2026-10-27_edf738f6b93a73df7052e3c56b96a2c3_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_edf738f6b93a73df7052e3c56b96a2c3_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 14.8MB
Sample261027-2q4ydaxtb1
SHA256 8ef7d33f5457dcdca4a35273a460989ac99939d58903b6950832b745d241d758
MD5 edf738f6b93a73df7052e3c56b96a2c3
SHA1 50af9247818464154fee3aac53e602e21a04b2cf
SHA512 c4a2ff38544902d38d8b64fe9c0a3dda3d936add0a45b1db272b285dc0b5f4fdeda3f7beb7e67c320f2e3047851eee9f173a68581d434a47073242c2d8740cde
SSDEEP 196608:4XPU+ltkNzEc1Q2vU0LfutXvlQKkTtyotVKb1RTMkwLODu/yetyYcJJZhYvFza2R:4iy0FOugpmcv/GDHL6JDo
TLSH
T150F6BF43B7E680B3EAD7D1B545BAAB7D4535BA3C032589CFB3842A494D322D1693930F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-27_edf738f6b93a73df7052e3c56b96a2c3_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-10-27_edf738f6b93a73df7052e3c56b96a2c3_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 14.8MB

2026-10-27_edf738f6b93a73df7052e3c56b96a2c3_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH d3ea94810a363a25ffae345108dbec61
SHA256 8ef7d33f5457dcdca4a35273a460989ac99939d58903b6950832b745d241d758
MD5 edf738f6b93a73df7052e3c56b96a2c3
SHA1 50af9247818464154fee3aac53e602e21a04b2cf
SHA512 c4a2ff38544902d38d8b64fe9c0a3dda3d936add0a45b1db272b285dc0b5f4fdeda3f7beb7e67c320f2e3047851eee9f173a68581d434a47073242c2d8740cde
SSDEEP 196608:4XPU+ltkNzEc1Q2vU0LfutXvlQKkTtyotVKb1RTMkwLODu/yetyYcJJZhYvFza2R:4iy0FOugpmcv/GDHL6JDo
TLSH
T150F6BF43B7E680B3EAD7D1B545BAAB7D4535BA3C032589CFB3842A494D322D1693930F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

268603

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoCreateInstance CoUninitialize CoInitialize IIDFromString StringFromGUID2 CoCreateGuid CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc

shell32

SHGetFolderPathW SHGetFolderPathA CommandLineToArgvW

user32

LoadStringA MessageBoxA SendMessageTimeoutW CharNextA MessageBoxW GetMessageW GetMessageA DispatchMessageA DispatchMessageW MsgWaitForMultipleObjectsEx TranslateMessage PeekMessageA IsWindowUnicode wsprintfA

kernel32

GetFileInformationByHandle GetDriveTypeW DeleteFileW CreateDirectoryW WriteConsoleW GetModuleFileNameW GetStdHandle GetConsoleMode GetConsoleCP GetFileType VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetModuleFileNameA SizeofResource GetCommandLineW LoadLibraryExA InitializeCriticalSectionAndSpinCount FindResourceA GetModuleHandleA MultiByteToWideChar GetLastError SetDllDirectoryA RaiseException IsDBCSLeadByte LoadResource DecodePointer GetProcAddress DeleteCriticalSection FreeLibrary WideCharToMultiByte lstrcmpiA SetCurrentDirectoryA DeleteFileA GetTickCount LocalFree GetEnvironmentVariableA GetModuleHandleExA GetCurrentThreadId Sleep FormatMessageW GetLocalTime GetCurrentProcessId FindFirstFileA WriteFile FileTimeToSystemTime FindClose WaitForSingleObject LocalAlloc CreateFileA GetSystemDirectoryA LockResource CloseHandle GetWindowsDirectoryA ExitProcess FormatMessageA ReadFile SetHandleInformation CreatePipe PeekNamedPipe RemoveDirectoryA CreateProcessA CreateDirectoryA GetExitCodeProcess SetLastError DeviceIoControl FindNextFileA CopyFileA GetFileAttributesA MoveFileExA SetFileAttributesA GetCurrentProcess GetModuleHandleExW GetTempPathA GetNativeSystemInfo GetSystemWow64DirectoryA SetEndOfFile SetFilePointerEx OpenMutexA LoadLibraryExW LoadLibraryW UnmapViewOfFile FlushViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFile CreateFileW TlsAlloc LeaveCriticalSection InitializeCriticalSection TlsGetValue GetFullPathNameW SetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize HeapReAlloc HeapFree HeapAlloc ReadConsoleW GetFileSizeEx FlushFileBuffers GetCurrentDirectoryW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SwitchToThread GetStringTypeW TlsSetValue TlsFree GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime OutputDebugStringW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetModuleHandleW TerminateProcess EnterCriticalSection IsDebuggerPresent

advapi32

GetSecurityDescriptorDacl RegDeleteValueA RegOpenKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA CopySid OpenProcessToken GetTokenInformation RegQueryValueExA RegEnumValueA RegEnumKeyExA GetSecurityDescriptorOwner SetFileSecurityA CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegCloseKey RegQueryInfoKeyW RegDeleteKeyA RegCreateKeyExA RegSetValueExA

oleaut32

SysFreeString VarUI4FromStr GetErrorInfo

shlwapi

SHDeleteKeyA PathIsURLA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueW

msi

ord117 ord115 ord159 ord141 ord44 ord204 ord91 ord67 ord8 ord158 ord137 ord160 ord168 ord31 ord189

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_edf738f6b93a73df7052e3c56b96a2c3_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

ole32

shell32

user32

kernel32

advapi32

oleaut32

shlwapi

version

msi

generic