2026-08-12_01a1621fae28f6c71b6d2f529e4e44c2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos

General

Target
2026-08-12_01a1621fae28f6c71b6d2f529e4e44c2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos
Size 290KB
Sample260812-eelakaaj3y
SHA256 e84c8a82ce872127de9c418c1afd082961dfb1ac602852535476e1752ae17a92
MD5 01a1621fae28f6c71b6d2f529e4e44c2
SHA1 c46784c4597204d7f577efa953628ee5fcbeed7c
SHA512 9ba8732720b9b6974a6f6b60b3b3c8695f11b790ddfc76920b399f45a092ef78abb70479c8ec65bfc22c7014dc0204dc3881b4ba3486f21e197921e0bb66631a
SSDEEP 6144:ASgYi4EDW3Qa6b10JGSIVLMDvbRSs5q3M4mF5sAOj/dxCx32S:ASbi4EcQa6b10JGSAYjbP/4OSdxQX
TLSH
T17B549E717284C873D89204305AE8C7B6657DBE704FA18ADB77882B2D6E302D36A35F57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_01a1621fae28f6c71b6d2f529e4e44c2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos

File Explorer

2026-08-12_01a1621fae28f6c71b6d2f529e4e44c2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos

.exe 290KB

2026-08-12_01a1621fae28f6c71b6d2f529e4e44c2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos

IMPHASH 0d7e6f9fa81515d8153395a2e77c0eb7
SHA256 e84c8a82ce872127de9c418c1afd082961dfb1ac602852535476e1752ae17a92
MD5 01a1621fae28f6c71b6d2f529e4e44c2
SHA1 c46784c4597204d7f577efa953628ee5fcbeed7c
SHA512 9ba8732720b9b6974a6f6b60b3b3c8695f11b790ddfc76920b399f45a092ef78abb70479c8ec65bfc22c7014dc0204dc3881b4ba3486f21e197921e0bb66631a
SSDEEP 6144:ASgYi4EDW3Qa6b10JGSIVLMDvbRSs5q3M4mF5sAOj/dxCx32S:ASbi4EcQa6b10JGSAYjbP/4OSdxQX
TLSH
T17B549E717284C873D89204305AE8C7B6657DBE704FA18ADB77882B2D6E302D36A35F57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

75764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\pub_bh8h\rc_bug_mas_v12_2409\Build\Release\WPSOffice\office6\kvprinter\kvpins.pdb

kernel32

SetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW GetTempFileNameW RemoveDirectoryW SetFileAttributesW GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle GetLastError SetLastError FatalAppExitW HeapAlloc HeapFree GetProcessHeap SetEvent WaitForSingleObject CreateEventW SetWaitableTimer Sleep CreateWaitableTimerW GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess TerminateThread GetExitCodeThread ResumeThread CreateProcessW OpenProcess GetTickCount GetSystemDirectoryW GetNativeSystemInfo VirtualQuery GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree FormatMessageW GetPrivateProfileIntW GetPrivateProfileStringW CopyFileW MoveFileExW WideCharToMultiByte GetLocaleInfoW GetThreadLocale GetSystemDefaultLCID CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer OutputDebugStringA RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection FreeLibrary LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW MultiByteToWideChar CreateFileMappingW MapViewOfFile UnmapViewOfFile IsValidCodePage CreateFileW LoadLibraryW GetCurrentThreadId GetWindowsDirectoryW IsWow64Process DecodePointer HeapReAlloc HeapSize GetConsoleMode GetSystemInfo VirtualProtect LoadLibraryExA lstrlenA SwitchToThread CreateThread QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile ExitProcess GetFileType LCMapStringW FindClose FindFirstFileExW FindNextFileW GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleCP WriteConsoleW

kvpvbsext

?RunScript@ScriptInterpreter@@YGJPB_WPBD0PAPAUtagSAFEARRAY@@PAUtagVARIANT@@@Z

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_01a1621fae28f6c71b6d2f529e4e44c2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos

kernel32

kvpvbsext

generic