2026-08-12_c7bdbbcad6148b0bae00be6645a3a2b7_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_c7bdbbcad6148b0bae00be6645a3a2b7_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot
Size 3.5MB
Sample260812-rh17eadb73
SHA256 b8bf592db0580e8b1c711c92d9e238931ea7d71ac72d18cde923cb08e5809558
MD5 c7bdbbcad6148b0bae00be6645a3a2b7
SHA1 4fce0fcf8eb5e392ae067be03fc9820544900ad2
SHA512 43816bb3d8e7fbcadb02524f73cb8a2c0dea0ae1bc0f2f301a56662174dddeec389b91913701230598d07c38d1bb39329640445e2fb8a7442c968aa74d5a064c
SSDEEP 98304:iaKOqIry1mP6cVzORPGQxZLZ/IJWxQnhK3VWRhg:iaKOBjKRuASWxQnheMRhg
TLSH
T15FF5BF293D944077C03382315D59F635E6ADE6F20F3EE1C722949EAD1D252C28E3A67B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-12_c7bdbbcad6148b0bae00be6645a3a2b7_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot

File Explorer

2026-08-12_c7bdbbcad6148b0bae00be6645a3a2b7_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot

.exe 3.5MB

2026-08-12_c7bdbbcad6148b0bae00be6645a3a2b7_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot

IMPHASH 8c52b8bb0ec6315810d9a44437c42faf
SHA256 b8bf592db0580e8b1c711c92d9e238931ea7d71ac72d18cde923cb08e5809558
MD5 c7bdbbcad6148b0bae00be6645a3a2b7
SHA1 4fce0fcf8eb5e392ae067be03fc9820544900ad2
SHA512 43816bb3d8e7fbcadb02524f73cb8a2c0dea0ae1bc0f2f301a56662174dddeec389b91913701230598d07c38d1bb39329640445e2fb8a7442c968aa74d5a064c
SSDEEP 98304:iaKOqIry1mP6cVzORPGQxZLZ/IJWxQnhK3VWRhg:iaKOBjKRuASWxQnheMRhg
TLSH
T15FF5BF293D944077C03382315D59F635E6ADE6F20F3EE1C722949EAD1D252C28E3A67B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

28:a2:af:d7:97:bc:f5:66:cf:58:49:e4:0e:40:28:d6:8e:3e:02:71:30:bc:19:ec:f5:c9:f7:4b:19:e0:c7:a7

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=101151819,CN=COREL CORPORATION,O=Alludo (COREL CORPORATION),L=Ottawa,ST=Ontario,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,1.3.6.1.4.1.311.60.2.1.2=#13104272697469736820436f6c756d626961,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 18, 2025

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

PE Signature issue

Digest

01:2a:ed:61:f3:3d:ef:17:4b:e9:64:17:25:0c:70:c5:eb:5f:28:51

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Feb 18, 2025

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

4d:f3:f6:8e:c1:34:f6:47:75:b8:0f:d2:20:3b:46:88

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 19, 2024 - Jan 18, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1577476

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\bld\STUB-CDGV2025STUB-JOB1\build\Sample\StubCore\Release\CorelDRAWGraphicsSuite2025Installer.pdb

kernel32

GlobalHandle GlobalFree LocalAlloc LocalReAlloc LocalFree GetCurrentProcessId LoadResource LockResource SizeofResource FindResourceW WideCharToMultiByte GlobalSize MulDiv FormatMessageW CopyFileW MultiByteToWideChar SetEvent WaitForSingleObject CreateEventW GetCurrentThreadId SetThreadPriority ResumeThread CompareStringW lstrcmpA GlobalGetAtomNameW FileTimeToSystemTime GetThreadLocale EncodePointer GetSystemDirectoryW FreeLibrary LoadLibraryExW LoadLibraryA GlobalDeleteAtom lstrcmpW GlobalAddAtomW GlobalFindAtomW CreateFileW DeleteFileW FindClose FindFirstFileW FlushFileBuffers GetFileSize GetFullPathNameW GetVolumeInformationW LockFile ReadFile SetEndOfFile SetFilePointer UnlockFile WriteFile DuplicateHandle GetCurrentProcess lstrcmpiW GlobalFlags GetVersionExW GetLocaleInfoW GetUserDefaultUILanguage VirtualProtect FileTimeToLocalFileTime GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime SetErrorMode lstrcpyW GetCurrentDirectoryW FindResourceExW GetWindowsDirectoryW VerSetConditionMask VerifyVersionInfoW GlobalLock GetTickCount GetProfileIntW SearchPathW GetTempFileNameW GetUserDefaultLCID UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateDirectoryW GetCommandLineW RemoveDirectoryW MoveFileExW ExitProcess CreateProcessW FindNextFileW CreateMutexW GetExitCodeProcess SetFilePointerEx GetLongPathNameW OpenProcess GetDiskFreeSpaceExW GetNativeSystemInfo GetUserGeoID ReadProcessMemory QueryFullProcessImageNameW GetSystemTime QueueUserWorkItem DeviceIoControl GetSystemInfo InitializeCriticalSectionEx ExpandEnvironmentStringsW ResetEvent WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GlobalUnlock GlobalReAlloc GlobalAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection LoadLibraryW GetModuleHandleW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc RaiseException DecodePointer OutputDebugStringA SetLastError GlobalMemoryStatusEx GetProcAddress GetLastError GetModuleHandleA lstrlenW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW GetTimeFormatW GetDateFormatW PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetStdHandle GetFileType SetStdHandle QueryPerformanceFrequency VirtualAlloc GetCommandLineA HeapQueryInformation GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind OutputDebugStringW GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx GetStringTypeW LoadLibraryExA CreateThread CloseHandle GetTempPathW Sleep VirtualQuery WaitForSingleObjectEx

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegDeleteValueW RegOpenKeyExW RegCloseKey CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges RegQueryInfoKeyW OpenProcessToken RegQueryValueExW RegEnumValueW RegSetValueExW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW

gdiplus

GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipBitmapLockBits GdipGetImageWidth GdipDrawImageI GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipDeleteGraphics GdipCreateFromHDC GdipSetInterpolationMode GdipCreateBitmapFromHBITMAP GdipDrawImageRectI GdipGetImageHeight GdipGetImageGraphicsContext

msimg32

TransparentBlt AlphaBlend

oleacc

CreateStdAccessibleObject LresultFromObject AccessibleObjectFromWindow

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

oledlg

OleUIBusyW

rpcrt4

UuidToStringW RpcStringFreeW

uxtheme

GetCurrentThemeName CloseThemeData IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemeColor GetThemePartSize OpenThemeData DrawThemeParentBackground DrawThemeText GetThemeSysColor DrawThemeBackground GetWindowTheme

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_c7bdbbcad6148b0bae00be6645a3a2b7_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot

PE Signature issue

PE Signature issue

kernel32

winspool.drv

advapi32

gdiplus

msimg32

oleacc

imm32

winmm

oledlg

rpcrt4

uxtheme

generic