2026-09-26_35b89802bb4848c8c47d68eca09169fa_amadey_avoslocker_elex_floxif_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_35b89802bb4848c8c47d68eca09169fa_amadey_avoslocker_elex_floxif_glassworm_luca-stealer_lynx_njrat
Size 8.4MB
Sample260927-wpd3nstx2j
SHA256 6172c68f508aff495bf9ef973746b5718847e18ba793faf1bba69e27c79bc83d
MD5 35b89802bb4848c8c47d68eca09169fa
SHA1 5066212b33dfbbf4c8f8817c326f4370e4588141
SHA512 3cd65ed7de79f663ebf32de707a527f9a277ee21b5a3fd2aca3cb58810ebf7cec9038481afac85c0355e52d5e5dddf5e3b022c679181056f2441c873c8ecbf48
SSDEEP 98304:Tgzjwfi0lZYemmNbPihwcQJHqSg4sCDKWTv2IlG0Akb18U95YF4h3jd0dcbEAEik:8fwfnuw1XX2Iltb6Uke3GdcbE8k
TLSH
T18496F1415222D3A0C891E67A92D8BF3718A83A3D5BCD7CC396F01C596C70BD25E3AD5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-26_35b89802bb4848c8c47d68eca09169fa_amadey_avoslocker_elex_floxif_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-09-26_35b89802bb4848c8c47d68eca09169fa_amadey_avoslocker_elex_floxif_glassworm_luca-stealer_lynx_njrat

.exe 8.4MB

2026-09-26_35b89802bb4848c8c47d68eca09169fa_amadey_avoslocker_elex_floxif_glassworm_luca-stealer_lynx_njrat

IMPHASH cc6324d57ada66a3eff72b31904d76d0
SHA256 6172c68f508aff495bf9ef973746b5718847e18ba793faf1bba69e27c79bc83d
MD5 35b89802bb4848c8c47d68eca09169fa
SHA1 5066212b33dfbbf4c8f8817c326f4370e4588141
SHA512 3cd65ed7de79f663ebf32de707a527f9a277ee21b5a3fd2aca3cb58810ebf7cec9038481afac85c0355e52d5e5dddf5e3b022c679181056f2441c873c8ecbf48
SSDEEP 98304:Tgzjwfi0lZYemmNbPihwcQJHqSg4sCDKWTv2IlG0Akb18U95YF4h3jd0dcbEAEik:8fwfnuw1XX2Iltb6Uke3GdcbE8k
TLSH
T18496F1415222D3A0C891E67A92D8BF3718A83A3D5BCD7CC396F01C596C70BD25E3AD5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0c:dd:c1:da:8d:5f:c3:59:a6:dd:96:10:36:2e:72:07:54:72:62:b3:69:5d:ec:0a:5b:b5:df:ef:19:79:7d:70

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,POSTALCODE=94110,STREET=\#202+STREET=3388 17th st,L=San Francisco,ST=California,C=US

Chains

Mar 14, 2020

CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,POSTALCODE=94110,STREET=\#202+STREET=3388 17th st,L=San Francisco,ST=California,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

53:e5:5a:95:4b:1d:bf:d3:b4:31:63:d9:3a:c2:c8:fb:04:96:d1:77

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,POSTALCODE=94110,STREET=\#202+STREET=3388 17th st,L=San Francisco,ST=California,C=US

Chains

Mar 14, 2020

CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,POSTALCODE=94110,STREET=\#202+STREET=3388 17th st,L=San Francisco,ST=California,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,POSTALCODE=94110,STREET=\#202+STREET=3388 17th st,L=San Francisco,ST=California,C=US

Serial Number

da:99:cf:f4:ef:e6:b3:ed:a6:3d:df:f3:b6:99:93:e4

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 1, 2015 - Apr 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1571437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\kjk\src\sumatrapdf\out\rel32\SumatraPDF-dll.pdb

comctl32

ImageList_EndDrag InitCommonControlsEx ImageList_BeginDrag ImageList_DragMove ImageList_DragEnter ImageList_DragShowNolock ImageList_Create ImageList_AddMasked ord412 ord410 ord413 ImageList_Destroy CreatePropertySheetPageW ImageList_GetIconSize ImageList_Draw

