2026-07-20_913d82d1e5dbde7bf9d76b99ab3298a5_amadey_avoslocker_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_913d82d1e5dbde7bf9d76b99ab3298a5_amadey_avoslocker_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat
Size 1.7MB
Sample260720-vv4pvaa17v
SHA256 3ae9bc443f016a63f2634fb6dcfc94b05e85dc955c3d274a6d90234125c0bdca
MD5 913d82d1e5dbde7bf9d76b99ab3298a5
SHA1 3c45028e18af4fd2ee987c313534d9db93dc98e5
SHA512 89fddacfcf2cf19739fc36e51131ff0998a4dd4aad6f233067aef48d1a0be1669d98375183a897ecb595d0db13266d3bb0c8cb44a7af05313a03d3f81dd69874
SSDEEP 49152:um8TEQli+c49yIXQy74XIrMVKE7TqlJJtCw/69:uKQli+c49yIXL74YrVlJJs
TLSH
T17F857C32FD468335D0324130B2ADA37592FB75B55B7352CBDFE06A2D2A709819A11E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_913d82d1e5dbde7bf9d76b99ab3298a5_amadey_avoslocker_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat

File Explorer

2026-07-20_913d82d1e5dbde7bf9d76b99ab3298a5_amadey_avoslocker_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat

.exe 1.7MB

2026-07-20_913d82d1e5dbde7bf9d76b99ab3298a5_amadey_avoslocker_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat

IMPHASH 7f26e28f910b1fa1e9b9c10e2469e7b8
SHA256 3ae9bc443f016a63f2634fb6dcfc94b05e85dc955c3d274a6d90234125c0bdca
MD5 913d82d1e5dbde7bf9d76b99ab3298a5
SHA1 3c45028e18af4fd2ee987c313534d9db93dc98e5
SHA512 89fddacfcf2cf19739fc36e51131ff0998a4dd4aad6f233067aef48d1a0be1669d98375183a897ecb595d0db13266d3bb0c8cb44a7af05313a03d3f81dd69874
SSDEEP 49152:um8TEQli+c49yIXQy74XIrMVKE7TqlJJtCw/69:uKQli+c49yIXL74YrVlJJs
TLSH
T17F857C32FD468335D0324130B2ADA37592FB75B55B7352CBDFE06A2D2A709819A11E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

aa:39:45:ad:f7:6d:b2:29:14:d6:da:3b:54:df:dd:40:e9:23:a5:7b:a5:87:1b:34:a5:59:df:f4:03:13:ba:8f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=WildTangent\, Inc.,O=WildTangent\, Inc.,L=Redmond,ST=Washington,C=US

Chains

Feb 9, 2023

CN=WildTangent\, Inc.,O=WildTangent\, Inc.,L=Redmond,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=WildTangent\, Inc.,O=WildTangent\, Inc.,L=Redmond,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=WildTangent\, Inc.,O=WildTangent\, Inc.,L=Redmond,ST=Washington,C=US

Serial Number

04:b9:0e:0d:85:6d:c8:dd:88:a2:35:7a:d1:5d:0f:af

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2022 - Mar 21, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

495511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\bamboo-agent-home-2\xml-data\build-dir\PGSC-MON-JOB1\Monolith\Build\WTHelper\Release\WildTangentHelperService.pdb

kernel32

CreateFileMappingA OpenFileMappingA GetModuleHandleA FlushFileBuffers SetFilePointerEx FormatMessageW GetPrivateProfileStringW WritePrivateProfileStringW CreateFileA GetVolumeInformationA DeviceIoControl GetWindowsDirectoryA GetFullPathNameW TerminateProcess GetExitCodeProcess GetGeoInfoW GetUserGeoID GetSystemDefaultUILanguage CreateProcessW GetSystemDirectoryW SetWaitableTimer CreateWaitableTimerW GetLocalTime GetFileAttributesExW ResumeThread InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute CreateMutexA GetPrivateProfileSectionNamesW SystemTimeToFileTime GetSystemTime FileTimeToLocalFileTime MoveFileW CopyFileW GetFileSizeEx FormatMessageA CreateSemaphoreW ReleaseSemaphore GetUserDefaultUILanguage WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA K32EnumProcesses GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW IsWow64Process GetNativeSystemInfo GetVersionExW GetTickCount WideCharToMultiByte WriteFile SetFilePointer SetEndOfFile ReadFile GetFileSize DuplicateHandle SetFileAttributesW RemoveDirectoryW GetFileAttributesW GetCurrentDirectoryW OutputDebugStringW UnmapViewOfFile MapViewOfFile OpenFileMappingW CreateFileMappingW VirtualQuery GetSystemInfo WaitForMultipleObjects OpenMutexW CreateMutexW ReleaseMutex ResetEvent TerminateThread CreateThread CreateEventW GetCommandLineW SetEvent SetErrorMode CheckRemoteDebuggerPresent IsDebuggerPresent GetCurrentProcess LocalFree GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar lstrcmpiW FreeLibrary K32GetProcessImageFileNameW GetCurrentProcessId OpenProcess VerifyVersionInfoW VerSetConditionMask DeleteCriticalSection GetModuleHandleW GetProcAddress SetLastError WTSGetActiveConsoleSessionId FindNextFileW DeleteFileW GetSystemTimeAsFileTime FindClose FindFirstFileW CloseHandle ReadDirectoryChangesW CancelIoEx CreateFileW Sleep GetTickCount64 GetCurrentThread DecodePointer WaitForSingleObject CreateDirectoryW GetCurrentThreadId HeapDestroy GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx GetLastError RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetStdHandle GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW MoveFileExW GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetStringTypeW InitOnceComplete InitOnceBeginInitialize LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OpenMutexA GetOEMCP

