2026-09-28_ba66158ab6e677c1f0a9274cc1ab9832_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_ba66158ab6e677c1f0a9274cc1ab9832_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot
Size 3.5MB
Sample260928-pn834atepc
SHA256 83d722f5d03bc053927d6e2aeb13fc59df4cb2cda3315d6ae2579e9ed70bfce4
MD5 ba66158ab6e677c1f0a9274cc1ab9832
SHA1 9ed742a74275490828953d63a57e2ffde5cbcbf2
SHA512 8f47ef11699b5b920bb9a7557516fec1a48cbea294ab92ce212a438dc1c60269be3407fab0d6fbaee3dc4426421490b065aac6203b7186fd66dd5f40a3051aea
SSDEEP 98304:iaKgJIry1mP6cVzORPGQxQLZ/IJWxQnhK3VWRhfp:iaKgkjKRupSWxQnheMRhB
TLSH
T18AF5BF293D944077C03382315D59F635E6ADE6F20F3EE1C722949EAD1D252C28E3A67B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-28_ba66158ab6e677c1f0a9274cc1ab9832_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot

File Explorer

2026-09-28_ba66158ab6e677c1f0a9274cc1ab9832_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot

.exe 3.5MB

2026-09-28_ba66158ab6e677c1f0a9274cc1ab9832_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot

IMPHASH 8c52b8bb0ec6315810d9a44437c42faf
SHA256 83d722f5d03bc053927d6e2aeb13fc59df4cb2cda3315d6ae2579e9ed70bfce4
MD5 ba66158ab6e677c1f0a9274cc1ab9832
SHA1 9ed742a74275490828953d63a57e2ffde5cbcbf2
SHA512 8f47ef11699b5b920bb9a7557516fec1a48cbea294ab92ce212a438dc1c60269be3407fab0d6fbaee3dc4426421490b065aac6203b7186fd66dd5f40a3051aea
SSDEEP 98304:iaKgJIry1mP6cVzORPGQxQLZ/IJWxQnhK3VWRhfp:iaKgkjKRupSWxQnheMRhB
TLSH
T18AF5BF293D944077C03382315D59F635E6ADE6F20F3EE1C722949EAD1D252C28E3A67B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c2:61:62:ed:e8:6b:96:74:67:59:e7:d4:4d:e7:03:da:10:fa:0a:30:6d:ff:81:ba:9a:af:65:33:b3:2d:45:4d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=101151819,CN=COREL CORPORATION,O=Alludo (COREL CORPORATION),L=Ottawa,ST=Ontario,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,1.3.6.1.4.1.311.60.2.1.2=#13104272697469736820436f6c756d626961,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 18, 2025

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

PE Signature issue

Digest

0f:1b:76:30:ed:fd:4b:73:cc:6f:50:35:27:c8:d9:02:02:78:09:df

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Feb 18, 2025

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

4d:f3:f6:8e:c1:34:f6:47:75:b8:0f:d2:20:3b:46:88

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 19, 2024 - Jan 18, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1577476

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\bld\STUB-CDGV2025STUB-JOB1\build\Sample\StubCore\Release\CorelDRAWGraphicsSuite2025Installer.pdb

kernel32

GlobalHandle GlobalFree LocalAlloc LocalReAlloc LocalFree GetCurrentProcessId LoadResource LockResource SizeofResource FindResourceW WideCharToMultiByte GlobalSize MulDiv FormatMessageW CopyFileW MultiByteToWideChar SetEvent WaitForSingleObject CreateEventW GetCurrentThreadId SetThreadPriority ResumeThread CompareStringW lstrcmpA GlobalGetAtomNameW FileTimeToSystemTime GetThreadLocale EncodePointer GetSystemDirectoryW FreeLibrary LoadLibraryExW LoadLibraryA GlobalDeleteAtom lstrcmpW GlobalAddAtomW GlobalFindAtomW CreateFileW DeleteFileW FindClose FindFirstFileW FlushFileBuffers GetFileSize GetFullPathNameW GetVolumeInformationW LockFile ReadFile SetEndOfFile SetFilePointer UnlockFile WriteFile DuplicateHandle GetCurrentProcess lstrcmpiW GlobalFlags GetVersionExW GetLocaleInfoW GetUserDefaultUILanguage VirtualProtect FileTimeToLocalFileTime GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime SetErrorMode lstrcpyW GetCurrentDirectoryW FindResourceExW GetWindowsDirectoryW VerSetConditionMask VerifyVersionInfoW GlobalLock GetTickCount GetProfileIntW SearchPathW GetTempFileNameW GetUserDefaultLCID UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateDirectoryW GetCommandLineW RemoveDirectoryW MoveFileExW ExitProcess CreateProcessW FindNextFileW CreateMutexW GetExitCodeProcess SetFilePointerEx GetLongPathNameW OpenProcess GetDiskFreeSpaceExW GetNativeSystemInfo GetUserGeoID ReadProcessMemory QueryFullProcessImageNameW GetSystemTime QueueUserWorkItem DeviceIoControl GetSystemInfo InitializeCriticalSectionEx ExpandEnvironmentStringsW ResetEvent WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GlobalUnlock GlobalReAlloc GlobalAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection LoadLibraryW GetModuleHandleW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc RaiseException DecodePointer OutputDebugStringA SetLastError GlobalMemoryStatusEx GetProcAddress GetLastError GetModuleHandleA lstrlenW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW GetTimeFormatW GetDateFormatW PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetStdHandle GetFileType SetStdHandle QueryPerformanceFrequency VirtualAlloc GetCommandLineA HeapQueryInformation GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind OutputDebugStringW GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx GetStringTypeW LoadLibraryExA CreateThread CloseHandle GetTempPathW Sleep VirtualQuery WaitForSingleObjectEx

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegDeleteValueW RegOpenKeyExW RegCloseKey CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges RegQueryInfoKeyW OpenProcessToken RegQueryValueExW RegEnumValueW RegSetValueExW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW

gdiplus

GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipBitmapLockBits GdipGetImageWidth GdipDrawImageI GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipDeleteGraphics GdipCreateFromHDC GdipSetInterpolationMode GdipCreateBitmapFromHBITMAP GdipDrawImageRectI GdipGetImageHeight GdipGetImageGraphicsContext

msimg32

TransparentBlt AlphaBlend

oleacc

CreateStdAccessibleObject LresultFromObject AccessibleObjectFromWindow

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

oledlg

OleUIBusyW

rpcrt4

UuidToStringW RpcStringFreeW

uxtheme

GetCurrentThemeName CloseThemeData IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemeColor GetThemePartSize OpenThemeData DrawThemeParentBackground DrawThemeText GetThemeSysColor DrawThemeBackground GetWindowTheme

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_ba66158ab6e677c1f0a9274cc1ab9832_amadey_avoslocker_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_qakbot

PE Signature issue

PE Signature issue

kernel32

winspool.drv

advapi32

gdiplus

msimg32

oleacc

imm32

winmm

oledlg

rpcrt4

uxtheme

generic