General
- Target 2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos
- Size 2.6MB
- Sample260705-gr2t7aas8x
- SHA256 767f7486a3bc26252f58f770030cc721702715f00abf30c9138eadab2cc89dd4
- MD5 d0124bf7491afded1017baab23450258
- SHA1 f1ac3b7ac3acd6d34138bd630c36f2e44650c34e
- SHA512 8f678d2192707e13964a8cba29f4cddfed4cb5a189dba38b2e1f694dceb07e876be3830a1b40051407d57bb2e30b620148a5475e0129e04e8e9c1d510432d384
- SSDEEP 49152:nMvcUuh3Z4JvDrWABR52whLQPOecFrSJww3v7zoe+KYW:nSruh32JkwoQrS+s46P
- TLSH T14DC589102E7E8026F522863C095CA537D5BBBBDCBB1F499722B0263B1B63791452DB73
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe
Resource
win11ltsc2024-20260629-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos
- Size 2.6MB
- SHA256 767f7486a3bc26252f58f770030cc721702715f00abf30c9138eadab2cc89dd4
- MD5 d0124bf7491afded1017baab23450258
- SHA1 f1ac3b7ac3acd6d34138bd630c36f2e44650c34e
- SHA512 8f678d2192707e13964a8cba29f4cddfed4cb5a189dba38b2e1f694dceb07e876be3830a1b40051407d57bb2e30b620148a5475e0129e04e8e9c1d510432d384
- SSDEEP 49152:nMvcUuh3Z4JvDrWABR52whLQPOecFrSJww3v7zoe+KYW:nSruh32JkwoQrS+s46P
- TLSH T14DC589102E7E8026F522863C095CA537D5BBBBDCBB1F499722B0263B1B63791452DB73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks for any installed AV software in registry
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.