2026-09-10_87d2280b20c2b588464d4ebfcb3e7c22_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_87d2280b20c2b588464d4ebfcb3e7c22_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos
Size 310KB
Sample260910-rhx5raytby
SHA256 b7151694de2c89400eb101949efbbca38b3fda04dc562b06de829ac830022000
MD5 87d2280b20c2b588464d4ebfcb3e7c22
SHA1 583dc3aaca22ca464b76070510e3186f3302c1b1
SHA512 f62ab273f9a7287432d7e5ba2481487c217c3b5762784514c90df0fa6bb5be8608ea7a10ef25b8b09b87677eb3f67dc59c54891a866d06c7ced74617cab971f7
SSDEEP 6144:nKk2lPQ23kvE6BVADkpIaCb10JOigh3gzcbVqKGqdM4mF5sAOj/dxCB3MW9JcQ:nKVlPQ23kvE6BVAUIaCb10JOikwAb2dx
TLSH
T132649E717684C832D892043069E8C7F6697DBA700FA18AD777881B6D5E302D36B39F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-10_87d2280b20c2b588464d4ebfcb3e7c22_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos

.exe 310KB

2026-09-10_87d2280b20c2b588464d4ebfcb3e7c22_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos

IMPHASH 4e1a5d600cae73049ecc38720cc848c4
SHA256 b7151694de2c89400eb101949efbbca38b3fda04dc562b06de829ac830022000
MD5 87d2280b20c2b588464d4ebfcb3e7c22
SHA1 583dc3aaca22ca464b76070510e3186f3302c1b1
SHA512 f62ab273f9a7287432d7e5ba2481487c217c3b5762784514c90df0fa6bb5be8608ea7a10ef25b8b09b87677eb3f67dc59c54891a866d06c7ced74617cab971f7
SSDEEP 6144:nKk2lPQ23kvE6BVADkpIaCb10JOigh3gzcbVqKGqdM4mF5sAOj/dxCB3MW9JcQ:nKVlPQ23kvE6BVAUIaCb10JOikwAb2dx
TLSH
T132649E717684C832D892043069E8C7F6697DBA700FA18AD777881B6D5E302D36B39F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

0a:67:b9:4a:60:56:ac:0f:8f:a9:d3:f9:a1:ea:15:3f:16:58:5f:35:11:01:86:95:13:c1:e7:da:60:e6:be:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Jul 24, 2026

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

f7:70:ff:31:f5:81:86:58:d7:bb:7e:66:6e:8e:83:18:a6:df:21:bc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Jul 24, 2026

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

0f:52:f2:95:33:ee:ba:d4:11:50:36:79:4e:e1:07:4f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2024 - Oct 17, 2027

Minor OS version

Major OS version

Entry point

75760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_1ikas\rc_bugfix_master_\Build\Release\WPSOffice\office6\kvprinter\kvpins.pdb

kvpvbsext

?RunScript@ScriptInterpreter@@YGJPB_WPBD0PAPAUtagSAFEARRAY@@PAUtagVARIANT@@@Z

kernel32

GetWindowsDirectoryW SetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW GetTempFileNameW RemoveDirectoryW SetFileAttributesW GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle GetLastError SetLastError FatalAppExitW HeapAlloc HeapFree GetProcessHeap SetEvent WaitForSingleObject CreateEventW SetWaitableTimer Sleep CreateWaitableTimerW GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess TerminateThread GetExitCodeThread ResumeThread CreateProcessW OpenProcess GetTickCount GetSystemDirectoryW GetNativeSystemInfo VirtualQuery GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree FormatMessageW GetPrivateProfileIntW GetPrivateProfileStringW CopyFileW MoveFileExW WideCharToMultiByte GetLocaleInfoW GetThreadLocale GetSystemDefaultLCID CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer OutputDebugStringA RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection FreeLibrary LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW MultiByteToWideChar CreateFileMappingW MapViewOfFile UnmapViewOfFile IsValidCodePage CreateFileW LoadLibraryW GetCurrentThreadId WriteConsoleW IsWow64Process DecodePointer HeapReAlloc HeapSize GetSystemInfo lstrlenA SwitchToThread CreateThread VirtualProtect LoadLibraryExA QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile ExitProcess GetFileType LCMapStringW FindClose FindFirstFileExW FindNextFileW GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_87d2280b20c2b588464d4ebfcb3e7c22_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_remcos

kvpvbsext

kernel32

generic