2026-10-28_fe436dd33d12002bc9fc2f92a6a710be_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_fe436dd33d12002bc9fc2f92a6a710be_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 14.8MB
Sample261029-a9ghmsht9k
SHA256 1ec69fb9ab8218854c9d73143b685ed73382169194f28cbb7ea01c73a2a1b94c
MD5 fe436dd33d12002bc9fc2f92a6a710be
SHA1 aad243db16e8bcb0ca90dbe6daa0ce266cba136a
SHA512 5cc41fb11b765164165f13b73baf4056d997186ead794416416ce631095f831c22e3f0426e31dac6bdf1f0cd10e7a059f9c73da55bdf64e080f041dd22e08e9c
SSDEEP 196608:4XPU+ltkNzEc1Q2vU0LfutXvlQKkTtyotVKb1RTMkwLODu/yetyYcJJZhYvFza2P:4iy0FOugpmcv/GDHL6JD4
TLSH
T102F6BF43B7E680B3EAD7D1B545BAAB7D4535BA3C032589CFB3842A494D322D1693930F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_fe436dd33d12002bc9fc2f92a6a710be_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-10-28_fe436dd33d12002bc9fc2f92a6a710be_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 14.8MB

2026-10-28_fe436dd33d12002bc9fc2f92a6a710be_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH d3ea94810a363a25ffae345108dbec61
SHA256 1ec69fb9ab8218854c9d73143b685ed73382169194f28cbb7ea01c73a2a1b94c
MD5 fe436dd33d12002bc9fc2f92a6a710be
SHA1 aad243db16e8bcb0ca90dbe6daa0ce266cba136a
SHA512 5cc41fb11b765164165f13b73baf4056d997186ead794416416ce631095f831c22e3f0426e31dac6bdf1f0cd10e7a059f9c73da55bdf64e080f041dd22e08e9c
SSDEEP 196608:4XPU+ltkNzEc1Q2vU0LfutXvlQKkTtyotVKb1RTMkwLODu/yetyYcJJZhYvFza2P:4iy0FOugpmcv/GDHL6JD4
TLSH
T102F6BF43B7E680B3EAD7D1B545BAAB7D4535BA3C032589CFB3842A494D322D1693930F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

268603

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoCreateInstance CoUninitialize CoInitialize IIDFromString StringFromGUID2 CoCreateGuid CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc

shell32

SHGetFolderPathW SHGetFolderPathA CommandLineToArgvW

user32

LoadStringA MessageBoxA SendMessageTimeoutW CharNextA MessageBoxW GetMessageW GetMessageA DispatchMessageA DispatchMessageW MsgWaitForMultipleObjectsEx TranslateMessage PeekMessageA IsWindowUnicode wsprintfA

kernel32

GetFileInformationByHandle GetDriveTypeW DeleteFileW CreateDirectoryW WriteConsoleW GetModuleFileNameW GetStdHandle GetConsoleMode GetConsoleCP GetFileType VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetModuleFileNameA SizeofResource GetCommandLineW LoadLibraryExA InitializeCriticalSectionAndSpinCount FindResourceA GetModuleHandleA MultiByteToWideChar GetLastError SetDllDirectoryA RaiseException IsDBCSLeadByte LoadResource DecodePointer GetProcAddress DeleteCriticalSection FreeLibrary WideCharToMultiByte lstrcmpiA SetCurrentDirectoryA DeleteFileA GetTickCount LocalFree GetEnvironmentVariableA GetModuleHandleExA GetCurrentThreadId Sleep FormatMessageW GetLocalTime GetCurrentProcessId FindFirstFileA WriteFile FileTimeToSystemTime FindClose WaitForSingleObject LocalAlloc CreateFileA GetSystemDirectoryA LockResource CloseHandle GetWindowsDirectoryA ExitProcess FormatMessageA ReadFile SetHandleInformation CreatePipe PeekNamedPipe RemoveDirectoryA CreateProcessA CreateDirectoryA GetExitCodeProcess SetLastError DeviceIoControl FindNextFileA CopyFileA GetFileAttributesA MoveFileExA SetFileAttributesA GetCurrentProcess GetModuleHandleExW GetTempPathA GetNativeSystemInfo GetSystemWow64DirectoryA SetEndOfFile SetFilePointerEx OpenMutexA LoadLibraryExW LoadLibraryW UnmapViewOfFile FlushViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFile CreateFileW TlsAlloc LeaveCriticalSection InitializeCriticalSection TlsGetValue GetFullPathNameW SetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize HeapReAlloc HeapFree HeapAlloc ReadConsoleW GetFileSizeEx FlushFileBuffers GetCurrentDirectoryW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SwitchToThread GetStringTypeW TlsSetValue TlsFree GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime OutputDebugStringW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetModuleHandleW TerminateProcess EnterCriticalSection IsDebuggerPresent

advapi32

GetSecurityDescriptorDacl RegDeleteValueA RegOpenKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA CopySid OpenProcessToken GetTokenInformation RegQueryValueExA RegEnumValueA RegEnumKeyExA GetSecurityDescriptorOwner SetFileSecurityA CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegCloseKey RegQueryInfoKeyW RegDeleteKeyA RegCreateKeyExA RegSetValueExA

oleaut32

SysFreeString VarUI4FromStr GetErrorInfo

shlwapi

SHDeleteKeyA PathIsURLA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueW

msi

ord117 ord115 ord159 ord141 ord44 ord204 ord91 ord67 ord8 ord158 ord137 ord160 ord168 ord31 ord189

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_fe436dd33d12002bc9fc2f92a6a710be_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

ole32

shell32

user32

kernel32

advapi32

oleaut32

shlwapi

version

msi

generic