2026-10-10_14804c8c783eab53df017f7469c814ce_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_14804c8c783eab53df017f7469c814ce_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat
Size 2.3MB
Sample261011-zhyqaacy7y
SHA256 404832b0386a1c4187889241ae62d290f22ce753915011e083badc7cbe26db89
MD5 14804c8c783eab53df017f7469c814ce
SHA1 d2337c1118fb0b613380e5870714c0fbc4f64829
SHA512 f9a93689880d6933a8d65e9a4f931695bea9b4a57361c325e9a4c81bf11103e64d28bcee893aafdb4f424f2a9a02a91bbe61b2f3f6d41e3d1df06b3534fe4d44
SSDEEP 24576:7HDM4jDxGk5fjvmQAODTu4SSyVDaKngL2jdshRTdG1YxITqvfPkbIcbjLm:LA4jDffjeQpTuCyVDarSj8RoTCCW
TLSH
T1C4B571F274FDF110EC1490398421BA38A2B49DEC9FA48BD97BECB4711834D691F2A975
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_14804c8c783eab53df017f7469c814ce_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

File Explorer

2026-10-10_14804c8c783eab53df017f7469c814ce_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

.exe 2.3MB

2026-10-10_14804c8c783eab53df017f7469c814ce_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

IMPHASH 915b9fc95883c5b2b56511c5ad212fff
SHA256 404832b0386a1c4187889241ae62d290f22ce753915011e083badc7cbe26db89
MD5 14804c8c783eab53df017f7469c814ce
SHA1 d2337c1118fb0b613380e5870714c0fbc4f64829
SHA512 f9a93689880d6933a8d65e9a4f931695bea9b4a57361c325e9a4c81bf11103e64d28bcee893aafdb4f424f2a9a02a91bbe61b2f3f6d41e3d1df06b3534fe4d44
SSDEEP 24576:7HDM4jDxGk5fjvmQAODTu4SSyVDaKngL2jdshRTdG1YxITqvfPkbIcbjLm:LA4jDffjeQpTuCyVDarSj8RoTCCW
TLSH
T1C4B571F274FDF110EC1490398421BA38A2B49DEC9FA48BD97BECB4711834D691F2A975
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

288978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\work\kdocs_pc\builder\win\KDocsExt.pdb

kernel32

TerminateThread GetSystemTime GetLocalTime GetTickCount SystemTimeToFileTime TerminateProcess CreateProcessW K32GetModuleInformation GetCurrentProcessId ProcessIdToSessionId OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose FindFirstFileW FindNextFileW GetCurrentThreadId Sleep LoadLibraryW WriteConsoleW CreateFileW GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx SetStdHandle GetSystemWow64DirectoryW GetSystemDirectoryW LocalFree VirtualQuery VirtualFree VirtualAlloc GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc VerifyVersionInfoW SetLastError VerSetConditionMask GlobalFree GlobalLock GlobalUnlock GlobalAlloc LockResource SetThreadLocale GetThreadLocale MultiByteToWideChar lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress FileTimeToSystemTime GetModuleFileNameW FreeLibrary LeaveCriticalSection EnterCriticalSection EncodePointer DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException LocalAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP DecodePointer IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType WriteFile GetStdHandle GetModuleHandleExW ExitProcess InterlockedPushEntrySList RtlUnwind LoadLibraryExA GetThreadContext SetThreadContext FlushInstructionCache ResumeThread VirtualProtect InterlockedCompareExchange QueryPerformanceFrequency QueryPerformanceCounter GetStartupInfoW InitializeSListHead WaitForSingleObjectEx ResetEvent SetEvent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread CreateEventW InitializeCriticalSectionAndSpinCount OutputDebugStringW IsDebuggerPresent CreateThread IsWow64Process GetWindowsDirectoryW GetCurrentProcess CloseHandle GetModuleHandleW WideCharToMultiByte

user32

DispatchMessageW GetMessageW MsgWaitForMultipleObjects CharLowerBuffW TranslateMessage InsertMenuItemW SetMenuItemBitmaps CharNextW SetTimer KillTimer

advapi32

CryptGenRandom CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RevertToSelf IsValidSid ImpersonateLoggedOnUser GetTokenInformation EqualSid OpenProcessToken ConvertSidToStringSidW RegOpenCurrentUser GetUserNameW LookupAccountNameW ConvertStringSidToSidW SetSecurityInfo GetSecurityInfo RegOpenKeyW RegCreateKeyW InitializeAcl GetLengthSid GetAclInformation GetAce DeleteAce AddAce RegQueryInfoKeyW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey CryptAcquireContextA

shell32

SHGetSpecialFolderPathW SHChangeNotify SHGetSpecialFolderLocation ShellExecuteW DragQueryFileW

ole32

IIDFromString CoInitialize CoUninitialize ReleaseStgMedium CreateStreamOnHGlobal CoTaskMemFree CoTaskMemRealloc CoInitializeEx CoCreateInstance StringFromGUID2 CoTaskMemAlloc

oleaut32

LoadRegTypeLi RegisterTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysFreeString SysAllocString UnRegisterTypeLi

shlwapi

AssocCreate PathAppendW StrCmpNIW PathFindNextComponentW PathRemoveFileSpecW StrCmpIW

gdiplus

GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCreateHBITMAPFromBitmap

wininet

InternetOpenW InternetCloseHandle HttpSendRequestW InternetConnectW InternetReadFile InternetSetOptionW HttpOpenRequestW HttpQueryInfoW

crypt32

CryptBinaryToStringA CryptStringToBinaryA CryptBinaryToStringW

Name

.text

Size

560KB

Virtual Size

560KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

884KB

Virtual Size

884KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

787KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=19, id=259, version=26715,

count=163, id=261, version=26715,

count=3, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=9, id=265, version=28322,

count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=35, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,

count=19, id=260, version=28117,

count=24, id=259, version=28117,

count=94, id=261, version=28117,

count=27, id=260, version=26715,

count=1, id=262, version=26715,

count=23, id=257, version=26715,

count=265, id=1, productName=Unmarked objects,

count=1, id=260, version=28322,

count=23, id=261, version=28322,

count=1, id=256, version=28322,

count=1, id=255, version=28322,

count=1, id=151,

count=1, id=258, version=28322,