2026-08-02_f90984f3711f08b1f6bf17898ab2a9e2_amadey_avoslocker_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_f90984f3711f08b1f6bf17898ab2a9e2_amadey_avoslocker_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat
Size 1.2MB
Sample260802-tkmsxastb1
SHA256 e44e5834d7dff29eeb1b4b7ae162ae7cfd55bf7b92c7f026228cfb42355d9c55
MD5 f90984f3711f08b1f6bf17898ab2a9e2
SHA1 32713fa851b25d2fea071ff33c64289965ecdd0f
SHA512 02700a35d61e49e6e3e2b029fd900e5b6ae4758e560f59c48ae15fedb2bc9341b9ec2351822f7b91d1b018838aa0264a166da49fdfda142ac33e47a3ca5e0503
SSDEEP 24576:Uq4cCZLtj/uGZXPR+ihzsoyj2cWZcW5ey+EpiWaKfO8oiXNwrEH7s:Uzj/D/zsoyj2cWZ3Ey+YiFKfO6N8
TLSH
T1B7456A20B84191B2C1A110B364BCB7BD4469EC287BA514C776C87B394D387D1EEF7E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-02_f90984f3711f08b1f6bf17898ab2a9e2_amadey_avoslocker_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

File Explorer

2026-08-02_f90984f3711f08b1f6bf17898ab2a9e2_amadey_avoslocker_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

.exe 1.2MB

2026-08-02_f90984f3711f08b1f6bf17898ab2a9e2_amadey_avoslocker_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

IMPHASH e4bb1d0c30e1f7c9577f2db0239ee7f5
SHA256 e44e5834d7dff29eeb1b4b7ae162ae7cfd55bf7b92c7f026228cfb42355d9c55
MD5 f90984f3711f08b1f6bf17898ab2a9e2
SHA1 32713fa851b25d2fea071ff33c64289965ecdd0f
SHA512 02700a35d61e49e6e3e2b029fd900e5b6ae4758e560f59c48ae15fedb2bc9341b9ec2351822f7b91d1b018838aa0264a166da49fdfda142ac33e47a3ca5e0503
SSDEEP 24576:Uq4cCZLtj/uGZXPR+ihzsoyj2cWZcW5ey+EpiWaKfO8oiXNwrEH7s:Uzj/D/zsoyj2cWZ3Ey+YiFKfO6N8
TLSH
T1B7456A20B84191B2C1A110B364BCB7BD4469EC287BA514C776C87B394D387D1EEF7E6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

53:40:a1:ae:6e:62:fe:2d:96:8c:86:1a:94:5b:e0:91:59:23:8e:73:93:fa:5a:6e:b6:4e:9b:14:ac:7c:66:3c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2585063-4,CN=EasyAntiCheat Oy,O=EasyAntiCheat Oy,STREET=Tammasaarenkatu 3,L=Helsinki,ST=Uusimaa,C=FI,1.3.6.1.4.1.311.60.2.1.3=#13024649,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 12, 2022

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

Serial Number

26:50:4e:06:45:c8:dd:dc:8c:28:cc:15

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Oct 28, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

