2026-08-09_e47ce1d49874bfad0f224511d5e442a6_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_e47ce1d49874bfad0f224511d5e442a6_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_njrat
Size 1.6MB
Sample260809-lqtjmsyths
SHA256 2b1a44e23daa94b09eb9b79d064fefd76efa44b5f6572cb06dc097c1c6f02740
MD5 e47ce1d49874bfad0f224511d5e442a6
SHA1 4dd99c79ac9d53c0f4d1d851ef49c01a7dc41a9b
SHA512 1feae68c0ea0a5f8a3dd209a41e75d710295b22ad3b386e1d2652915233fee59bd9ac05a1228f3ea9a15dc0baf263b9c903e64ade557593cdb80577d6951bebb
SSDEEP 49152:0ETvrAVde3TBf8LPxpUTc7FOciydUdlbKLKrcUoj:0ErGB7FOciuoI
TLSH
T11175081177E95B28F5F72B31AEB851A44A7B7C616F35C6CF12801A4E3934AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_e47ce1d49874bfad0f224511d5e442a6_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_njrat

File Explorer

2026-08-09_e47ce1d49874bfad0f224511d5e442a6_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_njrat

.exe 1.6MB

2026-08-09_e47ce1d49874bfad0f224511d5e442a6_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_njrat

IMPHASH 010452478718a60e5313b47edbac73c2
SHA256 2b1a44e23daa94b09eb9b79d064fefd76efa44b5f6572cb06dc097c1c6f02740
MD5 e47ce1d49874bfad0f224511d5e442a6
SHA1 4dd99c79ac9d53c0f4d1d851ef49c01a7dc41a9b
SHA512 1feae68c0ea0a5f8a3dd209a41e75d710295b22ad3b386e1d2652915233fee59bd9ac05a1228f3ea9a15dc0baf263b9c903e64ade557593cdb80577d6951bebb
SSDEEP 49152:0ETvrAVde3TBf8LPxpUTc7FOciydUdlbKLKrcUoj:0ErGB7FOciuoI
TLSH
T11175081177E95B28F5F72B31AEB851A44A7B7C616F35C6CF12801A4E3934AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

93:23:fa:81:71:3e:3d:2b:97:86:01:c9:c9:1e:4f:08:85:ca:32:71:a0:48:3e:17:93:66:ad:07:f6:72:d9:77

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Mar 21, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1a:34:0f:78:d7:d0:00:e0:89:fd:ba:ad:65:22:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

445696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARM.pdb

msi

ord114 ord16 ord120 ord123 ord205 ord159 ord160 ord141 ord8 ord118 ord171 ord92 ord116 ord115 ord119 ord88 ord240 ord131 ord150 ord78 ord70 ord181 ord195 ord32 ord281

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses GetModuleFileNameExW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW HttpQueryInfoW InternetReadFile InternetCrackUrlW InternetOpenW InternetConnectW HttpOpenRequestW HttpSendRequestW InternetErrorDlg InternetSetOptionW InternetCloseHandle

sensapi

IsNetworkAlive

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer

kernel32

GlobalAlloc GlobalLock GlobalUnlock GlobalFree MulDiv FlushFileBuffers GetFullPathNameW LockFile UnlockFile DuplicateHandle LoadLibraryExW LoadLibraryA GetCurrentThreadId GetVersionExW FreeLibrary GlobalDeleteAtom SetThreadPriority SuspendThread ResumeThread GetPrivateProfileIntW GlobalAddAtomW EncodePointer GetSystemDirectoryW GetModuleFileNameW CompareStringW FileTimeToLocalFileTime FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW GetFileSizeEx GetFileTime InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc SetErrorMode GetCurrentDirectoryW GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags GetUserDefaultLCID ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetACP ExpandEnvironmentStringsW GetCurrentProcessId ProcessIdToSessionId GlobalMemoryStatusEx GetEnvironmentVariableW GetSystemInfo WideCharToMultiByte DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionEx TerminateProcess Module32NextW Module32FirstW GetNativeSystemInfo Process32NextW GetLongPathNameW Process32FirstW CreateToolhelp32Snapshot LoadLibraryW FindResourceExW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy lstrcmpA lstrcmpW LocalAlloc GetExitCodeProcess CreateProcessW GetFileInformationByHandle OpenMutexW CreateMutexW SystemTimeToFileTime SetEndOfFile RemoveDirectoryW GetFileSize SetFilePointer GetThreadLocale GetPrivateProfileSectionNamesW MoveFileW WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ReadFile LocalFree GetUserDefaultLangID UnmapViewOfFile OpenFileMappingW MapViewOfFile FormatMessageW GetLocalTime GetModuleHandleW GetProcAddress GetVolumeInformationW GetPrivateProfileStringW WritePrivateProfileStringW MoveFileExW CreateFileW GetCurrentThread GetCurrentProcess OpenProcess CopyFileW GetTickCount64 GetTempPathW SetLastError WaitForSingleObject SetEvent OpenEventW CloseHandle CreateEventW Sleep GetThreadPriority MultiByteToWideChar FindClose FindFirstFileW DeleteFileW lstrlenW SetFileAttributesW SetFileTime WriteFile GetLastError GetModuleHandleA CreateDirectoryW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource OutputDebugStringW GetStringTypeW LCMapStringW GetCPInfo RtlUnwind GetDriveTypeW SetEnvironmentVariableW SetCurrentDirectoryW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA GetCommandLineW SetStdHandle GetFileType HeapQueryInformation GetStdHandle ExitProcess GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GlobalFindAtomW