d2d1

ord1

kernel32

FoldStringW TzSpecificLocalTimeToSystemTime IsDBCSLeadByte AreFileApisANSI GetConsoleScreenBufferInfo ReadDirectoryChangesW LocalFileTimeToFileTime QueueUserAPC ResetEvent WaitForMultipleObjectsEx CompareFileTime CancelIo GetFileTime GetDriveTypeW GetTempFileNameW GetSystemInfo HeapReAlloc SetEvent CreateEventW CreateToolhelp32Snapshot GetLocaleInfoA GetVersionExW GetCurrentThreadId WaitForSingleObject GetEnvironmentVariableA TerminateProcess GetCurrentProcess HeapFree HeapCreate DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection SetThreadPriority DeviceIoControl RemoveDirectoryW CreateHardLinkW MoveFileW ReleaseSemaphore GetProcessAffinityMask CreateSemaphoreW CreateThread HeapAlloc Module32FirstW LoadLibraryExA GetModuleHandleW DecodePointer WriteConsoleW SetConsoleScreenBufferSize GetTimeZoneInformation GetSystemDirectoryW GetProcessHeap GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetModuleHandleExW SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType EncodePointer LoadLibraryExW RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError GetStartupInfoW IsDebuggerPresent InitializeSListHead WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent UnhandledExceptionFilter SetFilePointer GetExitCodeProcess GetACP FileTimeToDosDateTime FileTimeToLocalFileTime RaiseException OutputDebugStringW WideCharToMultiByte OpenThread VirtualQuery GetThreadContext GetCurrentThread GetModuleHandleA ResumeThread SuspendThread Thread32First Thread32Next GetModuleFileNameA DeleteFileW GetTempPathW GetUserDefaultUILanguage MapViewOfFile CreateFileMappingW LoadLibraryW UnmapViewOfFile SetErrorMode GetFullPathNameW GetDateFormatW GetTimeFormatW MoveFileExW LocalFree FormatMessageW SetFileAttributesW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource SetThreadExecutionState GlobalAddAtomW GlobalDeleteAtom GetTickCount GlobalUnlock GlobalLock GlobalFree GlobalAlloc GetSystemTime CopyFileW ExitProcess GetCommandLineW Process32FirstW Process32NextW OpenProcess GetLastError FindClose FindNextFileW FindFirstFileW SetEndOfFile GetWindowsDirectoryW GetFileAttributesExW AllocConsole FormatMessageA VerifyVersionInfoW FreeLibrary CreateProcessW SetUnhandledExceptionFilter Module32NextW GlobalMemoryStatusEx GetCurrentProcessId HeapSize MulDiv QueryPerformanceCounter QueryPerformanceFrequency GetLogicalDrives GetFileInformationByHandle CreateFileW GetVolumePathNameW GetModuleFileNameW SetFileTime GetPrivateProfileIntW GetShortPathNameW WriteFile GetLongPathNameW WritePrivateProfileStringW VerSetConditionMask GetProcAddress SetCurrentDirectoryW GetCurrentDirectoryW GetEnvironmentVariableW OutputDebugStringA GetFileSizeEx ReadFile CreateDirectoryW MultiByteToWideChar GetSystemTimeAsFileTime SystemTimeToFileTime CloseHandle Sleep HeapDestroy VirtualProtect GetLocaleInfoW GetStdHandle

