2026-08-01_55fd9e4d54e7e3c1858a50ea2f5e48ee_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_55fd9e4d54e7e3c1858a50ea2f5e48ee_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 978KB
Sample260802-a3l5js1ckc
SHA256 335fe7d5a53ca16a6da332b34ae242229ffd53356967be89d1296416ec6e3c37
MD5 55fd9e4d54e7e3c1858a50ea2f5e48ee
SHA1 33a3891b98c48dd30b8817c0a70378142363b3bc
SHA512 2fc557bb19812965003a3cbea39f308472b6fc47752c51616d0265d837c419913e65c7c4342811556dc085eb96bf28cadaf0b41e1add1cecde63c0fd2de75811
SSDEEP 24576:4jGKsEiY1qEvRBaTB8Bx4tSVuUXG4fM+hGIwrEH7Q:u6EvRA3O7U+hhA
TLSH
T1A62549027A8DBDE5D4716430273793F24F6CEC242991D54FB3D17B2AAA3C293B518B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-01_55fd9e4d54e7e3c1858a50ea2f5e48ee_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-08-01_55fd9e4d54e7e3c1858a50ea2f5e48ee_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 978KB

2026-08-01_55fd9e4d54e7e3c1858a50ea2f5e48ee_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH eac92aa280cb6bfd8cd6b5c812122fb3
SHA256 335fe7d5a53ca16a6da332b34ae242229ffd53356967be89d1296416ec6e3c37
MD5 55fd9e4d54e7e3c1858a50ea2f5e48ee
SHA1 33a3891b98c48dd30b8817c0a70378142363b3bc
SHA512 2fc557bb19812965003a3cbea39f308472b6fc47752c51616d0265d837c419913e65c7c4342811556dc085eb96bf28cadaf0b41e1add1cecde63c0fd2de75811
SSDEEP 24576:4jGKsEiY1qEvRBaTB8Bx4tSVuUXG4fM+hGIwrEH7Q:u6EvRA3O7U+hhA
TLSH
T1A62549027A8DBDE5D4716430273793F24F6CEC242991D54FB3D17B2AAA3C293B518B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3b:ce:ca:79:a0:7c:89:ba:f2:00:d9:2b:49:87:a8:62:37:93:94:90:5e:81:81:bf:09:b4:68:84:ec:83:4a:7e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro,ST=New Hampshire,C=US

Chains

May 3, 2021

CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro,ST=New Hampshire,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro,ST=New Hampshire,C=US

Serial Number

03:3e:d5:ed:a0:65:d1:b8:c9:1d:fc:f9:2a:6c:9b:d8

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 18, 2018 - Dec 22, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

17975

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\1\b\bin\win32\pyw.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

advapi32

RegCloseKey RegEnumKeyW RegOpenKeyExW RegQueryValueExW

shell32

SHGetFolderPathW

kernel32

WriteConsoleW SetEndOfFile EnterCriticalSection HeapReAlloc HeapSize CreateFileW GetStartupInfoW SetConsoleCtrlHandler SetInformationJobObject QueryInformationJobObject SearchPathW GetBinaryTypeW GetCommandLineW GetCurrentProcess GetStdHandle AssignProcessToJobObject GetModuleFileNameW SetEnvironmentVariableW CreateJobObjectW GetEnvironmentVariableW GetFileAttributesW DuplicateHandle MultiByteToWideChar GetPrivateProfileStringW FormatMessageW GetLastError WaitForSingleObjectEx CloseHandle CreateProcessW IsWow64Process GetExitCodeProcess SetFilePointerEx GetFileSizeEx GetProcessHeap SetStdHandle FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW InterlockedPushEntrySList InterlockedFlushSList RtlUnwind SetLastError DecodePointer LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException ExitProcess GetModuleHandleExW GetCommandLineA WriteFile HeapFree HeapAlloc GetCurrentThread GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetStringTypeW ReadFile ReadConsoleW OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW

user32

MessageBoxW PostMessageW GetMessageW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_55fd9e4d54e7e3c1858a50ea2f5e48ee_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

version

advapi32

shell32

kernel32

user32

generic