c0a79f057f2d347b5cce81e33fec263ebd75a965eb561b7c98fb1c6aa7adce7e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_736b91ceda8ae2807898994555317977_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
Size 1.5MB
Sample260821-e1l4zshf24
SHA256 c0a79f057f2d347b5cce81e33fec263ebd75a965eb561b7c98fb1c6aa7adce7e
MD5 736b91ceda8ae2807898994555317977
SHA1 e295d4ad8ecb7c244752489031113616151171ee
SHA512 b6fe497578159f4d03cd3668e9453e1f29f59b478f82fc2157d7732fc6dfbc4da83cf780fe7e3789ffdb09ce9cee9ac01ec2b59a539bfc01b6bcbb7cc7593754
SSDEEP 49152:7maeeAxhHcKt5188it9LfG6ulQknhekqYmcHwWq:7maeeQc0OnhfG6ulQ0AkqaV
TLSH
T1697501037ACC7CE2D075023037BB97E5C72EED2559A1D99F62D4026ACA7C0937622BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1760	avcenter.exe
2840	avcenter.exe

Loads dropped DLL 1 IoCs

pid	Process
2840	avcenter.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_736b91ceda8ae2807898994555317977_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avcenter.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_736b91ceda8ae2807898994555317977_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_736b91ceda8ae2807898994555317977_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4508

C:\ProgramData\AviraProductFamily\avcenter.exe
C:\ProgramData\AviraProductFamily\avcenter.exe
1⤵
- Executes dropped EXE
PID:1760

C:\ProgramData\AviraProductFamily\avcenter.exe
"C:\ProgramData\AviraProductFamily\avcenter.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES.RC

Path C:\ProgramData\AviraProductFamily\RES.RC
Size 32KB
SHA256 4d22ee588789d00cdbae100f64fcd75e92779463c1f6ada866e131e238016b1b
MD5 0f92e98c922a4309194114917ac8b17f
SHA1 78ec623b3b0532c1461e7ea46c38cc1b655adf32
SHA512 32992fc7f82fef79e7f9f55ba2074935272154d077f1b56b72d9f568bde7927956d7acdb69ab242411dc0f0d978bf3035943e1bdf66e67cf27a0c97ab4ca6de0
SSDEEP 384:pLK++Q4isaz0NaPsbcrtpLHQTh7cWxc7ekXQyNKQtIixb/X/AHZRWIGABGVLjmpr:pP+QsIUbchpQtc1qHQtUTBGVLj8r
TLSH
T1A4E22A42226AE3D81798753A75075D538E88983CBFDF3E2ACCA0DA91BC6D30FC521575
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avcenter.exe

Path C:\ProgramData\AviraProductFamily\avcenter.exe
Size 2.7MB
SHA256 d51b187d3d3bdcd4841a8bdbe3306e223647c673156e868c71c9b241ca48ea2b
MD5 2b288dd03db8bb2426de9101fc61e9a6
SHA1 fe22cd98f33ed674f0a20e9ed7fc4956921274ea
SHA512 b687bfbae90bcca378396c67c24d7a76c1c81f2ceffc08de6c75c9f6742347b523772d9f5cdc97d47a13b16d5f9ba3124667a9c6efdcc12c137b3d863fe94c79
SSDEEP 49152:jnDdPffCVmaLGYvHVMv5Mck3P6yhKGkZ565Sjh5WqNQ8S80kbzaTh/v:XdnfClLGYvVMv5Mck3P6yhKGkZM5Sjhm
TLSH
T169D57D2079A140B6D1E202304D89F77AB5AFBD608F7141CB1384BE291E75EE35A25F7B
MD5 SHA1 SHA512 SSDEEP TLSH