2026-08-01_607137f4e983af18921e6871cdc2f7ed_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_redline-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_607137f4e983af18921e6871cdc2f7ed_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_redline-stealer
Size 1.2MB
Sample260801-m1vecshp2v
SHA256 72470729a0af4c47138547859e863132be2803542c0dc6f8601141f9a084ecd0
MD5 607137f4e983af18921e6871cdc2f7ed
SHA1 2fb60dc8cafc8e994201ccb296d71158b10a79aa
SHA512 ff82d629588de484560fc591dac2002b19dd004cf12f45996fa15d47ce55bfd1f774bf5c8863e41cbde4e7fa6ab7c15142c90340d8981f5ba5e7b5152e14facb
SSDEEP 24576:TDBZzfp/ji/Dt7NP9ziRBEZfUd+lLykXXCyaFkBRzmpePy1nUG8sqjnhMgeiCl7j:T9Zzfp/ji/Dt7NP9ziRBEZfUd+ljXXCV
TLSH
T1D745D0217581C13AD97210710A68EBF5916EFC365F7209CBB7C01B6E5A352E22F31A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_607137f4e983af18921e6871cdc2f7ed_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_redline-stealer

File Explorer

2026-08-01_607137f4e983af18921e6871cdc2f7ed_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_redline-stealer

.exe 1.2MB

2026-08-01_607137f4e983af18921e6871cdc2f7ed_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_redline-stealer

IMPHASH f05817b30da052085e20bdc9778fab51
SHA256 72470729a0af4c47138547859e863132be2803542c0dc6f8601141f9a084ecd0
MD5 607137f4e983af18921e6871cdc2f7ed
SHA1 2fb60dc8cafc8e994201ccb296d71158b10a79aa
SHA512 ff82d629588de484560fc591dac2002b19dd004cf12f45996fa15d47ce55bfd1f774bf5c8863e41cbde4e7fa6ab7c15142c90340d8981f5ba5e7b5152e14facb
SSDEEP 24576:TDBZzfp/ji/Dt7NP9ziRBEZfUd+lLykXXCyaFkBRzmpePy1nUG8sqjnhMgeiCl7j:T9Zzfp/ji/Dt7NP9ziRBEZfUd+ljXXCV
TLSH
T1D745D0217581C13AD97210710A68EBF5916EFC365F7209CBB7C01B6E5A352E22F31A7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

340876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

X:\jenkins-workspace\workspace\hybridclient-builder-remoteieframe\ut_win\Build\Win32\Release\RemoteIEFrame.pdb

urlmon

UrlMkSetSessionOption

kernel32

CreateThread HeapAlloc GetProcAddress CreateMutexExW GetCurrentProcessId GetProcessHeap GetModuleHandleW DebugBreak IsDebuggerPresent GetVolumeInformationA GetCurrentProcess LoadLibraryA GetModuleFileNameW GetDriveTypeW GetModuleHandleA GetTickCount MultiByteToWideChar WideCharToMultiByte ReadFile VirtualAlloc CreateFileW SetUnhandledExceptionFilter GetSystemTimeAsFileTime VerSetConditionMask VerifyVersionInfoW WriteFile CreateNamedPipeW PeekNamedPipe DisconnectNamedPipe CreateEventW Sleep SetEvent GetOverlappedResult ConnectNamedPipe FlushFileBuffers GetLocaleInfoW CancelSynchronousIo LoadLibraryW LocalFree ExitProcess GlobalAlloc GetFileSizeEx GetCommandLineW GetFileAttributesW OutputDebugStringA LoadLibraryExW FreeLibrary GetEnvironmentVariableW HeapSize GetConsoleMode GetConsoleOutputCP SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileType GetStdHandle TlsFree TlsSetValue TlsGetValue TlsAlloc CloseHandle OpenSemaphoreW WaitForSingleObjectEx TerminateThread OutputDebugStringW GetLastError ReleaseMutex FormatMessageW GetCurrentThreadId WaitForSingleObject GetModuleHandleExW ReleaseSemaphore WriteConsoleW SetLastError HeapFree CreateSemaphoreExW GetModuleFileNameA CreateDirectoryW CancelIoEx RaiseException RtlUnwind InitializeSListHead GetStartupInfoW ResetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer QueryPerformanceCounter

user32

MapWindowPoints DispatchMessageW ShowWindow SendMessageW TranslateMessage GetClientRect PostQuitMessage ReleaseDC EndPaint BeginPaint CreateWindowExW GetForegroundWindow MoveWindow GetParent InvalidateRect GetWindowLongW GetWindowRect LoadCursorA SetWindowPos RegisterClassExW TrackMouseEvent FindWindowW SetWindowLongW PtInRect GetCursorPos GetMessageW DefWindowProcW GetKeyState PostMessageW DestroyWindow GetDC LogicalToPhysicalPointForPerMonitorDPI

gdi32

SelectObject CreateCompatibleDC StretchBlt DeleteDC SetStretchBltMode DeleteObject CreateCompatibleBitmap

advapi32

RegCloseKey RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegQueryValueExW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW DragQueryFileW DragFinish CommandLineToArgvW

ole32

OleUninitialize CoTaskMemAlloc CoTaskMemFree OleInitialize CoCreateInstance ReleaseStgMedium OleSetContainedObject OleCreate CreateStreamOnHGlobal StgCreateStorageEx

oleaut32

VariantClear SysAllocString DispGetParam SysFreeString VariantInit LoadTypeLibEx SysStringLen

shlwapi

PathRemoveFileSpecW PathFileExistsW PathFindFileNameW PathCombineW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_607137f4e983af18921e6871cdc2f7ed_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_redline-stealer

urlmon

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

generic