General
- Target 2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_smoke-loader
- Size 2.8MB
- Sample261003-2s5mpaydnf
- SHA256 8e620a54c673911dc895515d8dcf9dde8f4feb8b93396caac245e2a089e6c211
- MD5 facad586ac8a8acbfd758e7482e0fc62
- SHA1 95f8f39299e330d14708359e6054d46d49ecbd4c
- SHA512 be991a20bb330128a047a64695c25445665afab04d0dfa8676aee0a8e9e6ef7249fc7f44847042f0645503bc069799c2e19974c132c3cc90573d33d86ca22967
- SSDEEP 49152:aLU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/o+QY8cdH0y8:aLU/jIEeQfoR/IuOFVjUu5cY8WUl
- TLSH T1CBD5AE12BAD58432F1B316319DB8C2695674B8A6873685EFB3CC561E4F309C1CA32F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Resource
win10v2004-20260911-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_smoke-loader
- Size 2.8MB
- SHA256 8e620a54c673911dc895515d8dcf9dde8f4feb8b93396caac245e2a089e6c211
- MD5 facad586ac8a8acbfd758e7482e0fc62
- SHA1 95f8f39299e330d14708359e6054d46d49ecbd4c
- SHA512 be991a20bb330128a047a64695c25445665afab04d0dfa8676aee0a8e9e6ef7249fc7f44847042f0645503bc069799c2e19974c132c3cc90573d33d86ca22967
- SSDEEP 49152:aLU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/o+QY8cdH0y8:aLU/jIEeQfoR/IuOFVjUu5cY8WUl
- TLSH T1CBD5AE12BAD58432F1B316319DB8C2695674B8A6873685EFB3CC561E4F309C1CA32F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1