General
- Target 2026-07-12_741c46fe0989d65df6051a32cc648f56_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys
- Size 1.5MB
- Sample260712-vdmp1adw7p
- SHA256 b7a6f8a0ae1fbef781bcf49109a8077a9d7137bd015465e1e25f3c8e7de24275
- MD5 741c46fe0989d65df6051a32cc648f56
- SHA1 1e08a570a1295b7d4adb5cbc82e359b3d22d2725
- SHA512 7b2b24db7115d31dcbc30c5eb212ef71a3733fb9a11314e1f04e771604108295d31a3d31f3f505f01092e79edff74e2b7aa76f96aa6f3d4a6c04b66a01abd6de
- SSDEEP 24576:xKP2pH7efRtJ3YeEAYOnwj1+M57Ef85PNMLasvqiaC:xKKe1YeEAYOW1+M5A83M+svqiaC
- TLSH T1B975081177E95A29F1FB2B71AEB851604A7B7C615F31C7CF13802A5E2970AC09936B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_741c46fe0989d65df6051a32cc648f56_amadey_avoslocker_darkgate_elex_hijackloader_luca-steale.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_741c46fe0989d65df6051a32cc648f56_amadey_avoslocker_darkgate_elex_hijackloader_luca-steale.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_741c46fe0989d65df6051a32cc648f56_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys
- Size 1.5MB
- SHA256 b7a6f8a0ae1fbef781bcf49109a8077a9d7137bd015465e1e25f3c8e7de24275
- MD5 741c46fe0989d65df6051a32cc648f56
- SHA1 1e08a570a1295b7d4adb5cbc82e359b3d22d2725
- SHA512 7b2b24db7115d31dcbc30c5eb212ef71a3733fb9a11314e1f04e771604108295d31a3d31f3f505f01092e79edff74e2b7aa76f96aa6f3d4a6c04b66a01abd6de
- SSDEEP 24576:xKP2pH7efRtJ3YeEAYOnwj1+M57Ef85PNMLasvqiaC:xKKe1YeEAYOW1+M5A83M+svqiaC
- TLSH T1B975081177E95A29F1FB2B71AEB851604A7B7C615F31C7CF13802A5E2970AC09936B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Modifies WinLogon