2026-08-08_96b384f45f5fa99cec9e35c7aedac78b_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_96b384f45f5fa99cec9e35c7aedac78b_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 813KB
Sample260808-s8texstxb1
SHA256 783eaa9a12d9cc41671f1de4684f494405d7e6061c22e2d61147fe90466bb912
MD5 96b384f45f5fa99cec9e35c7aedac78b
SHA1 a5033b73b1bc38ad23d084b964af6f9ce3c16860
SHA512 c17722502c4b5eaaee3edaed22c29bb9566581f3b2d0fc684f0a9a371b831323004e84efd1537334b4c86d97624dff356902ceaf0c92a7abadd0ae5bfe9e1982
SSDEEP 24576:OU5bg9CT3emhlfmUL3D5BBPT4vhSMXlL2Jh0uzrEH7OI:OsremhFmUL3DfBPTHYuA
TLSH
T143059C1272D182F6E0F131B06DBF9B6E95FD79380B2149CB6F841D6AB9249C19A30737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_96b384f45f5fa99cec9e35c7aedac78b_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-08-08_96b384f45f5fa99cec9e35c7aedac78b_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 813KB

2026-08-08_96b384f45f5fa99cec9e35c7aedac78b_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH 0c77bd92f6bcae5ebde7e61f5c092879
SHA256 783eaa9a12d9cc41671f1de4684f494405d7e6061c22e2d61147fe90466bb912
MD5 96b384f45f5fa99cec9e35c7aedac78b
SHA1 a5033b73b1bc38ad23d084b964af6f9ce3c16860
SHA512 c17722502c4b5eaaee3edaed22c29bb9566581f3b2d0fc684f0a9a371b831323004e84efd1537334b4c86d97624dff356902ceaf0c92a7abadd0ae5bfe9e1982
SSDEEP 24576:OU5bg9CT3emhlfmUL3D5BBPT4vhSMXlL2Jh0uzrEH7OI:OsremhFmUL3DfBPTHYuA
TLSH
T143059C1272D182F6E0F131B06DBF9B6E95FD79380B2149CB6F841D6AB9249C19A30737
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

25:7e:69:60:71:2b:78:4e:f7:0e:8c:cb:aa:4a:95:80:b3:e2:92:92:0c:74:30:43:48:74:b2:02:16:1a:9b:cf

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Kakao corp.,O=Kakao corp.,L=Jeju-si,ST=Jeju-do,C=KR

Chains

Nov 15, 2021

CN=Kakao corp.,O=Kakao corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Kakao corp.,O=Kakao corp.,L=Jeju-si,ST=Jeju-do,C=KR

Serial Number

4b:dd:4d:ac:fa:8f:ff:84:22:2e:bf:2e:ff:82:90:d2

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2020 - Aug 19, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

272578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Jenkins_workspaces\KakaoUpdate Build and Deploy qa stage\build\KakaoUpdate.pdb

kernel32

WaitForSingleObjectEx WaitForSingleObject OpenSemaphoreW GetTempPathW GetLocalTime GetCommandLineW LocalFree ResumeThread CreateSemaphoreW GetTickCount MoveFileExW Sleep DeleteFileW RemoveDirectoryW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateDirectoryW CopyFileW OpenProcess GetCurrentProcessId CreateMutexExW CreateSemaphoreExW GetUserDefaultUILanguage MultiByteToWideChar GetFileAttributesW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW TerminateProcess ReadFile lstrlenW WriteFile SetFileTime CreateFileW LocalFileTimeToFileTime GetFileSize DosDateTimeToFileTime GetFileTime WideCharToMultiByte GetModuleFileNameW FreeLibrary GetCurrentProcess QueryPerformanceFrequency TlsGetValue TlsSetValue TlsAlloc ReleaseMutex EnterCriticalSection LeaveCriticalSection SetEvent DeleteCriticalSection FormatMessageA SetFilePointerEx SetEndOfFile GetCurrentDirectoryW FlushFileBuffers GetStdHandle GetEnvironmentVariableW GetFileType HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapReAlloc ExitProcess FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RaiseException RtlUnwind WriteConsoleW InitializeSListHead GetStartupInfoW CreateEventW ResetEvent ReleaseSemaphore CloseHandle SetLastError OutputDebugStringW IsDebuggerPresent GetLastError GetProcAddress GetModuleHandleW DebugBreak GetModuleFileNameA GetModuleHandleExW HeapFree GetProcessHeap HeapAlloc GetCurrentThreadId TlsFree FormatMessageW InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW InitializeCriticalSectionEx FindFirstFileExW QueryPerformanceCounter EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetSystemTimeAsFileTime

user32

LoadAcceleratorsW BeginPaint EndPaint LoadStringW SendMessageW DestroyWindow GetMessageW ExitWindowsEx GetWindowThreadProcessId FindWindowW PostMessageW EndDialog MessageBoxW PostQuitMessage DefWindowProcW DialogBoxParamW SetWindowTextW SetWindowLongW GetWindowLongW GetDlgItem UpdateWindow ShowWindow CreateDialogParamW CreateWindowExW RegisterClassExW LoadCursorW LoadIconW DispatchMessageW TranslateMessage TranslateAcceleratorW

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegCloseKey RegSetValueExW SetNamedSecurityInfoW RegOpenKeyExW

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteW

ws2_32

WSAStartup WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_96b384f45f5fa99cec9e35c7aedac78b_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

kernel32

user32

advapi32

shell32

ws2_32

generic