1e445e1e68d5f302cedf058f098514b8039b956a6efa532c2d41716203bc005e

General

Target
2026-07-08_06381c53f02dc2aa46199e4a71f17efd_amadey_avoslocker_elex_luca-stealer_lynx_njrat_smoke-loader
Size 168KB
Sample260708-dfmpcahz9s
SHA256 1e445e1e68d5f302cedf058f098514b8039b956a6efa532c2d41716203bc005e
MD5 06381c53f02dc2aa46199e4a71f17efd
SHA1 4aebc1bf07c8df55f007601d326658875edf4699
SHA512 b19af48cbd53f42a624d04e569285d9025ad86627d9f6ebae300499e338696e01433bdbb61163aef1cc03fac2b55cc36fa8f876690ab1297fa067d8638317950
SSDEEP 3072:I+n0DHzR+tWXxYQvgCU6LvduQURUS9QoQ9d7KrcFGWfITg34Hi3:R6zQwXiuLvdjsUEJQ9P3Oi3
TLSH
T1E4F37B9136D08472E5B3293009B09AF1592EFD302B35AC9B6B81497E2E71DD39935F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\a7k9p2q-ReadMe.txt

Ransom Note

>>> All your important files have been ENCRYPTED <<< - The only way for restoring your files is through purchase of decryption software from us. - To restore your files, contact us by email. - Send your ID to all addresses below to get the fastest response client ID --> W2A5J1X5KP9HIHCB In order to start negotiations, Send message to our mailboxes: - Telegram:@SuppLockers You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. - qTox : 4101943D54538F8543D11FBCCA952FC76B5C3B0932BEB56D6EC42BE8EEF94E1DF82B94D8E968 >>> Your client ID:W2A5J1X5KP9HIHCB <<< Important Warnings: - Do not contact data recovery companies. They are middlemen who will charge you much more and scam you. - The sooner you contact us, the lower the recovery cost. - Do not rename, modify, or delete any encrypted files — doing so can make recovery impossible. - Do not use third-party tools to decrypt files. This will damage your data and make recovery permanently impossible. Time is critical. Send your ID to all email addresses for the quickest help.

URLs

https://tox.chat/download.html

Targets

- Target
  2026-07-08_06381c53f02dc2aa46199e4a71f17efd_amadey_avoslocker_elex_luca-stealer_lynx_njrat_smoke-loader
- Size 168KB
- SHA256 1e445e1e68d5f302cedf058f098514b8039b956a6efa532c2d41716203bc005e
- MD5 06381c53f02dc2aa46199e4a71f17efd
- SHA1 4aebc1bf07c8df55f007601d326658875edf4699
- SHA512 b19af48cbd53f42a624d04e569285d9025ad86627d9f6ebae300499e338696e01433bdbb61163aef1cc03fac2b55cc36fa8f876690ab1297fa067d8638317950
- SSDEEP 3072:I+n0DHzR+tWXxYQvgCU6LvduQURUS9QoQ9d7KrcFGWfITg34Hi3:R6zQwXiuLvdjsUEJQ9P3Oi3
- TLSH
  T1E4F37B9136D08472E5B3293009B09AF1592EFD302B35AC9B6B81497E2E71DD39935F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence ransomware spyware stealer
- Clears Windows event logs
  defense_evasion ransomware
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2