2026-08-14_819d586445d6d7e2f3cfd0192349127e_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_819d586445d6d7e2f3cfd0192349127e_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 284KB
Sample260814-ejptjstzev
SHA256 9e8c837b7c92de35c7271fa64c77cc7a2db03a466aaaec62499f93e684e5d7f4
MD5 819d586445d6d7e2f3cfd0192349127e
SHA1 34e359fd5213360401f1de55b5af1c7853ce9e87
SHA512 9b986f25052bf38fa6eee4898eb925e08bfb747a4dc3ab01dbf7876dd7a49c6149c97a7fb9189e38b07738178d45cdc3951fbdcfcc5e33a5d90a3b91a5840fa5
SSDEEP 6144:UOJ6eevK47JBbjTDptmjadhzsZwHdmyykrBV+UdvrEFp7hKMenh:fJM7JBbjTDptaadj8hcBjvrEH7Leh
TLSH
T158548D603290C7F7C562043038E8FAB679A9B97D0B6658D7B3941B6D0E3D2C35635E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-14_819d586445d6d7e2f3cfd0192349127e_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-08-14_819d586445d6d7e2f3cfd0192349127e_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 284KB

2026-08-14_819d586445d6d7e2f3cfd0192349127e_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH 74f13a1b9c5043c440d6e5ec512fbec4
SHA256 9e8c837b7c92de35c7271fa64c77cc7a2db03a466aaaec62499f93e684e5d7f4
MD5 819d586445d6d7e2f3cfd0192349127e
SHA1 34e359fd5213360401f1de55b5af1c7853ce9e87
SHA512 9b986f25052bf38fa6eee4898eb925e08bfb747a4dc3ab01dbf7876dd7a49c6149c97a7fb9189e38b07738178d45cdc3951fbdcfcc5e33a5d90a3b91a5840fa5
SSDEEP 6144:UOJ6eevK47JBbjTDptmjadhzsZwHdmyykrBV+UdvrEFp7hKMenh:fJM7JBbjTDptaadj8hcBjvrEH7Leh
TLSH
T158548D603290C7F7C562043038E8FAB679A9B97D0B6658D7B3941B6D0E3D2C35635E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

14:c4:dd:05:a5:2e:10:5b:be:a1:c5:c2:07:8e:84:46:ab:73:d3:c0:0d:81:03:3d:b6:69:45:b7:e3:7b:9b:e5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 15, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2023 - Nov 14, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:dd:5d:57:1d:95:d4:ad:aa:1b:00:01:00:00:01:dd

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 12, 2023 - Jan 10, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

60224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\troubleshooters\Binaries\SIGMA\PrintMetadataTroubleshooter\Release\PrintMetadataTroubleshooter.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

api-ms-win-core-path-l1-1-0

PathCchSkipRoot PathAllocCombine

kernel32

GetLastError GetProcAddress ExpandEnvironmentStringsW CreateDirectoryW FindStringOrdinal FindClose FindFirstFileW RemoveDirectoryW FindNextFileW DeleteFileW SetFileAttributesW GetFileAttributesW CloseHandle SetLastError GetFileInformationByHandleEx CreateFileW LocalFree GetFullPathNameW LocalAlloc MoveFileExW HeapReAlloc HeapSize CopyFileW SetFilePointerEx GetStringTypeW SetStdHandle LoadLibraryW IsDebuggerPresent FormatMessageW GetCurrentThreadId OutputDebugStringW SleepEx FlushFileBuffers CompareStringOrdinal FileTimeToSystemTime FreeLibrary GetConsoleCP RaiseException LCMapStringW CompareStringW CreateEventExW SetEvent GetModuleFileNameA InitOnceBeginInitialize CreateSemaphoreExW HeapFree ReleaseSemaphore GetModuleHandleExW GetConsoleMode WaitForSingleObject ReleaseMutex InitOnceComplete WaitForSingleObjectEx OpenSemaphoreW HeapAlloc CreateMutexExW WriteConsoleW GetProcessHeap DecodePointer GetModuleHandleW DebugBreak SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCurrentProcessId MultiByteToWideChar GetCPInfo GetOEMCP GetACP UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent CreateEventW GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileType FindFirstFileExW IsValidCodePage

shlwapi

PathFileExistsW PathFindFileNameW PathFindExtensionW

api-ms-win-devices-query-l1-1-0

DevFreeObjectProperties DevCloseObjectQuery DevGetObjectProperties DevCreateObjectQuery

ole32

CoCreateInstance CoUninitialize CoCreateFreeThreadedMarshaler CoInitializeEx CoWaitForMultipleHandles

advapi32

QueryServiceStatus EventWriteTransfer EventRegister EventSetInformation EventUnregister CloseServiceHandle ControlService NotifyServiceStatusChangeW OpenServiceW ChangeServiceConfigW OpenSCManagerW

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

winspool.drv

EnumPrinterDriversW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_819d586445d6d7e2f3cfd0192349127e_amadey_avoslocker_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

api-ms-win-core-synch-l1-2-0

api-ms-win-core-path-l1-1-0

kernel32

shlwapi

api-ms-win-devices-query-l1-1-0

ole32

advapi32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

winspool.drv

generic