2026-10-28_a018bb07c153ae9187dd920434d1d049_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_a018bb07c153ae9187dd920434d1d049_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 14.8MB
Sample261029-185rysfs9x
SHA256 db9f2a50d726653c41eb23ae070d4f87c9f02de66de98ea4036204f4191f0fe8
MD5 a018bb07c153ae9187dd920434d1d049
SHA1 7f2277ee5a700de16fe4c6c49822808a609be8df
SHA512 19213b698575acc34e895fa899976d358ac68e4a41eb780f0de142e33f9208e13d4ff7cdf9c559de7175d38ae604bf0153c3f7222f8fe384dbb291fe538caebe
SSDEEP 196608:4XPU+ltkNzEc1Q2vU0LfutXvlQKkTtyotVKb1RTMkwLODu/yetyYcJJZhYvFza2j:4iy0FOugpmcv/GDHL6JD+
TLSH
T108F6BF43B7E680B3EAD7D1B545BAAB7D4535BA3C032589CFB3842A494D322D1693930F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_a018bb07c153ae9187dd920434d1d049_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-10-28_a018bb07c153ae9187dd920434d1d049_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 14.8MB

2026-10-28_a018bb07c153ae9187dd920434d1d049_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH d3ea94810a363a25ffae345108dbec61
SHA256 db9f2a50d726653c41eb23ae070d4f87c9f02de66de98ea4036204f4191f0fe8
MD5 a018bb07c153ae9187dd920434d1d049
SHA1 7f2277ee5a700de16fe4c6c49822808a609be8df
SHA512 19213b698575acc34e895fa899976d358ac68e4a41eb780f0de142e33f9208e13d4ff7cdf9c559de7175d38ae604bf0153c3f7222f8fe384dbb291fe538caebe
SSDEEP 196608:4XPU+ltkNzEc1Q2vU0LfutXvlQKkTtyotVKb1RTMkwLODu/yetyYcJJZhYvFza2j:4iy0FOugpmcv/GDHL6JD+
TLSH
T108F6BF43B7E680B3EAD7D1B545BAAB7D4535BA3C032589CFB3842A494D322D1693930F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

268603

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoCreateInstance CoUninitialize CoInitialize IIDFromString StringFromGUID2 CoCreateGuid CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc

shell32

SHGetFolderPathW SHGetFolderPathA CommandLineToArgvW

user32

LoadStringA MessageBoxA SendMessageTimeoutW CharNextA MessageBoxW GetMessageW GetMessageA DispatchMessageA DispatchMessageW MsgWaitForMultipleObjectsEx TranslateMessage PeekMessageA IsWindowUnicode wsprintfA

kernel32

GetFileInformationByHandle GetDriveTypeW DeleteFileW CreateDirectoryW WriteConsoleW GetModuleFileNameW GetStdHandle GetConsoleMode GetConsoleCP GetFileType VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetModuleFileNameA SizeofResource GetCommandLineW LoadLibraryExA InitializeCriticalSectionAndSpinCount FindResourceA GetModuleHandleA MultiByteToWideChar GetLastError SetDllDirectoryA RaiseException IsDBCSLeadByte LoadResource DecodePointer GetProcAddress DeleteCriticalSection FreeLibrary WideCharToMultiByte lstrcmpiA SetCurrentDirectoryA DeleteFileA GetTickCount LocalFree GetEnvironmentVariableA GetModuleHandleExA GetCurrentThreadId Sleep FormatMessageW GetLocalTime GetCurrentProcessId FindFirstFileA WriteFile FileTimeToSystemTime FindClose WaitForSingleObject LocalAlloc CreateFileA GetSystemDirectoryA LockResource CloseHandle GetWindowsDirectoryA ExitProcess FormatMessageA ReadFile SetHandleInformation CreatePipe PeekNamedPipe RemoveDirectoryA CreateProcessA CreateDirectoryA GetExitCodeProcess SetLastError DeviceIoControl FindNextFileA CopyFileA GetFileAttributesA MoveFileExA SetFileAttributesA GetCurrentProcess GetModuleHandleExW GetTempPathA GetNativeSystemInfo GetSystemWow64DirectoryA SetEndOfFile SetFilePointerEx OpenMutexA LoadLibraryExW LoadLibraryW UnmapViewOfFile FlushViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFile CreateFileW TlsAlloc LeaveCriticalSection InitializeCriticalSection TlsGetValue GetFullPathNameW SetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize HeapReAlloc HeapFree HeapAlloc ReadConsoleW GetFileSizeEx FlushFileBuffers GetCurrentDirectoryW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SwitchToThread GetStringTypeW TlsSetValue TlsFree GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime OutputDebugStringW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetModuleHandleW TerminateProcess EnterCriticalSection IsDebuggerPresent

advapi32

GetSecurityDescriptorDacl RegDeleteValueA RegOpenKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA CopySid OpenProcessToken GetTokenInformation RegQueryValueExA RegEnumValueA RegEnumKeyExA GetSecurityDescriptorOwner SetFileSecurityA CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegCloseKey RegQueryInfoKeyW RegDeleteKeyA RegCreateKeyExA RegSetValueExA

oleaut32

SysFreeString VarUI4FromStr GetErrorInfo

shlwapi

SHDeleteKeyA PathIsURLA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueW

msi

ord117 ord115 ord159 ord141 ord44 ord204 ord91 ord67 ord8 ord158 ord137 ord160 ord168 ord31 ord189

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_a018bb07c153ae9187dd920434d1d049_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

ole32

shell32

user32

kernel32

advapi32

oleaut32

shlwapi

version

msi

generic