Major OS version

Entry point

448804

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

EasyAntiCheat_Setup.pdb

kernel32

LoadResource FindResourceW GlobalLock GlobalUnlock RemoveDirectoryW GetModuleFileNameW GetTempPathW CopyFileW MoveFileW GetExitCodeProcess CreateDirectoryW HeapFree SetLastError HeapAlloc GetProcessHeap LockResource SizeofResource K32EnumProcesses OutputDebugStringW SetFileAttributesW OpenProcess K32GetProcessImageFileNameW WaitForMultipleObjects TerminateProcess OutputDebugStringA WriteFile IsWow64Process GetLogicalDriveStringsW QueryDosDeviceW GetSystemDirectoryW LocalAlloc ExitProcess SetEndOfFile WriteConsoleW HeapSize GetFileAttributesExW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation FlushFileBuffers SetStdHandle GetCurrentDirectoryW SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID FileTimeToSystemTime GetCurrentProcess FormatMessageA WideCharToMultiByte LocalFree MultiByteToWideChar GetFullPathNameW CreateThread GetLastError Sleep ResumeThread DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection ResetEvent SetEvent CreateEventW WaitForSingleObject GetLocaleInfoW GetFileTime GetModuleHandleW DeleteFileW GetFileInformationByHandle IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapReAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode FindClose ExpandEnvironmentStringsW FindNextFileW GetFileSizeEx FindFirstFileW LoadLibraryA ReadFile GetSystemTimeAsFileTime LoadLibraryW MapViewOfFile CreateFileMappingW CloseHandle UnmapViewOfFile CreateFileW FreeLibrary GetProcAddress GlobalFree GlobalAlloc GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SleepEx InitializeCriticalSectionEx ExpandEnvironmentStringsA GetModuleHandleA GetTickCount64 VerifyVersionInfoA GetSystemDirectoryA VerSetConditionMask WaitForSingleObjectEx CreateFileA QueryPerformanceCounter QueryPerformanceFrequency EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException

user32

SetForegroundWindow ReleaseCapture UpdateWindow SystemParametersInfoW PostQuitMessage GetClientRect ReleaseDC LoadCursorW LoadIconW TranslateMessage MoveWindow GetMonitorInfoW DispatchMessageW ShowWindow InvalidateRect BeginPaint EndPaint SetCapture CreateWindowExW RegisterClassExW PostMessageW SetWindowPos FillRect SetWindowTextW MapWindowPoints IsWindowEnabled SendMessageA MapDialogRect DrawTextW GetClassInfoExW EnableWindow GetWindowTextW GetMessageW DefWindowProcW GetWindowRect DestroyWindow GetDC MessageBoxW MonitorFromRect SendMessageW

advapi32

RegDeleteKeyW StartServiceW DeleteService OpenSCManagerW CloseServiceHandle CreateServiceW GetTokenInformation OpenProcessToken ChangeServiceConfig2W StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW SetServiceStatus CryptAcquireContextA CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegQueryValueExW SetSecurityDescriptorDacl GetSecurityDescriptorDacl BuildExplicitAccessWithNameW AllocateAndInitializeSid SetEntriesInAclW ConvertStringSidToSidW SetServiceObjectSecurity ControlService FreeSid CheckTokenMembership InitializeSecurityDescriptor OpenServiceW LookupAccountSidW QueryServiceObjectSecurity RegCloseKey RegOpenKeyExW RegCreateKeyExW RegSetValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHFileOperationW CommandLineToArgvW ShellExecuteW ShellExecuteExW

ole32

CoTaskMemFree CoInitializeEx CreateStreamOnHGlobal

gdi32

AddFontMemResourceEx DeleteObject RestoreDC DeleteDC GetDeviceCaps CreateCompatibleDC SelectObject SaveDC CreateCompatibleBitmap BitBlt CreateFontW SetDCPenColor RoundRect SetDCBrushColor SetBkMode SetTextColor GetTextExtentPoint32W GetStockObject RemoveFontMemResourceEx

gdiplus

GdiplusShutdown GdipCreateLineBrushI GdipDeleteBrush GdipDrawImageRectI GdipLoadImageFromStream GdipFree GdipDisposeImage GdipAlloc GdipCloneImage GdipFillRectangleI GdiplusStartup GdipDeleteGraphics GdipCreateFromHDC

crypt32

CertFreeCertificateContext CryptStringToBinaryA CertCloseStore CertFindCertificateInStore CertGetCertificateChain CertFreeCertificateChainEngine CertAddCertificateContextToStore CryptQueryObject CertFreeCertificateChain CertGetNameStringA CertCreateCertificateChainEngine CertOpenStore

ws2_32

WSASetLastError recv send setsockopt htons getsockopt connect ntohs socket getsockname getpeername WSAGetLastError closesocket WSAIoctl bind select __WSAFDIsSet ioctlsocket freeaddrinfo getaddrinfo WSAStartup WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_f90984f3711f08b1f6bf17898ab2a9e2_amadey_avoslocker_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

gdi32

gdiplus

crypt32

ws2_32

generic