2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar
Size 76.4MB
Sample260730-ejrcdasxbv
SHA256 74d852ad168db96db41f80bfac63d3161f5dcd5651f0e5fc9d8bcb24446b4105
MD5 06fb88fec63b1295f9ff7908371c639f
SHA1 cb5f8fb38861724210ac972f9fd880afbc2306c0
SHA512 49f0fc96b5614a1a7b7c5b0adfbfae071f9b15fda1735bfe4c4d766ae6bf714e86dc4f81f2773db4fe9b6436a0928697451821524593ffca257b2864bb1cab48
SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpO:9iLVelepClAy6uw3W0BEROh2nvv4
TLSH
T1EF08011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar

File Explorer

2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar

.exe 76.4MB

2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar

IMPHASH 63c11544893457fb321a43dc42728c6a
SHA256 74d852ad168db96db41f80bfac63d3161f5dcd5651f0e5fc9d8bcb24446b4105
MD5 06fb88fec63b1295f9ff7908371c639f
SHA1 cb5f8fb38861724210ac972f9fd880afbc2306c0
SHA512 49f0fc96b5614a1a7b7c5b0adfbfae071f9b15fda1735bfe4c4d766ae6bf714e86dc4f81f2773db4fe9b6436a0928697451821524593ffca257b2864bb1cab48
SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpO:9iLVelepClAy6uw3W0BEROh2nvv4
TLSH
T1EF08011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

359528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Faronics\morocco\Faronics_Hg\Deploy\Faronics-Deploy_CloudAgent\Source\bin\Release\FaronicsDeployAgent\Win32\FaronicsDeployAgent.pdb

comctl32

ord17

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteExW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

crypt32

CryptStringToBinaryA CryptBinaryToStringA

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

kernel32

LocalAlloc LockResource DeviceIoControl FindNextFileW LocalFree SetFilePointer SetEndOfFile InterlockedDecrement ReadFile GetCurrentProcess LoadLibraryW GetUserDefaultLangID SetLastError GetVersionExW GetExitCodeProcess TerminateProcess IsWow64Process ExpandEnvironmentStringsW GetCurrentProcessId Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GlobalLock GlobalAlloc GlobalUnlock GetComputerNameExW GlobalFree GetWindowsDirectoryW CreateThread GetSystemDefaultLCID GetLocaleInfoW GetTimeZoneInformation MapViewOfFile UnmapViewOfFile CreateFileMappingW MoveFileExW GetSystemWindowsDirectoryW FindClose GetPrivateProfileStringW CopyFileW GetFileAttributesW WritePrivateProfileStringW GetTempPathW GetPrivateProfileIntW CreateEventW RemoveDirectoryW GetSystemInfo LoadResource LeaveCriticalSection EnterCriticalSection SystemTimeToFileTime FileTimeToSystemTime InterlockedCompareExchange InterlockedExchange GetProcessHeap WriteConsoleW SetStdHandle HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize IsValidCodePage GetOEMCP GetACP GetCurrentThreadId TlsFree TlsSetValue TlsGetValue GetProcAddress SizeofResource GetSystemDirectoryW GetModuleHandleW WaitForSingleObject CreateDirectoryW CreateProcessW CloseHandle GetLocalTime CreateFileW WriteFile DeleteFileW OutputDebugStringA MoveFileW GetLastError lstrlenW MultiByteToWideChar GetBinaryTypeW GetModuleFileNameW Sleep WideCharToMultiByte OutputDebugStringW FindFirstFileW TlsAlloc FlushFileBuffers GetConsoleMode GetConsoleCP FindResourceW InitializeCriticalSection FindResourceExW ExitProcess HeapDestroy HeapCreate IsProcessorFeaturePresent GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW HeapAlloc RtlUnwind RaiseException GetCPInfo GetStartupInfoW HeapSetInformation GetStringTypeW EncodePointer DecodePointer DeleteCriticalSection HeapFree GetSystemTimeAsFileTime GetCommandLineW InterlockedIncrement

user32

GetDesktopWindow EndDialog InvalidateRect LoadIconW PtInRect BeginPaint SetFocus GetClientRect DialogBoxParamW SetWindowPos GetWindowRect SetTimer SetWindowRgn EndPaint GetSystemMetrics ShowWindow SendMessageW SetWindowTextW MoveWindow wsprintfW MessageBoxExW ExitWindowsEx KillTimer

gdi32

SelectObject Rectangle CreateRoundRectRgn CreatePen CreateSolidBrush DeleteObject

advapi32

DeregisterEventSource RegCreateKeyExA ReportEventW RegOpenKeyExA RegisterEventSourceW RegCreateKeyA RegDeleteKeyW RegCreateKeyExW LookupAccountSidW ConvertStringSidToSidW RegQueryInfoKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken QueryServiceConfigW ControlService QueryServiceStatus StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW

ole32

CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CLSIDFromProgID CoCreateInstance CoInitialize CoUninitialize

oleaut32

VariantTimeToSystemTime VarCmp SysStringByteLen VariantChangeType SysAllocStringByteLen SysStringLen SysFreeString VariantInit VariantClear SysAllocString VariantCopy

shlwapi

PathGetArgsW PathAddBackslashW StrTrimW PathRemoveFileSpecW StrStrIW PathUnquoteSpacesW PathQuoteSpacesW PathRemoveArgsW PathFileExistsW

winhttp

WinHttpSetCredentials WinHttpReadData WinHttpOpenRequest WinHttpOpen WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpSetOption WinHttpReceiveResponse WinHttpSendRequest

msi

ord119 ord163 ord17 ord160 ord20 ord158 ord125 ord115 ord32 ord118 ord8 ord92 ord159

gdiplus

GdiplusStartup GdipCreatePen1 GdipCreatePath GdipCloneImage GdipCreateFromHDC GdipCreateFontFamilyFromName GdipDrawString GdipDeletePath GdipCreateFont GdiplusShutdown GdipDeleteBrush GdipFree GdipDeletePen GdipCloneBrush GdipStartPathFigure GdipCreateBitmapFromStream GdipSetTextRenderingHint GdipDrawPath GdipDisposeImage GdipAlloc GdipDrawImageI GdipCreateSolidFill GdipAddPathArcI GdipDeleteFontFamily GdipAddPathLineI GdipClosePathFigure GdipSetSmoothingMode GdipDeleteGraphics GdipDeleteFont

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar

comctl32

shell32

version

crypt32

rpcrt4

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

winhttp

msi

gdiplus

generic