2026-08-15_b9d2448ab861c12efd2e4231f8b4df5d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_b9d2448ab861c12efd2e4231f8b4df5d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar
Size 76.4MB
Sample260815-bkbrjadb26
SHA256 8f1ee7f2b4c3bc46daac10615c19b8e377d6199929cda9f69b8a16c40044e488
MD5 b9d2448ab861c12efd2e4231f8b4df5d
SHA1 0d4dd7eba22ba5fedacb05ef0ff5ae35de65fab8
SHA512 ec4c4eca93d16a9508794d527e46234d9ed693808623e44ff8d92cb6427155c759b76467da091cc031c4ae0536f46785aa991d97db3ddeb7f5e6d70e3ad530b4
SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpJ:9iLVelepClAy6uw3W0BEROh2nvvr
TLSH
T1B708011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_b9d2448ab861c12efd2e4231f8b4df5d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar

File Explorer

2026-08-15_b9d2448ab861c12efd2e4231f8b4df5d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar

.exe 76.4MB

2026-08-15_b9d2448ab861c12efd2e4231f8b4df5d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar

IMPHASH 63c11544893457fb321a43dc42728c6a
SHA256 8f1ee7f2b4c3bc46daac10615c19b8e377d6199929cda9f69b8a16c40044e488
MD5 b9d2448ab861c12efd2e4231f8b4df5d
SHA1 0d4dd7eba22ba5fedacb05ef0ff5ae35de65fab8
SHA512 ec4c4eca93d16a9508794d527e46234d9ed693808623e44ff8d92cb6427155c759b76467da091cc031c4ae0536f46785aa991d97db3ddeb7f5e6d70e3ad530b4
SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpJ:9iLVelepClAy6uw3W0BEROh2nvvr
TLSH
T1B708011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

359528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Faronics\morocco\Faronics_Hg\Deploy\Faronics-Deploy_CloudAgent\Source\bin\Release\FaronicsDeployAgent\Win32\FaronicsDeployAgent.pdb

comctl32

ord17

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteExW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

crypt32

CryptStringToBinaryA CryptBinaryToStringA

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

kernel32

LocalAlloc LockResource DeviceIoControl FindNextFileW LocalFree SetFilePointer SetEndOfFile InterlockedDecrement ReadFile GetCurrentProcess LoadLibraryW GetUserDefaultLangID SetLastError GetVersionExW GetExitCodeProcess TerminateProcess IsWow64Process ExpandEnvironmentStringsW GetCurrentProcessId Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GlobalLock GlobalAlloc GlobalUnlock GetComputerNameExW GlobalFree GetWindowsDirectoryW CreateThread GetSystemDefaultLCID GetLocaleInfoW GetTimeZoneInformation MapViewOfFile UnmapViewOfFile CreateFileMappingW MoveFileExW GetSystemWindowsDirectoryW FindClose GetPrivateProfileStringW CopyFileW GetFileAttributesW WritePrivateProfileStringW GetTempPathW GetPrivateProfileIntW CreateEventW RemoveDirectoryW GetSystemInfo LoadResource LeaveCriticalSection EnterCriticalSection SystemTimeToFileTime FileTimeToSystemTime InterlockedCompareExchange InterlockedExchange GetProcessHeap WriteConsoleW SetStdHandle HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize IsValidCodePage GetOEMCP GetACP GetCurrentThreadId TlsFree TlsSetValue TlsGetValue GetProcAddress SizeofResource GetSystemDirectoryW GetModuleHandleW WaitForSingleObject CreateDirectoryW CreateProcessW CloseHandle GetLocalTime CreateFileW WriteFile DeleteFileW OutputDebugStringA MoveFileW GetLastError lstrlenW MultiByteToWideChar GetBinaryTypeW GetModuleFileNameW Sleep WideCharToMultiByte OutputDebugStringW FindFirstFileW TlsAlloc FlushFileBuffers GetConsoleMode GetConsoleCP FindResourceW InitializeCriticalSection FindResourceExW ExitProcess HeapDestroy HeapCreate IsProcessorFeaturePresent GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW HeapAlloc RtlUnwind RaiseException GetCPInfo GetStartupInfoW HeapSetInformation GetStringTypeW EncodePointer DecodePointer DeleteCriticalSection HeapFree GetSystemTimeAsFileTime GetCommandLineW InterlockedIncrement

user32

GetDesktopWindow EndDialog InvalidateRect LoadIconW PtInRect BeginPaint SetFocus GetClientRect DialogBoxParamW SetWindowPos GetWindowRect SetTimer SetWindowRgn EndPaint GetSystemMetrics ShowWindow SendMessageW SetWindowTextW MoveWindow wsprintfW MessageBoxExW ExitWindowsEx KillTimer

gdi32

SelectObject Rectangle CreateRoundRectRgn CreatePen CreateSolidBrush DeleteObject

advapi32

DeregisterEventSource RegCreateKeyExA ReportEventW RegOpenKeyExA RegisterEventSourceW RegCreateKeyA RegDeleteKeyW RegCreateKeyExW LookupAccountSidW ConvertStringSidToSidW RegQueryInfoKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken QueryServiceConfigW ControlService QueryServiceStatus StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW

ole32

CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CLSIDFromProgID CoCreateInstance CoInitialize CoUninitialize

oleaut32

VariantTimeToSystemTime VarCmp SysStringByteLen VariantChangeType SysAllocStringByteLen SysStringLen SysFreeString VariantInit VariantClear SysAllocString VariantCopy

shlwapi

PathGetArgsW PathAddBackslashW StrTrimW PathRemoveFileSpecW StrStrIW PathUnquoteSpacesW PathQuoteSpacesW PathRemoveArgsW PathFileExistsW

winhttp

WinHttpSetCredentials WinHttpReadData WinHttpOpenRequest WinHttpOpen WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpSetOption WinHttpReceiveResponse WinHttpSendRequest

msi

ord119 ord163 ord17 ord160 ord20 ord158 ord125 ord115 ord32 ord118 ord8 ord92 ord159

gdiplus

GdiplusStartup GdipCreatePen1 GdipCreatePath GdipCloneImage GdipCreateFromHDC GdipCreateFontFamilyFromName GdipDrawString GdipDeletePath GdipCreateFont GdiplusShutdown GdipDeleteBrush GdipFree GdipDeletePen GdipCloneBrush GdipStartPathFigure GdipCreateBitmapFromStream GdipSetTextRenderingHint GdipDrawPath GdipDisposeImage GdipAlloc GdipDrawImageI GdipCreateSolidFill GdipAddPathArcI GdipDeleteFontFamily GdipAddPathLineI GdipClosePathFigure GdipSetSmoothingMode GdipDeleteGraphics GdipDeleteFont

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_b9d2448ab861c12efd2e4231f8b4df5d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedid_luca-stealer_lynx_mafia_njrat_remcos_rhadamanthys_smoke-loader_tofsee_vidar

comctl32

shell32

version

crypt32

rpcrt4

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

winhttp

msi

gdiplus

generic