2026-08-25_f17cd57c729efd718fb8814bb608dfa1_amadey_avoslocker_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_f17cd57c729efd718fb8814bb608dfa1_amadey_avoslocker_elex_luca-stealer_lynx_medusalocker_njrat
Size 1.3MB
Sample260826-c78v8a1grd
SHA256 b327e3402ad44f4e11fb5942a236c810d9f2347ffc41911d959daa1b52894c91
MD5 f17cd57c729efd718fb8814bb608dfa1
SHA1 53c0563f34c27544546c4412371166837a6d430f
SHA512 af83d2ef2945d0d69d41cd04bc8ebe1cbabc74b6b8e70e4328204f82cb3572242cd9886494a6f6a9577cefe8bca9695eb99cf0124f5b32c64b9b3c165bde5263
SSDEEP 24576:S4McrosNpHdS+XLylfUqMmCDs0K4JRAtT1OafAyZ7i+zXAaOdno8a1pXWj:GEF7ylf0mCDs0K4HA2afAyZGHXo8mF+
TLSH
T11355E0257553C435CAB202709E2DAB6A916FFD080B765ADBB388372E1E385E31E35533
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_f17cd57c729efd718fb8814bb608dfa1_amadey_avoslocker_elex_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-08-25_f17cd57c729efd718fb8814bb608dfa1_amadey_avoslocker_elex_luca-stealer_lynx_medusalocker_njrat

.exe 1.3MB

2026-08-25_f17cd57c729efd718fb8814bb608dfa1_amadey_avoslocker_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH 2601cf1620d96e76361e45752be3b844
SHA256 b327e3402ad44f4e11fb5942a236c810d9f2347ffc41911d959daa1b52894c91
MD5 f17cd57c729efd718fb8814bb608dfa1
SHA1 53c0563f34c27544546c4412371166837a6d430f
SHA512 af83d2ef2945d0d69d41cd04bc8ebe1cbabc74b6b8e70e4328204f82cb3572242cd9886494a6f6a9577cefe8bca9695eb99cf0124f5b32c64b9b3c165bde5263
SSDEEP 24576:S4McrosNpHdS+XLylfUqMmCDs0K4JRAtT1OafAyZ7i+zXAaOdno8a1pXWj:GEF7ylf0mCDs0K4HA2afAyZGHXo8mF+
TLSH
T11355E0257553C435CAB202709E2DAB6A916FFD080B765ADBB388372E1E385E31E35533
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

222118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\360Work\gzturbo\win_master\Release\turbo_vpn-service.pdb

kernel32

CreateFileW DeleteFileW SetFilePointer WriteFile ReleaseMutex CreateMutexW GetLocalTime GetModuleHandleA SetUnhandledExceptionFilter ConnectNamedPipe CreateNamedPipeW GetNamedPipeInfo CancelIo IsDebuggerPresent RaiseException CreateThread GetCurrentThreadId SetThreadPriority EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection UnregisterWaitEx RegisterWaitForSingleObject GetVersionExW GetNativeSystemInfo QueryPerformanceCounter QueryPerformanceFrequency CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW ResetEvent GetSystemDirectoryW GetModuleHandleExA GetCurrentDirectoryW FindClose FindNextFileW GetTempPathW FlushFileBuffers SetFilePointerEx WriteConsoleW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW SetStdHandle HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileSizeEx GetTickCount GetSystemTimeAsFileTime CreateProcessW TerminateProcess GetCurrentProcessId DuplicateHandle ReadFile GetStdHandle GetCommandLineW SetConsoleCtrlHandler WideCharToMultiByte MultiByteToWideChar Sleep SetEvent CreateEventW LocalAlloc WaitForSingleObject OutputDebugStringA LoadLibraryExW GetModuleFileNameW FreeLibrary GetModuleHandleW LocalFree GetProcAddress LoadLibraryW CloseHandle Process32FirstW Process32NextW GetLastError ProcessIdToSessionId CreateToolhelp32Snapshot OpenProcess GetCurrentProcess GetWindowsDirectoryW SetLastError GetFileType HeapAlloc HeapFree ExitThread GetConsoleMode GetConsoleCP ExitProcess RtlUnwind QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread GetStringTypeW EncodePointer DecodePointer LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber

user32

MessageBoxW MsgWaitForMultipleObjectsEx TranslateMessage DispatchMessageW PeekMessageW PostMessageW WaitMessage DefWindowProcW PostQuitMessage KillTimer SetTimer CreateWindowExW GetQueueStatus CallMsgFilterW DestroyWindow RegisterClassExW UnregisterClassW

advapi32

RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW ChangeServiceConfig2W DeleteService ControlService StartServiceW ChangeServiceConfigW OpenServiceW SetSecurityDescriptorDacl InitializeSecurityDescriptor LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf GetExplicitEntriesFromAclW EqualSid SetTokenInformation SetEntriesInAclW CreateWellKnownSid ConvertStringSidToSidW DeleteAce ImpersonateLoggedOnUser OpenProcessToken CreateProcessAsUserW DuplicateTokenEx GetTokenInformation

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoInitializeEx CoUninitialize

secur32

LsaFreeReturnBuffer LsaEnumerateLogonSessions LsaGetLogonSessionData

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

winmm

timeBeginPeriod timeEndPeriod timeGetTime

shlwapi

PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_f17cd57c729efd718fb8814bb608dfa1_amadey_avoslocker_elex_luca-stealer_lynx_medusalocker_njrat

kernel32

user32

advapi32

shell32

ole32

secur32

userenv

winmm

shlwapi

generic