2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader
Size 1.2MB
Sample260814-repzzadj5w
SHA256 043a53c43aa6f1b9684150728c5b70a6a26b5f09755fa069c261ea37b95be2ab
MD5 2ad9dfdf9278acae867ab0baddadb5fe
SHA1 501056740e5ed9aeb27fc9dc68c9766cb904fedb
SHA512 094be6cd4a675bb0f5430b07bc57f42a1b484f049fb6caad79b0ce5a99128dc44b765e3157629eafe608124d536fed32ec051f9d91f32adf32f27f8202bb77be
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXj:r4iwwGJra0uAUfkVy7/ZVij
TLSH
T15D557C2136D58036F2B32731587893649A3AFCB2993A854F73CC666D5F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader

File Explorer

2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader

.exe 1.2MB

2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader

IMPHASH 6df9e06e9a8e140f6b6b79c215bc7dae
SHA256 043a53c43aa6f1b9684150728c5b70a6a26b5f09755fa069c261ea37b95be2ab
MD5 2ad9dfdf9278acae867ab0baddadb5fe
SHA1 501056740e5ed9aeb27fc9dc68c9766cb904fedb
SHA512 094be6cd4a675bb0f5430b07bc57f42a1b484f049fb6caad79b0ce5a99128dc44b765e3157629eafe608124d536fed32ec051f9d91f32adf32f27f8202bb77be
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXj:r4iwwGJra0uAUfkVy7/ZVij
TLSH
T15D557C2136D58036F2B32731587893649A3AFCB2993A854F73CC666D5F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d6:58:f6:1e:8d:8c:01:b8:05:eb:54:53:a2:c4:2b:03:a5:88:d8:88:fb:6f:2a:f4:66:54:12:03:c6:06:cf:70

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Chains

Jun 14, 2023

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

06:0e:2f:8f:9e:1b:8b:e5:18:d5:fe:2b:69:cf:cc:b1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 9, 2023 - Mar 11, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

333206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

StringFromGUID2 IIDFromString OleUninitialize OleInitialize OleRun OleSetContainedObject CoUninitialize CoInitializeEx CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance

shell32

SHGetFolderPathW FindExecutableA Shell_NotifyIconA SHGetFolderPathA ShellExecuteExA

wininet

InternetCrackUrlA InternetTimeToSystemTime InternetTimeFromSystemTime InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetErrorDlg InternetGetConnectedState

user32

SetRect SetFocus IsChild GetAncestor GetFocus RegisterClassExA LoadCursorA GetParent GetDesktopWindow SetWindowLongW GetWindowThreadProcessId GetWindowLongW AdjustWindowRectEx GetWindowRect GetClientRect SetWindowTextW MessageBoxW ReleaseDC GetDC EnableMenuItem GetSystemMenu SetWindowPos CreateWindowExW GetClassInfoExW RegisterClassExW DefWindowProcW SendMessageA IsWindowUnicode MsgWaitForMultipleObjectsEx ShowWindow DestroyWindow wsprintfA CharNextA LoadStringA GetMessageA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA PostMessageA DefWindowProcA PostQuitMessage RegisterClassA GetSystemMetrics LoadImageA SetWindowLongA GetWindowLongA GetCursorPos SetForegroundWindow TrackPopupMenu AppendMenuA CreatePopupMenu CreateWindowExA

comctl32

InitCommonControlsEx

version

GetFileVersionInfoA VerQueryValueW GetFileVersionInfoSizeA

kernel32

TlsSetValue TlsGetValue TlsAlloc RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW IsProcessorFeaturePresent GetSystemInfo UnhandledExceptionFilter VirtualAlloc GetConsoleMode GetFileType GetStdHandle GetModuleFileNameW WriteConsoleW ExitThread FreeLibraryAndExitThread GetDriveTypeW TlsFree VirtualProtect VirtualQuery SetUnhandledExceptionFilter GetConsoleOutputCP GetFileInformationByHandle SystemTimeToTzSpecificLocalTime SetStdHandle HeapAlloc HeapFree HeapSize HeapReAlloc GetFullPathNameW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx CreateDirectoryW ReadConsoleW GetTimeZoneInformation DecodePointer RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrcmpA GetCommandLineA GetCurrentDirectoryW CreateMutexA FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryExA LoadResource SizeofResource lstrcmpiA FindResourceA SetDllDirectoryA MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByte DeleteFileA WaitForSingleObject GetExitCodeProcess LocalFree FormatMessageA lstrlenA SetEvent ResetEvent CreateEventA WaitForMultipleObjects CreateThread lstrcpyA lstrcatA lstrcpynA CreateFileA WriteFile OpenEventA Sleep GetSystemTime GetTempPathA GetCurrentProcess ReadFile FileTimeToSystemTime SystemTimeToFileTime MulDiv GetCurrentThreadId LocalAlloc GetCurrentProcessId GetLocalTime FormatMessageW GetEnvironmentVariableA FindClose FindFirstFileA ExitProcess TerminateProcess GetSystemDirectoryA GetWindowsDirectoryA LockResource SetEndOfFile SetFilePointerEx GetCommandLineW SetLastError GetNativeSystemInfo GetModuleHandleExW CreateDirectoryA FindNextFileA GetFileAttributesA RemoveDirectoryA SetFileAttributesA GetTickCount FindFirstFileExW MoveFileExA SetHandleInformation CreatePipe PeekNamedPipe CreateProcessA GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetModuleHandleExA OpenThread GetExitCodeThread LoadLibraryW LoadLibraryExW OpenMutexA ReleaseMutex QueryPerformanceCounter QueryPerformanceFrequency CreateFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetStringTypeW InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap CloseHandle

advapi32

RegEnumKeyA RegQueryInfoKeyW RegOpenKeyExA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey InitializeSecurityDescriptor SetSecurityDescriptorDacl RegSetValueExA ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExA CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash

oleaut32

SysFreeString VarUI4FromStr VariantClear SysAllocString VariantInit VariantChangeType SysStringByteLen SysAllocStringByteLen GetErrorInfo VariantCopy

shlwapi

ord12

gdi32

GetStockObject GetDeviceCaps

wintrust

WinVerifyTrust

crypt32

CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertGetNameStringW CryptQueryObject CryptStringToBinaryA CryptBinaryToStringA CryptProtectData CryptUnprotectData

msi

ord31 ord159 ord160 ord158 ord91 ord117 ord115 ord44 ord189 ord204 ord67 ord168 ord137 ord141 ord8

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader

PE Signature issue

ole32

shell32

wininet

user32

comctl32

version

kernel32

advapi32

oleaut32

shlwapi

gdi32

wintrust

crypt32

msi

generic