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-06-30_54672638d072901c330d141e06bdeb47_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat

.exe 989KB

2026-06-30_54672638d072901c330d141e06bdeb47_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat

IMPHASH c86ac4a7d73e7a94c76f67c463b65ed5
SHA256 f39d86ca3acf812924ffe083a95dee5269c4b72125dcee997bcdda13e5d613a6
MD5 54672638d072901c330d141e06bdeb47
SHA1 ea84b3227ecfa7c943cbd2de58f0bbcba3e9f537
SHA512 d9f4ce40b9c8822f84b3fc04f9ee458c756b20ebc38d38741df3ce1d194cfdc8d3ebf5414035ea37aeb187e1ce925bcff9f6893d400ba10d86cf50743e93c310
SSDEEP 12288:QE2JDNnwQd7KqZTOrIub0+DPwVxC3Yeba96ga8nXNBZmJ9W+:Q5nwQTZSMmPwS3Yijg/dBoi+
TLSH
T186250531706D4BB0EA48A07139341676487AAC085753F7B392DDB9A82131B9DBE34EF7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

d0:65:0c:45:61:13:3b:06:e6:30:a8:ce:96:9f:ef:2e:32:27:e0:7c:a1:41:d9:18:08:a0:52:af:d0:dd:2a:be

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=Boxborough,ST=Massachusetts,C=US

Chains

Nov 19, 2024

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=Boxborough,ST=Massachusetts,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=Boxborough,ST=Massachusetts,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

2a:13:64:08:f9:7b:99:26:4b:05:4b:c2:dc:ce:4e:d9:73:4d:9c:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=Boxborough,ST=Massachusetts,C=US

Chains

Nov 19, 2024

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=Boxborough,ST=Massachusetts,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=Boxborough,ST=Massachusetts,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=Boxborough,ST=Massachusetts,C=US

Serial Number

08:b6:cc:ae:35:74:69:6c:d3:28:f9:9a:1e:c2:1b:1d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2024 - Apr 4, 2027

Minor OS version

Major OS version

Entry point

57360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\build\thehoff\Raccoon_MR70.457421448654\Raccoon_MR7\vpn\Installer\WINXP\Setup\Win32\Release\Setup.pdb

msi

ord205 ord248 ord141 ord190

kernel32

VerifyVersionInfoW Sleep LoadLibraryW FindFirstFileW GetFullPathNameW FindNextFileW GetModuleFileNameW SetErrorMode GetTempPathW CreateMutexW FindClose CreateFileW GetFileAttributesW ReleaseMutex GetLocalTime SetUnhandledExceptionFilter VerSetConditionMask SetLastError MoveFileExW CreateProcessW CopyFileW SetDllDirectoryW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc HeapSize SetStdHandle LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection GetCurrentProcessId GetCurrentThreadId OutputDebugStringA LoadLibraryExW FreeLibrary FormatMessageW TlsFree TlsGetValue GetModuleHandleW LocalFree GetProcAddress CloseHandle TlsAlloc GetCurrentProcess TlsSetValue WideCharToMultiByte DeleteCriticalSection DecodePointer RaiseException DeleteFileW GetLastError MultiByteToWideChar InitializeCriticalSectionEx FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW TerminateProcess GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale IsDebuggerPresent OutputDebugStringW GetStringTypeW EncodePointer LCMapStringEx GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwind GetFileType GetCommandLineA GetCommandLineW ExitProcess GetModuleHandleExW GetStdHandle WriteFile SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

user32

GetDesktopWindow MessageBoxW ExitWindowsEx

advapi32

AllocateLocallyUniqueId CloseServiceHandle OpenSCManagerW ControlService OpenServiceW QueryServiceStatusEx DeregisterEventSource ReportEventA RegisterEventSourceA LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetThreadToken

shell32

ShellExecuteW

ole32

CoUninitialize CoInitializeEx

shlwapi

PathFindFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_54672638d072901c330d141e06bdeb47_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat

msi

kernel32

user32

advapi32

shell32

ole32

shlwapi

generic