2026-10-23_4da86cf46a330368f403027e467fc08d_amadey_avoslocker_elex_luca-stealer_lynx_njrat_remcos

General

Target
2026-10-23_4da86cf46a330368f403027e467fc08d_amadey_avoslocker_elex_luca-stealer_lynx_njrat_remcos
Size 1.6MB
Sample261023-prct3abx3x
SHA256 87d1b161e8eb23a88b3328360c1e31ea41bba5dc9c42d14768b5cf9c346e1994
MD5 4da86cf46a330368f403027e467fc08d
SHA1 61d89549a70c0c5ae6899781926309b11b3f52b0
SHA512 1ea1af9af8f3330c34f5f312d717863796803ddc99dfe4ffebcabcc6c4adab88167c2e5e583fe77d0ae94265e6520ffb38cbcc67202a83b080e0051d19176bb8
SSDEEP 49152:ZdEbqbc7AQOMQl6NpccKwNCuJTMoSq8ohDmg27RnWGj:ZWbqbc7kypkwUU4ZqNhD527BWG
TLSH
T1D775123072D8C473CCA314745AE8DBBB692B7D704F6004E777982B6DAE701D1DA39A26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_4da86cf46a330368f403027e467fc08d_amadey_avoslocker_elex_luca-stealer_lynx_njrat_remcos

File Explorer

2026-10-23_4da86cf46a330368f403027e467fc08d_amadey_avoslocker_elex_luca-stealer_lynx_njrat_remcos

.exe 1.6MB

2026-10-23_4da86cf46a330368f403027e467fc08d_amadey_avoslocker_elex_luca-stealer_lynx_njrat_remcos

IMPHASH 4e1a5d600cae73049ecc38720cc848c4
SHA256 87d1b161e8eb23a88b3328360c1e31ea41bba5dc9c42d14768b5cf9c346e1994
MD5 4da86cf46a330368f403027e467fc08d
SHA1 61d89549a70c0c5ae6899781926309b11b3f52b0
SHA512 1ea1af9af8f3330c34f5f312d717863796803ddc99dfe4ffebcabcc6c4adab88167c2e5e583fe77d0ae94265e6520ffb38cbcc67202a83b080e0051d19176bb8
SSDEEP 49152:ZdEbqbc7AQOMQl6NpccKwNCuJTMoSq8ohDmg27RnWGj:ZWbqbc7kypkwUU4ZqNhD527BWG
TLSH
T1D775123072D8C473CCA314745AE8DBBB692B7D704F6004E777982B6DAE701D1DA39A26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

77245

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_1p3u4\master_kso_v12\Build\Release\WPSOffice\office6\kvprinter\kvpins.pdb

kvpvbsext

?RunScript@ScriptInterpreter@@YGJPB_WPBD0PAPAUtagSAFEARRAY@@PAUtagVARIANT@@@Z

kernel32

GetWindowsDirectoryW SetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW GetTempFileNameW RemoveDirectoryW SetFileAttributesW GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle GetLastError SetLastError FatalAppExitW HeapAlloc HeapFree GetProcessHeap SetEvent WaitForSingleObject CreateEventW SetWaitableTimer Sleep CreateWaitableTimerW GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess TerminateThread GetExitCodeThread ResumeThread CreateProcessW OpenProcess GetTickCount GetSystemDirectoryW GetNativeSystemInfo VirtualQuery GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree FormatMessageW GetPrivateProfileIntW GetPrivateProfileStringW CopyFileW MoveFileExW WideCharToMultiByte GetLocaleInfoW GetThreadLocale GetSystemDefaultLCID CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer OutputDebugStringA RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection FreeLibrary LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW MultiByteToWideChar CreateFileMappingW MapViewOfFile UnmapViewOfFile IsValidCodePage CreateFileW LoadLibraryW GetCurrentThreadId WriteConsoleW IsWow64Process DecodePointer HeapReAlloc HeapSize GetSystemInfo lstrlenA SwitchToThread CreateThread VirtualProtect LoadLibraryExA QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile ExitProcess GetFileType LCMapStringW FindClose FindFirstFileExW FindNextFileW GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode

Name

.text

Size

149KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kvpver

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_4da86cf46a330368f403027e467fc08d_amadey_avoslocker_elex_luca-stealer_lynx_njrat_remcos

kvpvbsext

kernel32

generic