2026-08-08_5f042ea056dc0c001c72f71b1fca7a65_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_5f042ea056dc0c001c72f71b1fca7a65_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 843KB
Sample260808-d3csnayhpd
SHA256 f3ff1a70c554505b7a2029266c0dc78e543a2aad94711b432aeee88591e2b0c2
MD5 5f042ea056dc0c001c72f71b1fca7a65
SHA1 36774791dd020f1c330ab586f5e454dc746a2f9d
SHA512 42e55deac9ec6b1e7fcb5268b68d91633f60a0a5ec650150c81b5189ff874be51309388445ccf6658d5ce7eaba5fb8a10082a6be3e246fd26f83d8fb3cd15f86
SSDEEP 24576:5No8cF55bmf0/s+1nMTQGLhSMXlL2JhlXCNrEH7b:78KfgsInMTARys
TLSH
T15A05AD0371C182F6E0F531706DBF9B6D95FD69381B2149DB6F901E2A7920AC1AA3077B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_5f042ea056dc0c001c72f71b1fca7a65_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-08-08_5f042ea056dc0c001c72f71b1fca7a65_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 843KB

2026-08-08_5f042ea056dc0c001c72f71b1fca7a65_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH a94273b20d3241cd523d0465e5f61c1d
SHA256 f3ff1a70c554505b7a2029266c0dc78e543a2aad94711b432aeee88591e2b0c2
MD5 5f042ea056dc0c001c72f71b1fca7a65
SHA1 36774791dd020f1c330ab586f5e454dc746a2f9d
SHA512 42e55deac9ec6b1e7fcb5268b68d91633f60a0a5ec650150c81b5189ff874be51309388445ccf6658d5ce7eaba5fb8a10082a6be3e246fd26f83d8fb3cd15f86
SSDEEP 24576:5No8cF55bmf0/s+1nMTQGLhSMXlL2JhlXCNrEH7b:78KfgsInMTARys
TLSH
T15A05AD0371C182F6E0F531706DBF9B6D95FD69381B2149DB6F901E2A7920AC1AA3077B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fe:92:d5:81:66:2b:0e:29:11:1b:9a:f5:2b:bc:b3:15:88:a0:f2:fa:e6:73:a0:03:f2:2b:9f:c1:11:4f:d6:cc

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Kakao corp.,O=Kakao corp.,L=Jeju-si,ST=Jeju-do,C=KR

Chains

Jan 10, 2022

CN=Kakao corp.,O=Kakao corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Kakao corp.,O=Kakao corp.,L=Jeju-si,ST=Jeju-do,C=KR

Serial Number

4b:dd:4d:ac:fa:8f:ff:84:22:2e:bf:2e:ff:82:90:d2

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2020 - Aug 19, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

294510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Jenkins_workspaces\KakaoUpdate Build and Deploy qa stage\build\KakaoUpdate.pdb

kernel32

WaitForSingleObjectEx WaitForSingleObject OpenSemaphoreW GetTempPathW GetLocalTime GetCommandLineW LocalFree ResumeThread CreateSemaphoreW GetTickCount MoveFileExW Sleep DeleteFileW RemoveDirectoryW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateDirectoryW CopyFileW OpenProcess GetCurrentProcessId CreateMutexExW CreateSemaphoreExW GetUserDefaultUILanguage MultiByteToWideChar GetFileAttributesW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW TerminateProcess ReadFile lstrlenW WriteFile SetFileTime CreateFileW LocalFileTimeToFileTime GetFileSize WideCharToMultiByte DosDateTimeToFileTime GetFileTime GetModuleFileNameW FreeLibrary GetTimeZoneInformation GetCurrentProcess QueryPerformanceFrequency TlsGetValue TlsSetValue TlsAlloc TlsFree EnterCriticalSection LeaveCriticalSection SetEvent DeleteCriticalSection FormatMessageA SetFilePointerEx SetEndOfFile GetCurrentDirectoryW FlushFileBuffers GetCurrentThreadId HeapAlloc HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetConsoleOutputCP ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapReAlloc ExitProcess SetStdHandle FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead GetStartupInfoW ReleaseSemaphore CloseHandle SetLastError OutputDebugStringW IsDebuggerPresent GetLastError GetProcAddress GetModuleHandleW DebugBreak GetModuleFileNameA GetModuleHandleExW HeapFree GetProcessHeap ReleaseMutex CreateEventW ResetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WriteConsoleW GetStdHandle GetEnvironmentVariableW GetFileType SetFilePointer GetFileSizeEx QueryPerformanceCounter GetStringTypeW InitializeCriticalSectionEx FindFirstFileExW EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetSystemTimeAsFileTime FormatMessageW

user32

EndPaint SendMessageW BeginPaint LoadStringW ExitWindowsEx GetWindowThreadProcessId FindWindowW PostMessageW EndDialog MessageBoxW PostQuitMessage DefWindowProcW DestroyWindow DialogBoxParamW SetWindowTextW SetWindowLongW GetWindowLongW GetDlgItem UpdateWindow ShowWindow CreateDialogParamW CreateWindowExW RegisterClassExW LoadCursorW LoadIconW DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW

advapi32

RegSetValueExW AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegCloseKey SetNamedSecurityInfoW RegOpenKeyExW

shell32

ShellExecuteW SHGetFolderPathW CommandLineToArgvW

ws2_32

WSAStartup WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_5f042ea056dc0c001c72f71b1fca7a65_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

kernel32

user32

advapi32

shell32

ws2_32

generic