2026-07-27_0c51dec684ca130e81df1f84c8d94bea_amadey_avoslocker_darkgate_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_0c51dec684ca130e81df1f84c8d94bea_amadey_avoslocker_darkgate_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader
Size 1.3MB
Sample260727-dbw28avcne
SHA256 afa3b83a2cc5f2818a4fbfb047c05ebd7e882d61bedda0e4d5241737c0fe307f
MD5 0c51dec684ca130e81df1f84c8d94bea
SHA1 85fd18d688d0021e768696aa2d057e4cfd12aad7
SHA512 787a733687011167c2fe48f4c7a8828230cc62568991209c514f86dfb7a2228e0ba479b6a3d186a4941679360d5be1e490d8045fd8b2a69c1182c93c52b39a62
SSDEEP 24576:E2zEYytjjqNSlhvpfQiIhKPtehfQw99qySkbged3huo5NVoP1ovLW0Zna/0e0+K/:EPtjtQiIhUyQc1SkFdB6tKJG0zFIxRCc
TLSH
T1C555E012B592C033E0A211B15678AB769D7EBD340B3195DBA7C80B5D4E345C2AF36B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_0c51dec684ca130e81df1f84c8d94bea_amadey_avoslocker_darkgate_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-07-27_0c51dec684ca130e81df1f84c8d94bea_amadey_avoslocker_darkgate_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 1.3MB

2026-07-27_0c51dec684ca130e81df1f84c8d94bea_amadey_avoslocker_darkgate_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 99779933d13e7f3a0c46176caa0baa44
SHA256 afa3b83a2cc5f2818a4fbfb047c05ebd7e882d61bedda0e4d5241737c0fe307f
MD5 0c51dec684ca130e81df1f84c8d94bea
SHA1 85fd18d688d0021e768696aa2d057e4cfd12aad7
SHA512 787a733687011167c2fe48f4c7a8828230cc62568991209c514f86dfb7a2228e0ba479b6a3d186a4941679360d5be1e490d8045fd8b2a69c1182c93c52b39a62
SSDEEP 24576:E2zEYytjjqNSlhvpfQiIhKPtehfQw99qySkbged3huo5NVoP1ovLW0Zna/0e0+K/:EPtjtQiIhUyQc1SkFdB6tKJG0zFIxRCc
TLSH
T1C555E012B592C033E0A211B15678AB769D7EBD340B3195DBA7C80B5D4E345C2AF36B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

483197

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

\\cpbufs\transfer\aataneja\ReaderPOC\ReaderSolution\ReaderPOC\Release\ReaderPOC.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

msi

ord205 ord70

kernel32

CreateFileMappingA GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo CloseHandle HeapReAlloc DeleteFileW DeleteFileA GetVersionExA LoadLibraryA CreateFileA OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetVersionExW GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile LocalFree HeapFree HeapCreate ReadFile AreFileApisANSI InterlockedCompareExchange InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionEx RaiseException DecodePointer FindNextFileW GetModuleFileNameW FindClose GetCurrentProcess CreateEventW GetModuleHandleW TlsSetValue GetEnvironmentStringsW GetCommandLineW GetCommandLineA LockFileEx GetFileSize GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter TlsGetValue GetTickCount FlushFileBuffers GetLastError FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW TlsFree EncodePointer GetFullPathNameW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeZoneInformation ReadConsoleW GetConsoleMode SetFilePointerEx GetFileSizeEx GetFileType GetModuleHandleExW ExitProcess GetStdHandle LoadLibraryExW TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount SetLastError GetStringTypeW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter RtlUnwind GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentThreadId WaitForSingleObjectEx ResetEvent SetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter CompareStringW

advapi32

OpenServiceW OpenSCManagerW CloseServiceHandle RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW SHCreateDirectoryExW SHGetFolderPathAndSubDirW SHGetPathFromIDListW SHGetFolderLocation SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoCreateInstance CoCreateGuid CLSIDFromString CLSIDFromProgID CoUninitialize CoInitialize StringFromGUID2 OleRun

oleaut32

SysAllocString SysFreeString VariantClear VariantCopy GetErrorInfo VariantInit

shlwapi

PathFileExistsA PathAppendW PathFileExistsW PathIsDirectoryW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_0c51dec684ca130e81df1f84c8d94bea_amadey_avoslocker_darkgate_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader

version

msi

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

generic