2026-10-22_92bc8dcfb0e80bb9c37dda9c3bd799d7_amadey_avoslocker_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat

General

Target
2026-10-22_92bc8dcfb0e80bb9c37dda9c3bd799d7_amadey_avoslocker_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat
Size 660KB
Sample261024-e5lzsaec43
SHA256 6b1f961d35901764751030aacf56f5a9f7f950ce85aca6d9f88a94e98ba6b9b5
MD5 92bc8dcfb0e80bb9c37dda9c3bd799d7
SHA1 44e6cf309aef7cbeeb7dd0cd46004cba0301fd12
SHA512 b9cc21de7b5755f73df60ac3ae4d805adaca6ba0ada6fa1a675c32170e502564db1f94b671049d8671e9c3947ebd0253f60576a35b50c45207c40dd7e6360521
SSDEEP 12288:QElblj+6R2TZsz1jxrMnVWqqPIBONhxsUzMi4BjvrEH7Dd:QElbgLeX/xsUzvKrEH7Dd
TLSH
T16AE407E16240F69FE1C09A336FDC8A720D79F92DC9CA915727402EAE59350F26736633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_92bc8dcfb0e80bb9c37dda9c3bd799d7_amadey_avoslocker_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-10-22_92bc8dcfb0e80bb9c37dda9c3bd799d7_amadey_avoslocker_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat

.exe 660KB

2026-10-22_92bc8dcfb0e80bb9c37dda9c3bd799d7_amadey_avoslocker_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat

IMPHASH a0dc1c3c9febe5ea5ca04441cbb8da06
SHA256 6b1f961d35901764751030aacf56f5a9f7f950ce85aca6d9f88a94e98ba6b9b5
MD5 92bc8dcfb0e80bb9c37dda9c3bd799d7
SHA1 44e6cf309aef7cbeeb7dd0cd46004cba0301fd12
SHA512 b9cc21de7b5755f73df60ac3ae4d805adaca6ba0ada6fa1a675c32170e502564db1f94b671049d8671e9c3947ebd0253f60576a35b50c45207c40dd7e6360521
SSDEEP 12288:QElblj+6R2TZsz1jxrMnVWqqPIBONhxsUzMi4BjvrEH7Dd:QElbgLeX/xsUzvKrEH7Dd
TLSH
T16AE407E16240F69FE1C09A336FDC8A720D79F92DC9CA915727402EAE59350F26736633
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

126090

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\Ventoy\Ventoy2Disk\Release\Ventoy2Disk.pdb

kernel32

SetLastError GetCurrentProcess GetUserDefaultUILanguage GetSystemDirectoryW LCIDToLocaleName MultiByteToWideChar GetLastError LockResource LoadLibraryW LoadResource FindResourceW GetProcAddress GetModuleHandleW FreeLibrary WideCharToMultiByte GetSystemWindowsDirectoryW LoadLibraryExW GetEnvironmentVariableA LoadLibraryA GetDriveTypeW GetVolumeInformationA WaitForSingleObject GetCurrentDirectoryA DeleteFileA CloseHandle GetStartupInfoA GetCurrentProcessId CreateProcessA GetVolumeNameForVolumeMountPointA Sleep FormatMessageW DeviceIoControl ReadFile WriteFile SetFilePointerEx GetLogicalDrives DeleteVolumeMountPointA SetFilePointer QueryDosDeviceA FindFirstVolumeA GetTickCount64 SetVolumeMountPointA CreateFileA GetLogicalDriveStringsA FindNextVolumeA FindVolumeClose K32GetModuleFileNameExW K32GetProcessImageFileNameW GetModuleHandleA GetNativeSystemInfo ReadProcessMemory QueryFullProcessImageNameW GetFileType IsWow64Process VerifyVersionInfoA GetProductInfo GetFileAttributesA GetVersionExA GetLocalTime GetSystemWow64DirectoryA VerSetConditionMask GetDiskFreeSpaceA GetPrivateProfileIntA lstrlenW GetSystemDefaultUILanguage GetPrivateProfileIntW LoadLibraryExA CreateFileW GetPrivateProfileSectionNamesW OpenProcess CreateToolhelp32Snapshot GetPrivateProfileStringW Process32NextW SetDllDirectoryA Process32FirstW CreateThread GetWindowsDirectoryA GetCurrentDirectoryW SetCurrentDirectoryW GetFileSize lstrcpyW lstrcmpW SetEndOfFile WriteConsoleW HeapReAlloc HeapSize FlushFileBuffers GetProcessHeap GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW DecodePointer GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW LCMapStringW GetFileSizeEx GetConsoleMode GetConsoleOutputCP HeapFree HeapAlloc GetModuleHandleExW ExitProcess RaiseException GetSystemInfo VirtualProtect VirtualQuery UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA GetCommandLineW GetStdHandle GetModuleFileNameW

user32

GetMenuState ModifyMenuW LoadMenuW GetMenu CreateWindowExW DeleteMenu GetSubMenu ShowWindow SetWindowTextA SendDlgItemMessageW IsWindowEnabled SetMenu SetFocus LoadIconW wsprintfW CheckMenuItem AppendMenuW DialogBoxParamW EndDialog LoadImageW InvalidateRect GetSystemMetrics MessageBoxW CheckRadioButton SetWindowTextW GetWindowTextA SendMessageA GetDlgItem EnableWindow GetWindowLongW EnumChildWindows SendMessageW LoadStringW SetWinEventHook GetWindowTextW UpdateWindow

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_92bc8dcfb0e80bb9c37dda9c3bd799d7_amadey_avoslocker_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat

kernel32

user32

generic