2026-10-28_12765b2e049711681f9ffbac58914d78_amadey_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_12765b2e049711681f9ffbac58914d78_amadey_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat
Size 7.4MB
Sample261030-l3tp6sbs8s
SHA256 a23a3946458fde35ca894bc7cd6ed617354ae04ee39626664c29e782c75305da
MD5 12765b2e049711681f9ffbac58914d78
SHA1 6bdceebc9b1b3459712b98bb813085c4ecfe6d4d
SHA512 51908f7dbcd24ac7153f6493b09f969e28150e20e71fb5e04bae97b8e5cb465472393c204450e2fa9d55305336a86bbb0d3ec8d1e7ab5a4486fe6b4d731725c3
SSDEEP 98304:uz16s9EwkidrwQwPdz9u/ZZmDZJEr6XQbZT7wIX02R:uz16gBrd3gu/XmDZi60tR
TLSH
T16876F94162D58064F1B22675697A2AB1467B7D215F38C8CFB68C6D1D0BB36D2E830F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-28_12765b2e049711681f9ffbac58914d78_amadey_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-10-28_12765b2e049711681f9ffbac58914d78_amadey_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

.exe 7.4MB

2026-10-28_12765b2e049711681f9ffbac58914d78_amadey_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

IMPHASH 26d1142062053486e607ffede8dd675c
SHA256 a23a3946458fde35ca894bc7cd6ed617354ae04ee39626664c29e782c75305da
MD5 12765b2e049711681f9ffbac58914d78
SHA1 6bdceebc9b1b3459712b98bb813085c4ecfe6d4d
SHA512 51908f7dbcd24ac7153f6493b09f969e28150e20e71fb5e04bae97b8e5cb465472393c204450e2fa9d55305336a86bbb0d3ec8d1e7ab5a4486fe6b4d731725c3
SSDEEP 98304:uz16s9EwkidrwQwPdz9u/ZZmDZJEr6XQbZT7wIX02R:uz16gBrd3gu/XmDZi60tR
TLSH
T16876F94162D58064F1B22675697A2AB1467B7D215F38C8CFB68C6D1D0BB36D2E830F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

43:fc:5e:9e:bc:21:d1:c6:21:ac:12:2a:00:9b:15:ee:0d:40:91:91:15:25:2b:89:15:a7:2c:4a:ba:04:f4:0a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 2, 2020

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2019 - Feb 3, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

2954362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Set-up.pdb

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCW PathIsRelativeW PathRemoveBackslashW PathIsNetworkPathW PathStripPathW UrlIsW SHGetValueW UrlEscapeW PathFindFileNameW PathRemoveFileSpecW PathRemoveExtensionW PathFileExistsW PathAddExtensionW PathIsFileSpecW PathAppendW PathIsDirectoryW PathRenameExtensionW PathIsSystemFolderW PathFileExistsA PathAddBackslashW PathIsRootW PathStripToRootW

shell32

SHCreateDirectoryExW ord51 SHGetKnownFolderPath ShellExecuteW ShellExecuteExW SHGetSpecialFolderLocation SHBrowseForFolderW ord680 SHGetMalloc SHGetFolderLocation SHGetPathFromIDListW SHGetFolderPathW SHGetSpecialFolderPathW CommandLineToArgvW

kernel32

FindNextFileW WaitForMultipleObjects CreateFileW CreateEventW SetEvent ResetEvent GetOverlappedResult ReadDirectoryChangesW MultiByteToWideChar WideCharToMultiByte GetFileSizeEx FindClose GetFileAttributesW SetFileAttributesW DeleteFileW GetLocalTime GetTimeFormatW GetDateFormatW GetCurrentProcess DeviceIoControl GetTempPathW GetVersionExW GetComputerNameExW FileTimeToSystemTime GetNativeSystemInfo RaiseException LoadLibraryW GetProcAddress CreateProcessW GetModuleHandleW FreeLibrary InitializeCriticalSectionEx DecodePointer MulDiv GetModuleFileNameW TerminateProcess RemoveDirectoryW OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CopyFileW GetExitCodeProcess ReadFile SetLastError lstrlenW LocalAlloc GetDiskFreeSpaceExW GetCurrentDirectoryW SetCurrentDirectoryW MoveFileExW GetFileSize lstrcpyW lstrcmpiW lstrcmpW GetDriveTypeW GetFullPathNameW HeapSize HeapReAlloc HeapDestroy GlobalAlloc GlobalLock GlobalUnlock GetSystemDirectoryW SetDllDirectoryW GetStdHandle AttachConsole FreeConsole GetConsoleWindow AreFileApisANSI TryEnterCriticalSection HeapCreate WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer LeaveCriticalSection SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA GetSystemInfo HeapCompact UnlockFile CreateFileMappingA LockFileEx SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource LockResource LoadResource FindResourceW GlobalFree VerSetConditionMask FindFirstFileW GetUserDefaultLCID LCMapStringW DuplicateHandle ProcessIdToSessionId TerminateThread CreateThread FindResourceExW GetThreadTimes QueryFullProcessImageNameW GetUserDefaultLangID GetUserDefaultUILanguage SetNamedPipeHandleState CreateNamedPipeW ConnectNamedPipe CreateDirectoryW ReleaseSemaphore OpenSemaphoreW CreateSemaphoreW GetTimeZoneInformation VirtualFree VirtualAlloc QueryPerformanceFrequency GetCurrentThread SetFilePointerEx ResumeThread SetThreadPriority EnterCriticalSection CompareStringW GetCPInfo EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetStringTypeW GetExitCodeThread SwitchToThread GetModuleHandleExW QueueUserWorkItem IsProcessorFeaturePresent LoadLibraryExA VirtualQuery VirtualProtect GetCurrentProcessId GetCurrentThreadId OpenMutexW CloseHandle ReleaseMutex WaitForSingleObject CreateMutexW GetProcessHeap HeapAlloc HeapFree LocalFree GetLastError FormatMessageW GetLocaleInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask DeleteCriticalSection RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitThread GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime SetStdHandle WriteConsoleW ExitProcess GetConsoleCP GetConsoleMode IsValidLocale EnumSystemLocalesW ReadConsoleW FindFirstFileExW IsValidCodePage GetACP VerifyVersionInfoW GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW InitializeCriticalSection SetEnvironmentVariableW GetFullPathNameA

