2026-07-07_bd89f06dc1f01543b7d68d161031839f_amadey_avoslocker_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_bd89f06dc1f01543b7d68d161031839f_amadey_avoslocker_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader
Size 384KB
Sample260707-l1avaact7m
SHA256 7dd9ffae6a8e8f1ca7fdecad3c9e67638cd7511ce4aa21a1762108a073138d4b
MD5 bd89f06dc1f01543b7d68d161031839f
SHA1 a11cea89a348fa3e436fc09562be8cfda34ec6d1
SHA512 58ea557a680c216e1b7195c634d4af5a117acc0fbedbc0206fbc7cf1fd8fa584f107e3eadfb1f15a85a8e5d063b2d07bb2f48b7005ad49301fde32b659762b89
SSDEEP 6144:LCmbTG1ZITNbmpvO/AlGzW2fStBVVbMrV96u+O7024OeQ0emMJ5dFCA:LpW1C5mpvO/AlGzW2aopo5O7AjMvdFC
TLSH
T13684BE11B682C832D5A2493068F4DBA2A579BD345F631AD7734C3F6A7F307D10A28E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_bd89f06dc1f01543b7d68d161031839f_amadey_avoslocker_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader

File Explorer

2026-07-07_bd89f06dc1f01543b7d68d161031839f_amadey_avoslocker_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader

.exe 384KB

2026-07-07_bd89f06dc1f01543b7d68d161031839f_amadey_avoslocker_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader

IMPHASH d4950a6515a7b05edf7fd279c8bec956
SHA256 7dd9ffae6a8e8f1ca7fdecad3c9e67638cd7511ce4aa21a1762108a073138d4b
MD5 bd89f06dc1f01543b7d68d161031839f
SHA1 a11cea89a348fa3e436fc09562be8cfda34ec6d1
SHA512 58ea557a680c216e1b7195c634d4af5a117acc0fbedbc0206fbc7cf1fd8fa584f107e3eadfb1f15a85a8e5d063b2d07bb2f48b7005ad49301fde32b659762b89
SSDEEP 6144:LCmbTG1ZITNbmpvO/AlGzW2fStBVVbMrV96u+O7024OeQ0emMJ5dFCA:LpW1C5mpvO/AlGzW2aopo5O7AjMvdFC
TLSH
T13684BE11B682C832D5A2493068F4DBA2A579BD345F631AD7734C3F6A7F307D10A28E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\source\repos\CSOLauncher2\Release\CSOLauncher2.pdb

ole32

OleInitialize CreateStreamOnHGlobal CoCreateInstance OleSetContainedObject OleUninitialize

oleaut32

SysFreeString VariantInit SysAllocString

kernel32

CreateMutexW CreateFileW GetFileAttributesW SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetLastError Process32NextW LoadLibraryA LockResource GlobalAlloc DeleteFileW Process32FirstW CloseHandle CreateThread LoadResource FindResourceW GetProcAddress GlobalLock MoveFileExW GetFileSize GetCurrentProcessId FreeLibrary CopyFileW SetFilePointer GetSystemTimeAsFileTime GlobalUnlock MoveFileW GetProcessHeap LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc GetModuleFileNameW OutputDebugStringA WriteFile GetFullPathNameW SizeofResource ReadFile SetStdHandle CreateDirectoryW GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer WideCharToMultiByte WriteConsoleW HeapFree GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue HeapSize TlsGetValue TlsAlloc EncodePointer SetLastError RaiseException RtlUnwind InitializeSListHead GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount HeapReAlloc LeaveCriticalSection EnterCriticalSection

user32

RegisterClassW GetMessageW DefWindowProcW PostMessageW DestroyWindow EndPaint BeginPaint GetCursorPos ReleaseDC InvalidateRect UpdateWindow PostQuitMessage GetDC SetCursor LoadCursorW TranslateMessage KillTimer SetTimer DispatchMessageW GetSystemMetrics ScreenToClient CreateWindowExW MessageBoxW

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt DeleteDC DeleteObject BitBlt

advapi32

RegSetKeyValueW CryptAcquireContextW RegDeleteKeyValueW CryptCreateHash CryptHashData CryptDestroyHash RegGetValueW CryptGetHashParam CryptReleaseContext

shell32

ShellExecuteW

gdiplus

GdipCreatePen1 GdipCreateBitmapFromScan0 GdipDeletePen GdipDeleteFont GdipFillRectangleI GdipGetImageGraphicsContext GdipCloneBrush GdipSetTextRenderingHint GdipFillEllipseI GdipCreateFromHDC GdipDrawString GdipFree GdipCreateHBITMAPFromBitmap GdipDrawLine GdipCreateSolidFill GdipCreateFont GdipSetSmoothingMode GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipDrawEllipseI GdipDeleteBrush GdipCloneImage GdipCreateFontFamilyFromName GdipGetImageHeight GdipDeleteFontFamily GdiplusShutdown GdiplusStartup GdipLoadImageFromStream GdipGetImageWidth GdipDeleteGraphics

wininet

InternetSetOptionW InternetReadFile HttpQueryInfoA InternetOpenUrlA InternetCloseHandle InternetOpenA HttpQueryInfoW InternetQueryDataAvailable

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_bd89f06dc1f01543b7d68d161031839f_amadey_avoslocker_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader

ole32

oleaut32

kernel32

user32

gdi32

advapi32

shell32

gdiplus

wininet

generic