fbbf976738ea07cbe3860141e62e787bafb721a33a5a41c038e853c8809ead7b

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_489a4fe4e8c5c692b2c0f1861f1060c4_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe
Size 7.9MB
Sample260708-2e76nah13q
SHA256 fbbf976738ea07cbe3860141e62e787bafb721a33a5a41c038e853c8809ead7b
MD5 489a4fe4e8c5c692b2c0f1861f1060c4
SHA1 16bc0937ce36e0e4b69aaec6c93ad180cc3049aa
SHA512 8431b2bce3dab64ec680174475b0cc58e91d052aae63d3f3a741e11d893b0ae17d710499f0fa47c1274b32675608542beda38f63869731ba14435b63d320ecda
SSDEEP 196608:THBks/aTODF4wK7vwLyNRHRWcfbQAIxf9IKZ:THBksSTOawLyNlRR0AIx9Ig
TLSH
T139863311B6B1D0F6F29101700BB9E2FA59397D201F015AEB63E4BEA95E787C06A31737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2028	netsh.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-08_489a4fe4e8c5c692b2c0f1861f1060c4_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe

Loads dropped DLL 4 IoCs

pid	Process
916	2026-07-08_489a4fe4e8c5c692b2c0f1861f1060c4_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe
916	2026-07-08_489a4fe4e8c5c692b2c0f1861f1060c4_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe
916	2026-07-08_489a4fe4e8c5c692b2c0f1861f1060c4_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe
916	2026-07-08_489a4fe4e8c5c692b2c0f1861f1060c4_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_489a4fe4e8c5c692b2c0f1861f1060c4_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2028	916	2026-07-08_489a4fe4e8c5c692b2c0f1861f1060c4_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-08_489a4fe4e8c5c692b2c0f1861f1060c4_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_489a4fe4e8c5c692b2c0f1861f1060c4_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="DownloadSDKServer" dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\SDK\DownloadSDKServer.exe enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pub_store.dat

Path C:\ProgramData\Thunder Network\DownloadLib\pub_store.dat
Size 133B
SHA256 8ffcc084c6bc0ad211013e229b804ce2826e7536cdcfbdb0800f57148e43a744
MD5 372859882a3abe0eedb4750f3b64c32c
SHA1 a95d7b22f2b129d4d3898f81dd5a6860d55e2e63
SHA512 bdd5cbc56fde700c83f2d3a847a04d3d5e5a53d466d26df87113d82ef862797022d5f830e2fa91904943e271a265649f9671a6734924a8905bb8b47a68ef8b7b
TLSH
T14EC02B344E0AA420145D55E32124E9400435126E0271428C234FE5356102BC1071D609
MD5 SHA1 SHA512 TLSH

Submit Download

InstallEntry.dll

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\InstallEntry.dll
Size 1.1MB
SHA256 0cc4af38dbcc86efe7057fbabd97285f6cf08e76c80698ecc1c9cd3c8af620cc
MD5 9506651169ffd661c6f6e01870c449ce
SHA1 59af04b9619ec075bc1abeaa7308ceba01954bd3
SHA512 04c9c80238690b9cf600d9493952c3ef99650519b8d4af2bedd193fbe5a15e8011cda83953bb9869ad8a2aa0e543573fd23a0240f5057a419b1b3b3dc2b95153
SSDEEP 24576:8ieCZ1aWdNQqAzUKyq3fN729Mb6EUz3Hkv90BExUBqvJKbs+Nn:ReCZ1aWTQqAoBq3o9EUz3Hs902xUBqgd
TLSH
T193358D1092405137F9BB01715DBE62AD957CBF312B2190CBA3C4AE6E1F71AD2BA31367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\libcurl.dll
Size 706KB
SHA256 8fbb6e1c42d6ea9fb1f5651d0cad370cbd36fda89035568c460193b1ae316cdc
MD5 4b5dfd7e9ac50a741b5ac6102b30cbf5
SHA1 c3ae8f11f12b2160055a28ee8cd0f14d215864dc
SHA512 9099874416956b53bb7a8d63a215f0e40ae806d21bdad6fcdba002f35c5b3d8827c7d5e5c9500a356a7bdf7a3d402c3d8851dd0df69a72fed752277f32b210cc
SSDEEP 12288:Fqqa/+1vVBPwcuhY1N99FvRq9w9+qMA+1Jh7RrvBwXT0cqfswMSm:Mt/+B/Pwc2I99Fg9wozRryXgZb
TLSH
T18DF47C61BC81C032D2A3243592BDABB31C7D74322B3499CB639488B95F745D2B73A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libeay32.dll

