2026-08-08_0eba15f95f5d5cd5727f343dd4aac119_amadey_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_0eba15f95f5d5cd5727f343dd4aac119_amadey_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat
Size 1.1MB
Sample260808-13skfaff33
SHA256 084d9b652d5532fc0ac844c6a94d8ab8b4ec340906e30ff3db0a6a3e78de67ea
MD5 0eba15f95f5d5cd5727f343dd4aac119
SHA1 aed0be255b261772563284eaf839bb7bf7912785
SHA512 52ba391639f78a0872755ad1366b7c6545a05d8f197398587368073c74590ac7f47600d5594f50b9896e1f4de395903934e015adf17f63088748f16b7c178fe0
SSDEEP 24576:hCbT7XkkhD1ZKp2pDFs0Cft0Lt6QSuTkpECdK0K4JRHArEH7S:hO7XXDKYpDazSTkqQK0K4HHS
TLSH
T15635CF107982C0F3DAA20570297DEB37457DAD2D0B249DCBA3D47A3D4E342E35A7963A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_0eba15f95f5d5cd5727f343dd4aac119_amadey_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-08-08_0eba15f95f5d5cd5727f343dd4aac119_amadey_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

.exe 1.1MB

2026-08-08_0eba15f95f5d5cd5727f343dd4aac119_amadey_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

IMPHASH 9c339ab2bb489666056bc7fc19b477ff
SHA256 084d9b652d5532fc0ac844c6a94d8ab8b4ec340906e30ff3db0a6a3e78de67ea
MD5 0eba15f95f5d5cd5727f343dd4aac119
SHA1 aed0be255b261772563284eaf839bb7bf7912785
SHA512 52ba391639f78a0872755ad1366b7c6545a05d8f197398587368073c74590ac7f47600d5594f50b9896e1f4de395903934e015adf17f63088748f16b7c178fe0
SSDEEP 24576:hCbT7XkkhD1ZKp2pDFs0Cft0Lt6QSuTkpECdK0K4JRHArEH7S:hO7XXDKYpDazSTkqQK0K4HHS
TLSH
T15635CF107982C0F3DAA20570297DEB37457DAD2D0B249DCBA3D47A3D4E342E35A7963A
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3a:5e:a4:1b:3d:a9:ee:26:d9:96:bf:bd:bb:24:97:5f:20:77:25:ab:58:e6:e1:6d:93:47:22:83:83:56:b7:29

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=201812738K,CN=INNOVATIVE CONNECTING PTE. LIMITED,O=INNOVATIVE CONNECTING PTE. LIMITED,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Jul 17, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:33:3b:de:4c:a7:c5:7e:57:d0:3d:ec:dd:c8:53:b0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 7, 2026 - Apr 2, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

202681

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\360\work\quantum\Release\turbo_vpn-service.pdb

libuv

uv_timer_start uv_default_loop uv_close uv_queue_work uv_timer_stop uv_timer_init uv_async_send uv_write uv_pipe_init uv_udp_recv_start uv_fs_unlink uv_udp_bind uv_read_start uv_udp_init uv_listen uv_accept uv_udp_send uv_ip4_addr uv_buf_init uv_udp_getsockname uv_pipe_bind uv_exepath uv_run uv_loop_close uv_thread_self uv_async_init

ws2_32

getsockopt getsockname getpeername connect bind htons WSAGetLastError send recv closesocket htonl freeaddrinfo setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select accept listen ioctlsocket getaddrinfo socket ntohs

kernel32

HeapReAlloc RaiseException CreateThread HeapAlloc DecodePointer SetCurrentDirectoryW DeleteCriticalSection GetProcessHeap MultiByteToWideChar WideCharToMultiByte GetModuleFileNameA FindNextFileW GetTempPathW FindClose CreateFileW GetFileAttributesW GetFileAttributesA DeleteFileW MoveFileExW FindFirstFileA FindNextFileA GetCurrentThreadId DeleteFileA GetLocalTime ResetEvent GetTickCount GetNumaHighestNodeNumber IsValidCodePage FindFirstFileExW GetProcAddress LoadLibraryW CloseHandle Process32FirstW OutputDebugStringW Process32NextW GetLastError ProcessIdToSessionId CreateToolhelp32Snapshot OpenProcess GetCurrentProcess SetLastError GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEvent SetStdHandle SetEndOfFile FormatMessageA SleepEx VerSetConditionMask GetSystemDirectoryA LoadLibraryA VerifyVersionInfoA ExpandEnvironmentStringsA CreateFileA GetDriveTypeW GetFileInformationByHandle GetFileAttributesExW HeapSize SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetCurrentDirectoryW GetFullPathNameW LocalAlloc DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetTimeZoneInformation ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue EnumSystemLocalesW GetUserDefaultLCID IsValidLocale SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA WriteFile InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW ExitThread SetEnvironmentVariableW CreateEventW CompareStringW QueryPerformanceFrequency QueryPerformanceCounter EncodePointer GetSystemTimeAsFileTime TlsFree WriteConsoleW GetFileType GetStdHandle SetConsoleCtrlHandler GetModuleHandleExW ExitProcess RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc GetVersionExW LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask WaitForSingleObject InitializeCriticalSectionEx GetModuleFileNameW HeapFree ReleaseMutex CreateMutexW CreateDirectoryA TerminateProcess GetLocaleInfoA Sleep FreeLibrary GetModuleHandleW PeekNamedPipe LocalFree EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue GetProcessAffinityMask

advapi32

SetSecurityDescriptorDacl DeregisterEventSource SetServiceStatus RegisterServiceCtrlHandlerW InitializeSecurityDescriptor CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW ChangeServiceConfig2W DeleteService ControlService StartServiceW ChangeServiceConfigW OpenServiceW LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf GetExplicitEntriesFromAclW EqualSid SetTokenInformation SetEntriesInAclW CreateWellKnownSid ConvertStringSidToSidW DeleteAce ImpersonateLoggedOnUser OpenProcessToken CreateProcessAsUserW DuplicateTokenEx GetTokenInformation

secur32

LsaFreeReturnBuffer LsaEnumerateLogonSessions LsaGetLogonSessionData

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSFreeMemory

shlwapi

PathRemoveFileSpecW PathRemoveFileSpecA PathFileExistsW PathAppendW

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertAddCertificateContextToStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChain

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_0eba15f95f5d5cd5727f343dd4aac119_amadey_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

PE Signature issue

libuv

ws2_32

kernel32

advapi32

secur32

userenv

wtsapi32

shlwapi

crypt32

generic