user32

DestroyMenu GetMonitorInfoW MonitorFromWindow WinHelpW UnhookWindowsHookEx GetTopWindow GetClassNameW GetClassLongW PtInRect MapWindowPoints AdjustWindowRectEx RemovePropW GetPropW SetPropW ShowScrollBar GetScrollPos RedrawWindow TrackPopupMenu SetMenu GetMenu GetCapture EndDeferWindowPos DeferWindowPos BeginDeferWindowPos IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos CopyRect GetSysColor ScreenToClient EndPaint BeginPaint ReleaseDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetDesktopWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IsDialogMessageW SetWindowLongW GetWindowTextLengthW SetFocus GetDlgCtrlID SetDlgItemTextW GetSysColorBrush ShowWindow GetLastActivePopup GetWindowLongW IsWindowEnabled LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem CallNextHookEx SetWindowsHookExW ValidateRect GetKeyState DispatchMessageW TranslateMessage GetMessageW PostQuitMessage CharUpperW GetMenuStringW OffsetRect SendDlgItemMessageA UnregisterClassW GetWindow FindWindowW ExitWindowsEx RegisterWindowMessageW RealChildWindowFromPoint InvalidateRect EnumWindows GetWindowTextW IsWindowVisible GetWindowThreadProcessId FindWindowExW SystemParametersInfoW SetActiveWindow DrawAnimatedRects SetForegroundWindow SetMenuDefaultItem ModifyMenuW GetMenuItemID GetMenuItemCount GetSubMenu ClientToScreen GetCursorPos LoadMenuW SetCursor DrawFocusRect InflateRect SetRectEmpty GetParent SetWindowTextW LoadCursorW GetActiveWindow DrawIcon GetClientRect GetSystemMetrics IsIconic PeekMessageW UpdateWindow GetFocus IsWindow SetTimer GetWindowRect SendMessageW LoadIconW EnableWindow PostMessageW SetWindowPos GetForegroundWindow KillTimer MessageBoxW GetDlgItem DestroyWindow

gdi32

ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx CreateBitmap GetDeviceCaps DeleteDC SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetTextColor GetTextExtentPoint32W CreateFontIndirectW GetObjectW SetMapMode SetBkMode SetBkColor SelectObject SaveDC RestoreDC RectVisible PtVisible GetStockObject GetClipBox Escape DeleteObject

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW RegCloseKey RegDeleteTreeW CopySid GetLengthSid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired OpenProcessToken RegQueryValueW RegEnumKeyW RegDeleteKeyW RegFlushKey ConvertSidToStringSidW LookupAccountNameW ControlService QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW CreateWellKnownSid RegCreateKeyW RegDeleteKeyExW LookupAccountSidW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameW RegCreateKeyExW RegQueryValueExW RegSetValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW CheckTokenMembership DuplicateToken OpenThreadToken

shell32

ShellExecuteW SHCreateDirectoryExW ShellExecuteExW SHFileOperationW Shell_NotifyIconW SHAppBarMessage SHGetFolderPathW

comctl32

_TrackMouseEvent InitCommonControlsEx

shlwapi

PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW SHDeleteKeyW

ole32

CoInitialize CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoCreateInstance OleRun CoCreateGuid

oleaut32

SysAllocString SysFreeString VariantClear SysAllocStringByteLen SysStringByteLen VariantInit VariantCopy VariantChangeType GetErrorInfo

urlmon

URLDownloadToFileW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock UnloadUserProfile

crypt32

CryptUnprotectData CryptProtectData CryptDecodeObject CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptQueryObject CryptMsgGetParam

wintrust

WinVerifyTrust

oleacc

LresultFromObject CreateStdAccessibleObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_e47ce1d49874bfad0f224511d5e442a6_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_njrat

PE Signature issue

msi

psapi

version

wininet

sensapi

secur32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

userenv

crypt32

wintrust

oleacc

generic