2026-08-01_39d061d5f619855bd09aa8e14920a789_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_39d061d5f619855bd09aa8e14920a789_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 843KB
Sample260802-ewjs3ach64
SHA256 81b2103abcfd0b7db1df3fcba4db7a8475e5db1f1e876273611383c866f94d37
MD5 39d061d5f619855bd09aa8e14920a789
SHA1 b75029de464eaeb85872b7092477fdc78932772c
SHA512 492a9b1c2b951f85ff2fb171cad423c90014481ef6b96fa05949b6120a1e812d6f06dd7d32adb4b2b1cfff818cfc826c6aa05a5345fb9f21b07a4e61fa0c4272
SSDEEP 24576:5No8cF59bUf0/Jjf1nMTQGLhSMXlL2JhlXCNrEH7N:744fgJpnMTARyi
TLSH
T17505AE0271C182F6E0F531706DBF9B6D95FD69381B2549DBAF801E2A7920EC19A3077B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-01_39d061d5f619855bd09aa8e14920a789_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-08-01_39d061d5f619855bd09aa8e14920a789_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 843KB

2026-08-01_39d061d5f619855bd09aa8e14920a789_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH a94273b20d3241cd523d0465e5f61c1d
SHA256 81b2103abcfd0b7db1df3fcba4db7a8475e5db1f1e876273611383c866f94d37
MD5 39d061d5f619855bd09aa8e14920a789
SHA1 b75029de464eaeb85872b7092477fdc78932772c
SHA512 492a9b1c2b951f85ff2fb171cad423c90014481ef6b96fa05949b6120a1e812d6f06dd7d32adb4b2b1cfff818cfc826c6aa05a5345fb9f21b07a4e61fa0c4272
SSDEEP 24576:5No8cF59bUf0/Jjf1nMTQGLhSMXlL2JhlXCNrEH7N:744fgJpnMTARyi
TLSH
T17505AE0271C182F6E0F531706DBF9B6D95FD69381B2549DBAF801E2A7920EC19A3077B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5a:19:fb:bc:83:a1:9b:50:ea:ef:61:0e:b0:61:22:27:15:c4:5d:65:49:3d:21:4e:ac:10:f4:b3:b4:21:e5:9f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Kakao corp.,O=Kakao corp.,L=Jeju-si,ST=Jeju-do,C=KR

Chains

Jan 10, 2022

CN=Kakao corp.,O=Kakao corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Kakao corp.,O=Kakao corp.,L=Jeju-si,ST=Jeju-do,C=KR

Serial Number

4b:dd:4d:ac:fa:8f:ff:84:22:2e:bf:2e:ff:82:90:d2

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2020 - Aug 19, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

294510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Jenkins_workspaces\KakaoUpdate Build and Deploy qa stage\build\KakaoUpdate.pdb

kernel32

WaitForSingleObjectEx WaitForSingleObject OpenSemaphoreW GetTempPathW GetLocalTime GetCommandLineW LocalFree ResumeThread CreateSemaphoreW GetTickCount MoveFileExW Sleep DeleteFileW RemoveDirectoryW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateDirectoryW CopyFileW OpenProcess GetCurrentProcessId CreateMutexExW CreateSemaphoreExW GetUserDefaultUILanguage MultiByteToWideChar GetFileAttributesW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW TerminateProcess ReadFile lstrlenW WriteFile SetFileTime CreateFileW LocalFileTimeToFileTime GetFileSize WideCharToMultiByte DosDateTimeToFileTime GetFileTime GetModuleFileNameW FreeLibrary GetTimeZoneInformation GetCurrentProcess QueryPerformanceFrequency TlsGetValue TlsSetValue TlsAlloc TlsFree EnterCriticalSection LeaveCriticalSection SetEvent DeleteCriticalSection FormatMessageA SetFilePointerEx SetEndOfFile GetCurrentDirectoryW FlushFileBuffers GetCurrentThreadId HeapAlloc HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetConsoleOutputCP ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapReAlloc ExitProcess SetStdHandle FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW ReleaseSemaphore CloseHandle SetLastError OutputDebugStringW IsDebuggerPresent GetLastError GetProcAddress GetModuleHandleW DebugBreak GetModuleFileNameA GetModuleHandleExW HeapFree GetProcessHeap ReleaseMutex CreateEventW ResetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WriteConsoleW GetStdHandle GetEnvironmentVariableW GetFileType SetFilePointer GetFileSizeEx QueryPerformanceCounter GetStringTypeW InitializeCriticalSectionEx FindFirstFileExW EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetSystemTimeAsFileTime FormatMessageW

user32

EndPaint SendMessageW BeginPaint LoadStringW ExitWindowsEx GetWindowThreadProcessId FindWindowW PostMessageW EndDialog MessageBoxW PostQuitMessage DefWindowProcW DestroyWindow DialogBoxParamW SetWindowTextW SetWindowLongW GetWindowLongW GetDlgItem UpdateWindow ShowWindow CreateDialogParamW CreateWindowExW RegisterClassExW LoadCursorW LoadIconW DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW

advapi32

RegSetValueExW AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegCloseKey SetNamedSecurityInfoW RegOpenKeyExW

shell32

ShellExecuteW SHGetFolderPathW CommandLineToArgvW

ws2_32

WSAStartup WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_39d061d5f619855bd09aa8e14920a789_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

kernel32

user32

advapi32

shell32

ws2_32

generic