2026-10-28_5c547c038cef6d72c64f3210ecc889d5_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_5c547c038cef6d72c64f3210ecc889d5_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 14.8MB
Sample261030-eay1vsws6j
SHA256 d904b50bd69718d0897dad0600810e73563fd4c97eb06259bdd1489737d32319
MD5 5c547c038cef6d72c64f3210ecc889d5
SHA1 b08e3d1c32924500fda3bafe87d6a6957cfe33d4
SHA512 b06687bd4ace77d9161508c606576220807cd67816e0d91a74cfee24672a13ae5bca175cf9aef74dcdf453a2ad8bd563cc32c3a32dca05472d162007e9b5616b
SSDEEP 196608:4XPU+ltkNzEc1Q2vU0LfutXvlQKkTtyotVKb1RTMkwLODu/yetyYcJJZhYvFza21:4iy0FOugpmcv/GDHL6JD6
TLSH
T158F6BF43B7E680B3EAD7D1B545BAAB7D4535BA3C032589CFB3842A494D322D1693930F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_5c547c038cef6d72c64f3210ecc889d5_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-10-28_5c547c038cef6d72c64f3210ecc889d5_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 14.8MB

2026-10-28_5c547c038cef6d72c64f3210ecc889d5_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH d3ea94810a363a25ffae345108dbec61
SHA256 d904b50bd69718d0897dad0600810e73563fd4c97eb06259bdd1489737d32319
MD5 5c547c038cef6d72c64f3210ecc889d5
SHA1 b08e3d1c32924500fda3bafe87d6a6957cfe33d4
SHA512 b06687bd4ace77d9161508c606576220807cd67816e0d91a74cfee24672a13ae5bca175cf9aef74dcdf453a2ad8bd563cc32c3a32dca05472d162007e9b5616b
SSDEEP 196608:4XPU+ltkNzEc1Q2vU0LfutXvlQKkTtyotVKb1RTMkwLODu/yetyYcJJZhYvFza21:4iy0FOugpmcv/GDHL6JD6
TLSH
T158F6BF43B7E680B3EAD7D1B545BAAB7D4535BA3C032589CFB3842A494D322D1693930F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

268603

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoCreateInstance CoUninitialize CoInitialize IIDFromString StringFromGUID2 CoCreateGuid CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc

shell32

SHGetFolderPathW SHGetFolderPathA CommandLineToArgvW

user32

LoadStringA MessageBoxA SendMessageTimeoutW CharNextA MessageBoxW GetMessageW GetMessageA DispatchMessageA DispatchMessageW MsgWaitForMultipleObjectsEx TranslateMessage PeekMessageA IsWindowUnicode wsprintfA

kernel32

GetFileInformationByHandle GetDriveTypeW DeleteFileW CreateDirectoryW WriteConsoleW GetModuleFileNameW GetStdHandle GetConsoleMode GetConsoleCP GetFileType VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetModuleFileNameA SizeofResource GetCommandLineW LoadLibraryExA InitializeCriticalSectionAndSpinCount FindResourceA GetModuleHandleA MultiByteToWideChar GetLastError SetDllDirectoryA RaiseException IsDBCSLeadByte LoadResource DecodePointer GetProcAddress DeleteCriticalSection FreeLibrary WideCharToMultiByte lstrcmpiA SetCurrentDirectoryA DeleteFileA GetTickCount LocalFree GetEnvironmentVariableA GetModuleHandleExA GetCurrentThreadId Sleep FormatMessageW GetLocalTime GetCurrentProcessId FindFirstFileA WriteFile FileTimeToSystemTime FindClose WaitForSingleObject LocalAlloc CreateFileA GetSystemDirectoryA LockResource CloseHandle GetWindowsDirectoryA ExitProcess FormatMessageA ReadFile SetHandleInformation CreatePipe PeekNamedPipe RemoveDirectoryA CreateProcessA CreateDirectoryA GetExitCodeProcess SetLastError DeviceIoControl FindNextFileA CopyFileA GetFileAttributesA MoveFileExA SetFileAttributesA GetCurrentProcess GetModuleHandleExW GetTempPathA GetNativeSystemInfo GetSystemWow64DirectoryA SetEndOfFile SetFilePointerEx OpenMutexA LoadLibraryExW LoadLibraryW UnmapViewOfFile FlushViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFile CreateFileW TlsAlloc LeaveCriticalSection InitializeCriticalSection TlsGetValue GetFullPathNameW SetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize HeapReAlloc HeapFree HeapAlloc ReadConsoleW GetFileSizeEx FlushFileBuffers GetCurrentDirectoryW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SwitchToThread GetStringTypeW TlsSetValue TlsFree GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime OutputDebugStringW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetModuleHandleW TerminateProcess EnterCriticalSection IsDebuggerPresent

advapi32

GetSecurityDescriptorDacl RegDeleteValueA RegOpenKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA CopySid OpenProcessToken GetTokenInformation RegQueryValueExA RegEnumValueA RegEnumKeyExA GetSecurityDescriptorOwner SetFileSecurityA CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegCloseKey RegQueryInfoKeyW RegDeleteKeyA RegCreateKeyExA RegSetValueExA

oleaut32

SysFreeString VarUI4FromStr GetErrorInfo

shlwapi

SHDeleteKeyA PathIsURLA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueW

msi

ord117 ord115 ord159 ord141 ord44 ord204 ord91 ord67 ord8 ord158 ord137 ord160 ord168 ord31 ord189

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_5c547c038cef6d72c64f3210ecc889d5_amadey_avoslocker_darkgate_elex_http-browser_luca-stealer_lynx_mafia_njrat_poet-rat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

ole32

shell32

user32

kernel32

advapi32

oleaut32

shlwapi

version

msi

generic