General
- Target 2026-08-12_ef3dc03e8c33f9d10daf00b7795e9048_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_smoke-loader
- Size 2.2MB
- Sample260812-dw7dpat1d1
- SHA256 1b76c68821cb5831a3a358ba99e9c22e0ec44536b6a39625cfaf238ea14b75aa
- MD5 ef3dc03e8c33f9d10daf00b7795e9048
- SHA1 3089fde0bf226bcbc0d963cb5b4d5ec92607c0a7
- SHA512 9e135d8cc5757d3412968d596aceb09d21f337466f09785570d1d6c791aeadb12ffb1d7abf5e9d5a25ee98298c369862c9e51444f6f6702b2f2a7c95ba897dc5
- SSDEEP 49152:COU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Y:COU/jIEeQfoR/IuOFVjUu5u
- TLSH T152B58D12BAD58432F1B312319DB8C2695674B9A6473689EFB3CC561E4F309C1CA32F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_ef3dc03e8c33f9d10daf00b7795e9048_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_ef3dc03e8c33f9d10daf00b7795e9048_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_ef3dc03e8c33f9d10daf00b7795e9048_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_smoke-loader
- Size 2.2MB
- SHA256 1b76c68821cb5831a3a358ba99e9c22e0ec44536b6a39625cfaf238ea14b75aa
- MD5 ef3dc03e8c33f9d10daf00b7795e9048
- SHA1 3089fde0bf226bcbc0d963cb5b4d5ec92607c0a7
- SHA512 9e135d8cc5757d3412968d596aceb09d21f337466f09785570d1d6c791aeadb12ffb1d7abf5e9d5a25ee98298c369862c9e51444f6f6702b2f2a7c95ba897dc5
- SSDEEP 49152:COU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/Y:COU/jIEeQfoR/IuOFVjUu5u
- TLSH T152B58D12BAD58432F1B312319DB8C2695674B9A6473689EFB3CC561E4F309C1CA32F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.