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\libeay32.dll
Size 1.4MB
SHA256 e1fbb97ff3607d569d584f78ce77a9dd2cf64dca05aebdbf3e55c9711e07b3be
MD5 ff5c63efbba91a0eec9fc645da655b4c
SHA1 d225ceff3601b57add69df7d854b2348a8980255
SHA512 96b963823d7a28e4d4ecd703aa26ad3d3e1d4086e09a4cc08ca88c30c9b8ceb42b7daf184e33b9175f87a566e78028cca3e6ab90ed6537598677f27b15eefce5
SSDEEP 24576:bP7+KpPGpFwdp51AaHUzrFEUrCrhRgh4fnrvjHnhPUShTuTjCjstP/TqBlkcULQw:7t51AV4/gh4fvpvuOjstP/TqIcULQ3A
TLSH
T156659E07BF8199B2E5CF823C91B7977E9D3659119324C9C3CAA129A5CC316E0673F389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\resource\[email protected]
Size 1KB
SHA256 771391eaeea31ab1debc547ce1fa14c52302073794a06bacc548bed427ec568e
MD5 7fb51054d1cd663bbf8ffa55021b9249
SHA1 1a2fcef00117e64c3e5de0f523f5cb5aa2e241bf
SHA512 f715fa781457224bbe8497940c7b14ec2b18ce776f93029a13a9a2a984bb74fd1be543b32c8d9bec4c9d7bf70c739700e10898653a3a96ed581a13dece6f0bc0
TLSH
T11A214AF43540FCF6EB83E9693ED74D48A8CD41E016B0425D0C3384200829CD24AEDF70
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\resource\[email protected]
Size 1KB
SHA256 f94a832248565569da61bfe475617278b6ae428c2e09b4ae26348ac8ad87df2f
MD5 bcd9693086ebdc4b37dd532820133334
SHA1 11c4ce269648a1e4095f570218dcba74730bf8a1
SHA512 240c7398fce2e42ba45c88bbdec8f2c487534f14e1863a05bcc9972e75cf36d499cd160b6ddd99eb27c423ec8801e75f89a70d0ffe0fd9fac7921850dcc01938
TLSH
T12E31A8D32B14E546F36CD2B5C5B2E3493736114FC2A291AB1472E86D955581CCCFA2C1
MD5 SHA1 SHA512 TLSH

