2026-09-29_18d2bbbe577bbe7b993c8904d6ddc480_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_njrat

General

Target
2026-09-29_18d2bbbe577bbe7b993c8904d6ddc480_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_njrat
Size 2.2MB
Sample260930-flnvpstyf1
SHA256 4b35e177965910c940c84eecbbf535dafea3cbea34590141a3f53edfc97bf609
MD5 18d2bbbe577bbe7b993c8904d6ddc480
SHA1 31bf6908ced9e8916acff9be3d7b9e40c36cbf9d
SHA512 0e04aaae33c005a569b1a58f0a18e7b4d087432859da3407c65d5a61f4f21c99bfc5068fd987ea98f2b8380fa2c69db096f57e2ddadee1b1020dc39d16f02e0e
SSDEEP 49152:Mq1nCNDpWLQued6Ix6hNre93IYSBb1me5UFdEDmbG:H8NGIx6bre93IYYb1me5uku
TLSH
T157A5D0207693C136D07181B05978EFB5916DAD3C5F7286CBA3C43A2E5A305D26E3AF27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_18d2bbbe577bbe7b993c8904d6ddc480_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-09-29_18d2bbbe577bbe7b993c8904d6ddc480_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_njrat

.exe 2.2MB

2026-09-29_18d2bbbe577bbe7b993c8904d6ddc480_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 0499950a4dd49ea5b1323b16d409fdff
SHA256 4b35e177965910c940c84eecbbf535dafea3cbea34590141a3f53edfc97bf609
MD5 18d2bbbe577bbe7b993c8904d6ddc480
SHA1 31bf6908ced9e8916acff9be3d7b9e40c36cbf9d
SHA512 0e04aaae33c005a569b1a58f0a18e7b4d087432859da3407c65d5a61f4f21c99bfc5068fd987ea98f2b8380fa2c69db096f57e2ddadee1b1020dc39d16f02e0e
SSDEEP 49152:Mq1nCNDpWLQued6Ix6hNre93IYSBb1me5UFdEDmbG:H8NGIx6bre93IYYb1me5uku
TLSH
T157A5D0207693C136D07181B05978EFB5916DAD3C5F7286CBA3C43A2E5A305D26E3AF27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

714257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_1lgl3\rc_bugfix_master_\Build\Release\WPSOffice\wtoolex\updateself.pdb

kernel32

VerSetConditionMask CloseHandle GetLastError SetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetCurrentProcess GetCurrentThread GetSystemDirectoryW GetSystemWow64DirectoryW FreeLibrary GetProcAddress LoadLibraryW LocalFree VerifyVersionInfoW GetDateFormatW GetTimeFormatW GetEnvironmentVariableW SetEnvironmentVariableW GetFileAttributesW OpenProcess GlobalMemoryStatusEx GetNativeSystemInfo IsWow64Process GetModuleFileNameW GetPrivateProfileIntW GetPrivateProfileStringW GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetGeoInfoW GetUserGeoID GetUserDefaultLCID ExpandEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW FindClose FindNextFileW GetFileSizeEx ReadFile Sleep GetModuleHandleW MoveFileExW GlobalFree WriteFile WaitNamedPipeW GetOverlappedResult CancelIo WaitForSingleObject GetLongPathNameW GetCurrentProcessId TerminateProcess GetExitCodeProcess ProcessIdToSessionId GetVersionExW FindResourceExW LoadResource LockResource SizeofResource FindResourceW CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLocalTime SetFilePointer SetEvent ResetEvent CreateEventW CreateThread GetExitCodeThread ResumeThread GetTickCount MoveFileW WritePrivateProfileStringW GetFileSize SetUnhandledExceptionFilter GetCurrentThreadId GetProcessId SetFileAttributesW GetPrivateProfileSectionW GetCommandLineW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetFileAttributesExW OutputDebugStringW ReleaseMutex CreateMutexW lstrlenA DeviceIoControl lstrlenW GetUserDefaultUILanguage WTSGetActiveConsoleSessionId CreateProcessW CreateFileA GetSystemTime LoadLibraryExW LocalFileTimeToFileTime SetFileTime SystemTimeToFileTime QueryPerformanceCounter QueryPerformanceFrequency SetStdHandle GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection GetStringTypeW InitOnceBeginInitialize InitOnceComplete FormatMessageA FindFirstFileExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx GetSystemTimeAsFileTime EncodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo IsDebuggerPresent WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualAlloc SetConsoleCtrlHandler SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle ExitProcess CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetFileType GetConsoleMode ReadConsoleW FlushFileBuffers GetConsoleCP IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_18d2bbbe577bbe7b993c8904d6ddc480_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_njrat

kernel32

generic