ebb6d09cecc228bcb00f1f8d167d9d3a728d9d58ea395f918b996a9fca932d0a

General

Target
2026-08-02_18311104d35687acb2b972d871659933_amadey_avoslocker_elex_luca-stealer_lynx_njrat_smoke-loader
Size 168KB
Sample260802-d3x4laswa1
SHA256 ebb6d09cecc228bcb00f1f8d167d9d3a728d9d58ea395f918b996a9fca932d0a
MD5 18311104d35687acb2b972d871659933
SHA1 b32662234fe514041c3f41a923b83d610066efa9
SHA512 f2dccc7411bd64030b3a874287a2767e53ec11e43c9a6f9f366d8422b169a54b52f5c6c31ff2681159d3ed9c2d0939f679f24c672825c49a64bafd4dd938d51f
SSDEEP 3072:I+n0DHzR+tWXxYQvgCU6LvduQURUS9QoQ9d7KrcFGWDITg34ni3:R6zQwXiuLvdjsUEJQ9z3Ki3
TLSH
T10BF37B9535D08472E5B3293009B09AF1592EFD302B24ACDB6B81497E2E71DD39935F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\a7k9p2q-ReadMe.txt

Ransom Note

Read this text carefully. We have breached your network due to security vulnerabilities and encrypted all your files using a military algorithm. - The only way for restoring your files is through purchase of decryption software from us. - You can also send us an unimportant file less than 1MB, We decrypt it as a guarantee for free. What do we offer in exchange for your payment: - Decryption and restoration of all your machines and data within 24 hours with a guarantee; - Assurance that we will never inform anyone about the data breach from your company; - Provision of valuable advice on your company's IT protection so no one can attack you again. In order to start negotiations, Send message to our mailboxes: - [email protected] - [email protected] - Make sure the subject of your email is your client ID: 4WZ0CWG2M64E68GU You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in qTox. Tox ID: 4101943D54538F8543D11FBCCA952FC76B5C3B0932BEB56D6EC42BE8EEF94E1DF82B94D8E968 >>> WARNING! - Avoid recovery companies; they are costly middlemen who may deceive you. - They negotiate with us for decryption software, then overcharge you or scam you. - Do NOT modify encrypted files, as this leads to permanent data loss. - Do NOT use third-party repair software; it can damage your files irreparably. - Act quickly, The faster you pay, the lower the price.

Emails

URLs

https://tox.chat/download.html

Targets

- Target
  2026-08-02_18311104d35687acb2b972d871659933_amadey_avoslocker_elex_luca-stealer_lynx_njrat_smoke-loader
- Size 168KB
- SHA256 ebb6d09cecc228bcb00f1f8d167d9d3a728d9d58ea395f918b996a9fca932d0a
- MD5 18311104d35687acb2b972d871659933
- SHA1 b32662234fe514041c3f41a923b83d610066efa9
- SHA512 f2dccc7411bd64030b3a874287a2767e53ec11e43c9a6f9f366d8422b169a54b52f5c6c31ff2681159d3ed9c2d0939f679f24c672825c49a64bafd4dd938d51f
- SSDEEP 3072:I+n0DHzR+tWXxYQvgCU6LvduQURUS9QoQ9d7KrcFGWDITg34ni3:R6zQwXiuLvdjsUEJQ9z3Ki3
- TLSH
  T10BF37B9535D08472E5B3293009B09AF1592EFD302B24ACDB6B81497E2E71DD39935F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence ransomware spyware stealer
- Clears Windows event logs
  defense_evasion ransomware
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2