General
- Target 2026-08-18_0d3d9aa28f12dece9961eb9b1066946a_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_smoke-loader
- Size 2.2MB
- Sample260818-1h75dsbf52
- SHA256 4aad7b97ce16cd25a3e91e314195afd78ba70d97f8bcb1344d889e4c9ae62ff7
- MD5 0d3d9aa28f12dece9961eb9b1066946a
- SHA1 6de60581722b6d9696972727392721782ea61bb7
- SHA512 3ed75d6e3e33ff850cf1fab5673fbae975c74300eb9760830a78949e78442c1d4a14eeb1e93b74c4d0b2c37192a8edf352781b27fc0277da0d146a79681667e2
- SSDEEP 49152:7fU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/:7fU/jIEeQfoR/IuOFVjUu5
- TLSH T18CB58D12BAD58432F1B312319DB8C2695674B9A6473689EFB3CC561E4F309C18E32F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-18_0d3d9aa28f12dece9961eb9b1066946a_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_0d3d9aa28f12dece9961eb9b1066946a_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_smoke-loader
- Size 2.2MB
- SHA256 4aad7b97ce16cd25a3e91e314195afd78ba70d97f8bcb1344d889e4c9ae62ff7
- MD5 0d3d9aa28f12dece9961eb9b1066946a
- SHA1 6de60581722b6d9696972727392721782ea61bb7
- SHA512 3ed75d6e3e33ff850cf1fab5673fbae975c74300eb9760830a78949e78442c1d4a14eeb1e93b74c4d0b2c37192a8edf352781b27fc0277da0d146a79681667e2
- SSDEEP 49152:7fU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/:7fU/jIEeQfoR/IuOFVjUu5
- TLSH T18CB58D12BAD58432F1B312319DB8C2695674B9A6473689EFB3CC561E4F309C18E32F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.