user32

SystemParametersInfoW GetSystemMetrics GetSysColor DdeConnect PostMessageW EndPaint BeginPaint IsIconic ReleaseCapture KillTimer GetCursorPos CopyImage HideCaret SetClassLongW ShowCaret LoadImageW CharLowerW IsCharAlphaNumericW ValidateRect GetUpdateRect GetWindowThreadProcessId GetMessageW AllowSetForegroundWindow FindWindowExW LoadAcceleratorsW LoadBitmapW TranslateAcceleratorW SetParent ShowScrollBar MapVirtualKeyW ScreenToClient IsWindow CharLowerBuffW GetAncestor IsCharUpperW GetWindow CheckRadioButton EndDialog SetDlgItemTextW SendDlgItemMessageW DialogBoxIndirectParamW IsDlgButtonChecked CheckDlgButton DialogBoxParamW SetActiveWindow MoveWindow GetFocus OpenClipboard CloseClipboard EmptyClipboard GetWindowTextLengthW ReuseDDElParam ShowWindowAsync IsWindowUnicode UnpackDDElParam GetDC LoadCursorW DrawTextW ModifyMenuW CheckMenuRadioItem GetMenuItemID GetMenu SetMenuItemInfoW SetMenu DrawTextExW InsertMenuW AppendMenuA MsgWaitForMultipleObjects DispatchMessageW IsDialogMessageW PeekMessageW MessageBoxA BringWindowToTop TranslateMessage LoadIconW GetDlgItem PostQuitMessage EnableWindow MessageBeep GetDesktopWindow SetForegroundWindow DdeFreeStringHandle DdeDisconnect CheckMenuItem SetClipboardData EndDeferWindowPos DdeFreeDataHandle DdeClientTransaction DdeUninitialize DdeInitializeW TrackMouseEvent ClientToScreen GetMonitorInfoW GetWindowInfo GetClientRect DdeCreateStringHandleW BeginDeferWindowPos EnumDisplayMonitors MonitorFromWindow MonitorFromRect GetKeyState AdjustWindowRectEx DeferWindowPos SetLayeredWindowAttributes GetMessagePos IsWindowEnabled WindowFromDC SetPropW RemovePropW GetPropW PtInRect UpdateWindow InvalidateRect MessageBoxW CreateMenu wsprintfA DestroyWindow GetWindowLongW GetMenuItemInfoW GetSystemMenu CallWindowProcW GetWindowRect IsWindowVisible SetWindowPos GetMenuItemCount SetCursor CreateWindowExW CreatePopupMenu RegisterClassExW TrackPopupMenu ShowWindow InvalidateRgn OffsetRect RedrawWindow MapWindowPoints SetMenuDefaultItem GetForegroundWindow DestroyMenu FindWindowW GetWindowDC SetWindowLongW TrackPopupMenuEx RemoveMenu IsZoomed AppendMenuW GetClassLongW DrawIconEx EnableMenuItem DrawEdge CharToOemBuffW CharUpperW OemToCharBuffA CharToOemA OemToCharA GetParent DrawFrameControl ReleaseDC SetScrollInfo DefWindowProcW FillRect GetCursor GetScrollInfo GetScrollPos GetCapture SetTimer SetFocus SetCapture SendMessageW

gdi32

CreateDIBSection ExtTextOutW GetObjectA IntersectClipRect SetWorldTransform SetLayout CreateRoundRectRgn TextOutW GetTextExtentPoint32W SelectClipRgn RoundRect BitBlt StartPage AbortDoc EndDoc CreateDCW SetMapMode StartDocW EndPage GetDeviceCaps LineTo MoveToEx SetBkColor SetBkMode CreateFontIndirectW GetClipBox CreateRectRgn SetViewportOrgEx ExcludeClipRect ExtSelectClipRgn SelectObject CreateCompatibleDC StretchBlt GetStockObject DeleteDC SetTextColor CreatePen Rectangle DeleteObject CreateSolidBrush SetBrushOrgEx SetStretchBltMode SetDIBits GetObjectW GetDIBits SetGraphicsMode SetDIBColorTable GetDIBColorTable CreateCompatibleBitmap SetROP2 CreateBitmap CreatePatternBrush PatBlt GetTextMetricsW

winspool.drv

DeviceCapabilitiesW EnumPrintersW ClosePrinter DocumentPropertiesW GetPrinterW OpenPrinterW ord203

comdlg32

GetSaveFileNameW PrintDlgExW CommDlgExtendedError GetOpenFileNameW

advapi32

RegQueryValueExW AdjustTokenPrivileges OpenProcessToken RegEnumKeyW CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash SetFileSecurityW CryptGetHashParam CryptReleaseContext SetSecurityDescriptorDacl AllocateAndInitializeSid RegCreateKeyExW RegCloseKey RegQueryInfoKeyW RegOpenKeyExW RegSetKeySecurity LookupPrivilegeValueW InitializeSecurityDescriptor CheckTokenMembership FreeSid

shell32

SHGetMalloc DragFinish SHGetPathFromIDListW SHFileOperationW SHGetFileInfoW SHBindToParent ShellExecuteExW SHGetDesktopFolder SHChangeNotify DragAcceptFiles SHAddToRecentDocs SHGetFolderPathW SHBrowseForFolderW DragQueryPoint DragQueryFileW

ole32

CoTaskMemFree CoUninitialize CoInitialize ReleaseStgMedium CoCreateInstance OleUninitialize OleInitialize CoTaskMemAlloc CreateStreamOnHGlobal CoGetMalloc

oleaut32

SafeArrayCreateVector SafeArrayPutElement SysFreeString VariantClear VariantInit SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_35b89802bb4848c8c47d68eca09169fa_amadey_avoslocker_elex_floxif_glassworm_luca-stealer_lynx_njrat

PE Signature issue

PE Signature issue

comctl32

d2d1

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

generic