2026-07-22_3bec3c8e0d2f81088ea0f8335903d3fd_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_3bec3c8e0d2f81088ea0f8335903d3fd_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat
Size 2.7MB
Sample260723-aearlsxdpd
SHA256 e83efcfb933fee1321d047e1a61cff020fccdec57f1bf944986a5fd852d9a049
MD5 3bec3c8e0d2f81088ea0f8335903d3fd
SHA1 07a3d3e7bbddd6523a86f09942fd1192d5eae3b7
SHA512 7686b3d04df2ba2689b0b6ee9cbcf0b9121416985ec817844bc48ef182cf0e48b936f66b86008ba1cfeb9c3f147bc0657954e6eee33b673dbe6b0fe535b225ca
SSDEEP 49152:IRWMLm5JJ+CNr7vded6eBAhm8UVrpJPP4qT+sHoUsWmyWTTloZUAbctFAyDmg27z:I8MLmR+CNlzUHohWmVThlAiD527BWG
TLSH
T1C2D5AF13B7C3C073EC924171557EDBAB58297A24072848CBE2D05E1D68E26D26F36B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_3bec3c8e0d2f81088ea0f8335903d3fd_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat

File Explorer

2026-07-22_3bec3c8e0d2f81088ea0f8335903d3fd_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat

.exe 2.7MB

2026-07-22_3bec3c8e0d2f81088ea0f8335903d3fd_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat

IMPHASH 8228b51f94e32d919543d0118d0ddc46
SHA256 e83efcfb933fee1321d047e1a61cff020fccdec57f1bf944986a5fd852d9a049
MD5 3bec3c8e0d2f81088ea0f8335903d3fd
SHA1 07a3d3e7bbddd6523a86f09942fd1192d5eae3b7
SHA512 7686b3d04df2ba2689b0b6ee9cbcf0b9121416985ec817844bc48ef182cf0e48b936f66b86008ba1cfeb9c3f147bc0657954e6eee33b673dbe6b0fe535b225ca
SSDEEP 49152:IRWMLm5JJ+CNr7vded6eBAhm8UVrpJPP4qT+sHoUsWmyWTTloZUAbctFAyDmg27z:I8MLmR+CNlzUHohWmVThlAiD527BWG
TLSH
T1C2D5AF13B7C3C073EC924171557EDBAB58297A24072848CBE2D05E1D68E26D26F36B6F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1293632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wa_3rd_party_host_32.pdb

kernel32

GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetTickCount64 SizeofResource GetModuleHandleExW GetModuleFileNameW LocalAlloc FreeResource LockResource LoadResource FindResourceW SetErrorMode LoadLibraryExW InitializeCriticalSectionEx Sleep GetWindowsDirectoryW GetEnvironmentStringsW GetCurrentDirectoryW SetCurrentDirectoryW FindFirstFileW FindNextFileW FindClose FileTimeToSystemTime GetFileTime GetVolumeNameForVolumeMountPointW GetLogicalDriveStringsW GetDriveTypeW DeviceIoControl GetSystemWindowsDirectoryW lstrcpyW GetModuleHandleW WaitForMultipleObjects CreateEventW SetEvent CreateNamedPipeW OpenProcess CreateThread GetOverlappedResult ConnectNamedPipe GetExitCodeProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW DisconnectNamedPipe CreateDirectoryW GetCurrentProcess CreateProcessW CopyFileW SetLastError lstrcpynW GetLocaleInfoW TerminateProcess GetTempFileNameW ExpandEnvironmentStringsW GetVersionExW GetTimeZoneInformation GetSystemDirectoryW ReleaseMutex CreateMutexA VirtualAlloc VirtualFree VirtualQuery WriteConsoleW ReadConsoleW SetStdHandle MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile AreFileApisANSI GetFullPathNameA SetFilePointer InitializeCriticalSection LeaveCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile DecodePointer FreeEnvironmentStringsW FindFirstFileExW SetEnvironmentVariableW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetOEMCP GetACP IsValidCodePage GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait GetModuleHandleA FreeLibraryAndExitThread UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStringTypeW DuplicateHandle GetCurrentThread GetExitCodeThread GetNativeSystemInfo QueryPerformanceFrequency EncodePointer QueueUserWorkItem InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetCPInfo CreateTimerQueue GetThreadTimes LoadLibraryExA

user32

PostThreadMessageW wsprintfW

advapi32

OpenSCManagerW EqualSid AllocateAndInitializeSid FreeSid CheckTokenMembership QueryServiceStatus OpenServiceW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW CloseServiceHandle GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation AccessCheck GetFileSecurityW DuplicateToken MapGenericMask LookupPrivilegeValueW AdjustTokenPrivileges RegSaveKeyW OpenProcessToken

ole32

CoSetProxyBlanket CoUninitialize CoInitializeEx CoCreateInstance IIDFromString CLSIDFromString CoAddRefServerProcess CoReleaseServerProcess OleRun

oleaut32

GetErrorInfo VariantTimeToSystemTime VariantClear SafeArrayCreateVector SafeArrayCreate SafeArrayLock VariantCopy SafeArrayPutElement SysAllocString SysFreeString SafeArrayGetDim SysStringLen SysAllocStringLen SafeArrayDestroy VariantInit SafeArrayGetElement SafeArrayUnlock

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

StrStrIW

wininet

HttpSendRequestW InternetConnectW InternetCloseHandle InternetOpenW InternetSetOptionW InternetReadFile HttpOpenRequestW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

406KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

636KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_3bec3c8e0d2f81088ea0f8335903d3fd_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat

kernel32

user32

advapi32

ole32

oleaut32

version

shlwapi

wininet

generic