General
- Target 2026-09-06_d64172da42a017dfd032b0d35d847061_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_smoke-loader
- Size 2.2MB
- Sample260906-vhx2jaycnh
- SHA256 7bffaefaf717d9d09d88fd64189f9a3b45ee7b8bc91f5130673ba7a243061255
- MD5 d64172da42a017dfd032b0d35d847061
- SHA1 dc6ef0b13dd06e2a459e6058635584c985008763
- SHA512 dc71f0b89b9ef8059ab5418f24efbd32fb8dda9479c0ac597f337efcdd79d87e22c53361044e7a03374e9baf6fadd9a986b8af72931cee64fe389952b9ce7dec
- SSDEEP 49152:OfU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/:OfU/jIEeQfoR/IuOFVjUu5
- TLSH T193B58D12BAD58432F1B312319DB8C2695674B9A6473689EFB3CC561E4F309C18E32F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-06_d64172da42a017dfd032b0d35d847061_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-06_d64172da42a017dfd032b0d35d847061_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_smoke-loader
- Size 2.2MB
- SHA256 7bffaefaf717d9d09d88fd64189f9a3b45ee7b8bc91f5130673ba7a243061255
- MD5 d64172da42a017dfd032b0d35d847061
- SHA1 dc6ef0b13dd06e2a459e6058635584c985008763
- SHA512 dc71f0b89b9ef8059ab5418f24efbd32fb8dda9479c0ac597f337efcdd79d87e22c53361044e7a03374e9baf6fadd9a986b8af72931cee64fe389952b9ce7dec
- SSDEEP 49152:OfU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/:OfU/jIEeQfoR/IuOFVjUu5
- TLSH T193B58D12BAD58432F1B312319DB8C2695674B9A6473689EFB3CC561E4F309C18E32F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.