user32

ReleaseDC GetDC GetSystemMetrics MessageBoxW TranslateMessage DispatchMessageW GetMessageW CallWindowProcW CreateWindowExW PeekMessageW SetWindowLongW DefWindowProcW LoadCursorW GetClassInfoExW RegisterClassExW PostQuitMessage CharNextW SetTimer KillTimer LoadStringW EnumDisplaySettingsW GetWindowLongW CharUpperW UnregisterClassW PostThreadMessageW

gdi32

GetDeviceCaps

advapi32

RegEnumValueW MakeSelfRelativeSD CryptGetHashParam RegSetValueExA RegSetKeySecurity RegQueryValueExA RegOpenKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA ImpersonateSelf CryptGenRandom SetTokenInformation CreateProcessAsUserW CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptSetKeyParam CryptDestroyKey CryptDeriveKey CryptReleaseContext CryptAcquireContextW OpenProcessToken BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW RegisterServiceCtrlHandlerW DeleteService StartServiceCtrlDispatcherW RegQueryValueExW SetServiceStatus SetServiceObjectSecurity SetEntriesInAclW CreateWellKnownSid QueryServiceObjectSecurity StartServiceW ControlService QueryServiceStatusEx DeregisterEventSource ReportEventW RegisterEventSourceW CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW CreateServiceW OpenServiceW OpenSCManagerW InitializeSecurityDescriptor GetSecurityDescriptorControl GetSecurityDescriptorSacl SetSecurityDescriptorDacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetAce GetAclInformation IsValidSid GetLengthSid CopySid GetSidSubAuthority InitializeSid GetSidLengthRequired RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW GetUserNameW RegEnumKeyW RegOpenCurrentUser RegOpenKeyExW RegCloseKey RevertToSelf ImpersonateLoggedOnUser OpenThreadToken MakeAbsoluteSD InitializeAcl GetSecurityDescriptorLength RegEnumKeyExA RegQueryInfoKeyA AddAce

shell32

SHChangeNotify ShellExecuteExW SHGetKnownFolderPath SHGetFolderPathW

ole32

OleRun CoInitializeEx StringFromCLSID CoSetProxyBlanket CLSIDFromString CoUninitialize CoRegisterClassObject CoRevokeClassObject CoCreateInstance StringFromGUID2 CoAddRefServerProcess CoReleaseServerProcess CoResumeClassObjects CoInitializeSecurity CoTaskMemAlloc CoTaskMemRealloc CoInitialize CoTaskMemFree

oleaut32

GetErrorInfo VarUI4FromStr SysStringLen UnRegisterTypeLi SysAllocString LoadTypeLi RegisterTypeLi VariantInit VariantClear VariantChangeType SysAllocStringLen SysStringByteLen SysAllocStringByteLen SystemTimeToVariantTime VariantTimeToSystemTime SysFreeString VarBstrCmp

shlwapi

StrStrIW PathGetArgsW PathUnquoteSpacesW PathCombineW PathFileExistsW PathStripToRootW PathFindOnPathW PathCanonicalizeW PathFindFileNameW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSQuerySessionInformationW WTSRegisterSessionNotification WTSUnRegisterSessionNotification

secur32

GetUserNameExW

rpcrt4

UuidCreate

wininet

InternetGetConnectedState InternetCrackUrlW HttpAddRequestHeadersA HttpOpenRequestA InternetQueryOptionA InternetGetLastResponseInfoA HttpQueryInfoA InternetConnectA InternetCloseHandle InternetOpenA InternetConnectW InternetQueryOptionW HttpOpenRequestW InternetReadFile HttpSendRequestA

ws2_32

gethostbyname WSAStartup getpeername WSAAddressToStringW ntohl

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

crypt32

CertNameToStrW CryptQueryObject CryptMsgClose CryptMsgGetAndVerifySigner CertFreeCertificateContext

wintrust

WinVerifyTrust

Name

.text

Size

890KB

Virtual Size

889KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pecode

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

266KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gchr

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

366KB

Virtual Size

365KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_913d82d1e5dbde7bf9d76b99ab3298a5_amadey_avoslocker_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

userenv

wtsapi32

secur32

rpcrt4

wininet

ws2_32

iphlpapi

version

crypt32

wintrust

generic