Submit Download

install_bkg.png

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\resource\install_bkg.png
Size 712KB
SHA256 7f49606de40353b0133028433c82995653a6d4d47f5deb0355320a37adf14d74
MD5 7fee676f9eaf162dca4298cf40a971db
SHA1 5e916d76d41a19967a7da5f06e4b5520961eede0
SHA512 5a8224799b9b9772ad2bafd0fba72f7dafb156ad220855dd2185dde94dd6f57122d4d4c9402a95cf8d18935fe48898e6527e1458dd258664b9cd3128aacafe8b
SSDEEP 12288:p+OqDDzMzM4V+NauuqgLe2SIJb03741RIkzW09gLmNoPjJvQwbcbAoeCgJrWcfV4:0OQDzMzMHNaukLJzFBS9mN8VX/o1O5mV
TLSH
T1A5F42375FD5889D287BE742FF8E190B73CB3983AA7912D0C14C736A136748459C263EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\resource\[email protected]
Size 3KB
SHA256 7a5a05255450f34bffd39d76bc7d41b45cba7744cc562becbeb7572b32bc11a1
MD5 0ccd101a1adfe7ca02da3efc092c1268
SHA1 780eb8cfe0fe81458f3b5fe8406979c7ad906206
SHA512 683ff65f5c659d65631d3488cb562de18e5d74eb338622a88a412b72e504473bb85b7f211a13d972754f4e604442c7d6bff4137a05475311197860b0fcfee211
TLSH
T10C5107F226131628DECCA72041D68072C92E917530CB9C754C86752C1DD2FDEBF01EA9
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\resource\[email protected]
Size 57KB
SHA256 d6be90ee217ce5e04acccbe8d9f3d2d84885614b9a06f7e018961d6a1e876b9e
MD5 5e1569f6cd728ed8b180e97de3bc2c28
SHA1 5bbb3b028cdbb5998359fac87521ca494f025576
SHA512 b19c85ebffdf4d1e01dd770a445526d14d643226b86902f6315bc502d91f4aa78ccebe87ba830ddbb82b20643f8bff7fb60bae3f5364716e4d67376881988f61
SSDEEP 1536:DbT86pWth2qCIKYSVxocFMYTrDaxz3rAv5Xkn9L:DbT5ie9Y4mupf2x7rAv5Unl
TLSH
T1C5430263DA1E0F92E399D3B0EEE71B68B33B3665514720313EE02D4952463FF162B562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\resource\[email protected]
Size 401B
SHA256 225be85473e09b7d08f8a58ccbe32bd39eb81547bdd703ca371115f9bfbe9c2c
MD5 e09ed94afcf7c13b7cc4c46dc8a338f7
SHA1 523ccbe8a343e61849421cbc1454c0e4bbf01dee
SHA512 c36f5bb553e36699d6817a0a19cc9ab998982b5cbc643918091a5c344d9e3407534fc3e1529c9ec5fd74fdc41d152e5a9d0741ce5877020fbd95c86bf34ae47f
TLSH
T124E026F23E88A52B8B180F3914D2505A2D7FCB2F36066C681BCEA0595151D0E928DBA2
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\resource\[email protected]
Size 1KB
SHA256 37cce4c15fcfd9b396db672e6f4f3e76ec38b0475193520b7a0873d9a79a8552
MD5 4a3714d2ab6132ec38427c5c979453f9
SHA1 7ea9b918e94025d9582669036158bb10365deecb
SHA512 4f614c61ff515294bfaa41d0f19f47c94e09b193c8aa01d162ec672d28877e73f93a5c3fc8719f51e340c8e3f8cf406401ecae2e6c91061ff871f95799c60501
TLSH
T1483118D17688A0E75B4A0B3FE3BEC720607F5B5CE0827145E1B930D078A278C578F261
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\resource\[email protected]
Size 1KB
SHA256 ced1e2b2d1c750d4a50517228f3b5701e8ead8baa7d7b85f218b4c9f7d37c400
MD5 4198fed68f06450799116ae88c2f4f70
SHA1 6132c3b3ee035c228b250da49f4a735dfbab07e1
SHA512 4ba22b18ceabd369750c45c0584bd9d3857824ffb2fceab8ba6ba3ea83245ddc04f990363fddc781448bfad1c209f5b16c1fbead778732958433970a44fef144
TLSH
T1332198D0F71045F7DA3F342541DE81A5457BAF690BC0EBB091BC101C637A5099E276F5
MD5 SHA1 SHA512 TLSH

Submit Download

ssleay32.dll

Path C:\Users\Admin\AppData\Local\Temp\OnlineInstall\12.4.12.4000\OnlineResource\ssleay32.dll
Size 371KB
SHA256 f3a288c5455b074fe9c9d5a160adeb49e84bbe1832b5fcbe8f26093215192f65
MD5 7456818a22dad2c0965580d8bbf4cabd
SHA1 548714607df2ec3b7c8a22cfba3a1776e6e80861
SHA512 13f6589bd9c0c60a3df63325c57e94129761adc558d1a65eb4c6e138e6155dd9dbe501d45edde282219dc357593458f5f84a29188d123dcb7770e7479f6a7e68
SSDEEP 6144:ei2wWNZIpLE8b643WlU03dn3Hg460la0C1bDTQ90IVgcQ7Ab/NXXN7zKDhz+Pi8O:x2wWNZIpLE8b6mWlU03d3Hg460laf1ns
TLSH
T19D848E03F68181B3E89A4B74317B6BB62D3E6A015B65C5D3CF60696C8D313C0A73DA9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads