2026-08-04_b8cd442e3df1030d9e62883e706c9cc3_amadey_avoslocker_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

General

Target
2026-08-04_b8cd442e3df1030d9e62883e706c9cc3_amadey_avoslocker_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat
Size 438KB
Sample260805-aq2dpsthpc
SHA256 83ca422dbf22610fe2ea9fe1c11c5185bd2b1baa7dc8ed7c344260825b56029e
MD5 b8cd442e3df1030d9e62883e706c9cc3
SHA1 b04cedf66742b1dd550b47a0b691968bf53d3700
SHA512 624b83e2a45567b23b6ed7f6a008247264924797b9f1c1a29c1560901af606f75c2031aaa44ec6ab93e8c73453d05be929d86279c97b4c623ec9b63c66d4e19f
SSDEEP 12288:huNbLSWTmviJqHAt7h7MBLvvUx1rBjvrEH79:gbGeJ7td7MBwNrEH79
TLSH
T1F394AE303171C6F6D4211D32342896654DABA83E2F6145FFE3966B3DCE383C25635A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_b8cd442e3df1030d9e62883e706c9cc3_amadey_avoslocker_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

File Explorer

2026-08-04_b8cd442e3df1030d9e62883e706c9cc3_amadey_avoslocker_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

.exe 438KB

2026-08-04_b8cd442e3df1030d9e62883e706c9cc3_amadey_avoslocker_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

IMPHASH 1208288a5efe294a900cda244cd74b1e
SHA256 83ca422dbf22610fe2ea9fe1c11c5185bd2b1baa7dc8ed7c344260825b56029e
MD5 b8cd442e3df1030d9e62883e706c9cc3
SHA1 b04cedf66742b1dd550b47a0b691968bf53d3700
SHA512 624b83e2a45567b23b6ed7f6a008247264924797b9f1c1a29c1560901af606f75c2031aaa44ec6ab93e8c73453d05be929d86279c97b4c623ec9b63c66d4e19f
SSDEEP 12288:huNbLSWTmviJqHAt7h7MBLvvUx1rBjvrEH79:gbGeJ7td7MBwNrEH79
TLSH
T1F394AE303171C6F6D4211D32342896654DABA83E2F6145FFE3966B3DCE383C25635A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c7:5b:04:70:ab:0a:a2:d7:15:ec:07:79:c4:48:26:2d:43:c1:25:88:5b:a0:b7:53:02:8d:7c:8c:e2:83:7c:2a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN

Chains

May 13, 2022

CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN

Serial Number

03:6a:f9:5e:02:ce:45:d3:5f:44:51:1e:61:c6:ce:d6

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 22, 2020 - Jan 2, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

0

Major OS version

6

Entry point

73518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\CCMini_Windows\Win32\Products\Release_Win32\CCMini.pdb

ws2_32

gethostbyname socket setsockopt send recv listen WSAStartup htonl ioctlsocket connect closesocket bind accept __WSAFDIsSet htons select ntohs getsockname WSAGetLastError

shell32

CommandLineToArgvW

kernel32

SetStdHandle GetProcessHeap GetCommandLineW Sleep EnterCriticalSection GetModuleFileNameW HeapSize InitializeCriticalSection DeleteCriticalSection WideCharToMultiByte WaitForSingleObject TerminateThread CloseHandle SetEnvironmentVariableW CreateFileW LeaveCriticalSection InitializeSListHead FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode EncodePointer DecodePointer InitializeCriticalSectionEx MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime WriteConsoleW RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetTimeZoneInformation ExitProcess GetStdHandle WriteFile HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP

audioengine

CreateAudioService SetCCMiniRootDir

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_b8cd442e3df1030d9e62883e706c9cc3_amadey_avoslocker_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

PE Signature issue

ws2_32

shell32

kernel32

audioengine

generic