user32

CharNextW BringWindowToTop TranslateAcceleratorW GetClassNameW SetCapture GetDlgItem GetParent RegisterWindowMessageW ReleaseCapture SetForegroundWindow InvalidateRect GetForegroundWindow GetSysColor AttachThreadInput IsChild DestroyAcceleratorTable ClientToScreen RedrawWindow InvalidateRgn IsWindow SetFocus ScreenToClient FillRect GetFocus GetWindow IsIconic BeginPaint EndPaint GetWindowTextW GetSystemMetrics GetMessageW DefWindowProcW GetWindowLongW DestroyWindow SetWindowPos CreateWindowExW SendMessageW RegisterClassExW GetActiveWindow DispatchMessageW CreateAcceleratorTableW SetWindowTextW CallWindowProcW GetWindowTextLengthW GetWindowThreadProcessId wsprintfW PostThreadMessageW TranslateMessage LoadCursorW SetWindowLongW PostQuitMessage GetDesktopWindow GetClassInfoExW GetDC MessageBoxW ShowWindow GetAsyncKeyState ReleaseDC PostMessageW UnregisterClassW GetClientRect EnumWindows MoveWindow GetShellWindow LoadImageW SystemParametersInfoW EnableMenuItem LoadIconW GetSystemMenu GetClassLongW AppendMenuW SetClassLongW GetWindowRect

gdi32

DeleteDC GetObjectW DeleteObject CreateSolidBrush GetDeviceCaps SelectObject CreateCompatibleBitmap GetStockObject BitBlt CreateCompatibleDC

advapi32

SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW GetTokenInformation CreateWellKnownSid LookupPrivilegeValueW OpenProcessToken RegFlushKey RegCloseKey RegDeleteKeyExW RegCreateKeyExW RegSetValueExW LookupAccountSidW RegOpenKeyExW RegEnumValueW EqualSid InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid SetSecurityDescriptorDacl DuplicateTokenEx ConvertSidToStringSidW ImpersonateLoggedOnUser ConvertStringSidToSidW RevertToSelf CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueExW GetUserNameW CredWriteW CredReadW CredDeleteW CredFree CredEnumerateW AdjustTokenPrivileges

ole32

CoCreateGuid CoAddRefServerProcess OleRun CoUninitialize CoInitialize CLSIDFromString CreateStreamOnHGlobal CLSIDFromProgID CoGetClassObject CoCreateInstance StringFromGUID2 OleInitialize OleUninitialize OleLockRunning CoTaskMemAlloc CoTaskMemFree CoReleaseServerProcess

oleaut32

VariantChangeType SysAllocStringLen SysStringLen SysFreeString VariantInit SysAllocString OleCreateFontIndirect LoadTypeLi LoadRegTypeLi SysAllocStringByteLen VariantCopy SysStringByteLen DispCallFunc GetErrorInfo VariantClear

bcrypt

BCryptCloseAlgorithmProvider BCryptVerifySignature BCryptGenerateSymmetricKey BCryptSetProperty BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptGetProperty

crypt32

CertGetIssuerCertificateFromStore CertGetNameStringW CryptProtectData CryptUnprotectData CryptStringToBinaryW CertOpenStore CertFindCertificateInStore CertFreeCertificateContext CertCreateCertificateContext CryptHashCertificate2 CryptImportPublicKeyInfoEx2 CertVerifySubjectCertificateContext CertAddCertificateContextToStore CertCloseStore

secur32

GetUserNameExW

wintrust

WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust WTHelperGetProvSignerFromChain

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_12765b2e049711681f9ffbac58914d78_amadey_avoslocker_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

PE Signature issue

comctl32

shlwapi

shell32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

bcrypt

crypt32

secur32

wintrust

generic