2026-08-10_229e97eeb457da895a2e710cb00f33db_amadey_avoslocker_elex_luca-stealer_lynx_njrat

General

Target
2026-08-10_229e97eeb457da895a2e710cb00f33db_amadey_avoslocker_elex_luca-stealer_lynx_njrat
Size 1.3MB
Sample260811-acxtcsbd35
SHA256 d7aa2b677f9e9a73555d38a8e3d73eeda2210868522a85e9de97769746c635a4
MD5 229e97eeb457da895a2e710cb00f33db
SHA1 24bf1be0aae228ead8a92a97b19504db68731542
SHA512 2bd2126a6b17bcfb5205d15cbd811b2c2a4ec3a3d1f76b21026d0b10383996d9ec3acd71fe343601f4351df0498bd26ecce0a016b2c5109dfd31f2eeb77e781a
SSDEEP 24576:KAYJC3WYtT9PNMy6KdXNyBo4kx929bL3Hnx:TWYtT9PN7ZdYB+kn3Hnx
TLSH
T13155BF1076B9C236E5B222701A7897B2943EBC255F3555DBE3809E7E09303E25E31B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_229e97eeb457da895a2e710cb00f33db_amadey_avoslocker_elex_luca-stealer_lynx_njrat

File Explorer

2026-08-10_229e97eeb457da895a2e710cb00f33db_amadey_avoslocker_elex_luca-stealer_lynx_njrat

.exe 1.3MB

2026-08-10_229e97eeb457da895a2e710cb00f33db_amadey_avoslocker_elex_luca-stealer_lynx_njrat

IMPHASH fb4ec1dd446fd6a9e007a0178f948d1c
SHA256 d7aa2b677f9e9a73555d38a8e3d73eeda2210868522a85e9de97769746c635a4
MD5 229e97eeb457da895a2e710cb00f33db
SHA1 24bf1be0aae228ead8a92a97b19504db68731542
SHA512 2bd2126a6b17bcfb5205d15cbd811b2c2a4ec3a3d1f76b21026d0b10383996d9ec3acd71fe343601f4351df0498bd26ecce0a016b2c5109dfd31f2eeb77e781a
SSDEEP 24576:KAYJC3WYtT9PNMy6KdXNyBo4kx929bL3Hnx:TWYtT9PN7ZdYB+kn3Hnx
TLSH
T13155BF1076B9C236E5B222701A7897B2943EBC255F3555DBE3809E7E09303E25E31B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

336400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\xml-data\build-dir\CODRU-IN-SOURCES\bin\Win32\Release\Installer.pdb

kernel32

GetLastError InitializeCriticalSectionEx GetModuleHandleW GetProcAddress GetSystemDirectoryW FormatMessageA GetModuleFileNameW SetEnvironmentVariableW FreeLibrary FindResourceW LoadResource LockResource SizeofResource CreateFileW GetFileSizeEx CloseHandle ReadFile FindFirstFileW FindNextFileW GetCurrentThreadId InitializeCriticalSection DeleteCriticalSection EnterCriticalSection SetEvent LeaveCriticalSection CreateEventW TryEnterCriticalSection IsWow64Process GetNativeSystemInfo GetCurrentProcess WaitForSingleObject MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter CreateThread CreateDirectoryW GetTempFileNameW DeleteFileW GetCurrentProcessId ResetEvent HeapAlloc GetProcessHeap HeapFree CreateProcessW GetExitCodeProcess GetProcessId OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW ReadProcessMemory GetTempPathW CopyFileW MoveFileExW RemoveDirectoryW GetTickCount GetFileAttributesExW FindClose WaitForMultipleObjects SetFilePointer WriteFile SetLastError Sleep LocalFree FormatMessageW LoadLibraryW GetSystemTime CreateFileMappingW MapViewOfFile UnmapViewOfFile GetExitCodeThread GetCommandLineW LoadLibraryExW QueryDosDeviceW K32GetProcessImageFileNameW K32GetModuleFileNameExW SetFileAttributesW GetSystemInfo lstrlenW VirtualQuery VirtualProtect WriteConsoleW LoadLibraryExA HeapSize GetStringTypeW SetCurrentDirectoryW GetCurrentDirectoryW FindFirstFileExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle ReadConsoleW

dbghelp

MiniDumpWriteDump

rpcrt4

UuidCreate

Name

.text

Size

497KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

182KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_229e97eeb457da895a2e710cb00f33db_amadey_avoslocker_elex_luca-stealer_lynx_njrat

kernel32

dbghelp

rpcrt4

generic