2026-08-09_101f3ed7edc2cc0fba1bc2b27ae374e6_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_101f3ed7edc2cc0fba1bc2b27ae374e6_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat
Size 1.5MB
Sample260809-vrh9qsseka
SHA256 a6d479a7b6efe75432e31b895896525cbaa44dc228517b22e3421881b22608c7
MD5 101f3ed7edc2cc0fba1bc2b27ae374e6
SHA1 6cd8c356a6e978b5fd1797bef6ad730bd8aee25f
SHA512 74b7dfb0cdf99d65f3f9462460db5913873b97bcc4f7069a4aa51864a350d75cfb92c96280d9553095f7d30ed18c27d7f471fea39be72ecd29c95f42176f1e15
SSDEEP 49152:jJ+dNUMyI+Y4LtpkLEaEQgBKQ0yiaDd+OW5e5hd:j8UMj4pkLEa1gAnaR
TLSH
T133751A207669DD66C97185705B3AE7FE624C9D400B65E0EFA2C839391BB81C33E33E56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_101f3ed7edc2cc0fba1bc2b27ae374e6_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat

File Explorer

2026-08-09_101f3ed7edc2cc0fba1bc2b27ae374e6_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat

.exe 1.5MB

2026-08-09_101f3ed7edc2cc0fba1bc2b27ae374e6_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat

IMPHASH d688110e6d8db57e360ef4a887c79fcd
SHA256 a6d479a7b6efe75432e31b895896525cbaa44dc228517b22e3421881b22608c7
MD5 101f3ed7edc2cc0fba1bc2b27ae374e6
SHA1 6cd8c356a6e978b5fd1797bef6ad730bd8aee25f
SHA512 74b7dfb0cdf99d65f3f9462460db5913873b97bcc4f7069a4aa51864a350d75cfb92c96280d9553095f7d30ed18c27d7f471fea39be72ecd29c95f42176f1e15
SSDEEP 49152:jJ+dNUMyI+Y4LtpkLEaEQgBKQ0yiaDd+OW5e5hd:j8UMj4pkLEa1gAnaR
TLSH
T133751A207669DD66C97185705B3AE7FE624C9D400B65E0EFA2C839391BB81C33E33E56
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

643930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\Git_Project\Duzon\DCloudClientAgent\Release\WehagoAgent.pdb

httpapi

HttpCancelHttpRequest HttpSendResponseEntityBody HttpSendHttpResponse HttpReceiveRequestEntityBody HttpReceiveHttpRequest HttpCloseServerSession HttpInitialize HttpTerminate HttpCreateUrlGroup HttpAddUrlToUrlGroup HttpCloseUrlGroup HttpSetUrlGroupProperty HttpCreateServerSession HttpCreateRequestQueue HttpShutdownRequestQueue HttpCloseRequestQueue

kernel32

FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle ReadConsoleW CreateFileW FindClose SetFilePointerEx GetFileSizeEx ReadFile WriteConsoleW LocalAlloc LocalFree MultiByteToWideChar RaiseException GetLastError InitializeCriticalSectionEx DeleteCriticalSection DecodePointer CloseHandle HeapAlloc HeapFree HeapReAlloc HeapSize GetEnvironmentVariableW GetProcessHeap FormatMessageA OutputDebugStringA CreateMutexW GetModuleHandleA FormatMessageW GetSystemTimeAsFileTime CreateThreadpoolIo CloseThreadpoolIo StartThreadpoolIo CancelThreadpoolIo GetConsoleCP FlushFileBuffers GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID GetModuleHandleExW GetStdHandle WriteFile GetConsoleMode GetCurrentThreadId ExitProcess RtlUnwind GetCurrentProcessId GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter IsValidLocale IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection EncodePointer WideCharToMultiByte GetStringTypeW TryEnterCriticalSection UnhandledExceptionFilter QueueUserWorkItem IsProcessorFeaturePresent QueryPerformanceCounter QueryPerformanceFrequency SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetCPInfo CreateTimerQueue SetEvent WaitForSingleObjectEx SignalObjectAndWait GetCurrentProcess SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree VirtualProtect DuplicateHandle ReleaseSemaphore InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW ResetEvent GetFileType

user32

LoadAcceleratorsA DispatchMessageA TranslateAcceleratorA GetMessageA TranslateMessage

oleaut32

VariantClear VariantInit SysAllocString SysFreeString SysAllocStringLen

mscoree

CorBindToRuntimeEx CLRCreateInstance

Name

.text

Size

905KB

Virtual Size

904KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

51KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

159KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_101f3ed7edc2cc0fba1bc2b27ae374e6_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_mespinoza_njrat

httpapi

kernel32

user32

oleaut32

mscoree

generic