2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader

General

Target
2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader
Size 1.3MB
Sample261102-2sh4paxvav
SHA256 9d1a21cd5eb4d0eb74832de18fef0226a2bc390fc18c1e1db196a361982ace20
MD5 c928dff0d1a884bb6d2c15d0cd77b2b1
SHA1 8d9f3a9cc11748d73087a10e26bca11d192d4a6d
SHA512 addee2e4d582efcb9c5edc158480229bc4897bbd74e5b2368e81447db5819d2eaa9d6bd069e47ad66b03ae8f85e9ad28028ef06473ba429b33fb726a3408a200
SSDEEP 24576:74ZZQufMz4MMMMMMf8XB6D+InjiojsqjnhMgeiCl7G0nehbGZpbD:7EZQUu4MMMMMMf8YDtnNnDmg27RnWGj
TLSH
T1955517D195C38CDBD41A0A316474D9B7142A3F246B74A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader

File Explorer

2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader

.exe 1.3MB

2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader

IMPHASH 7a485fe51b5d2e1b8ee9e22c1d488fca
SHA256 9d1a21cd5eb4d0eb74832de18fef0226a2bc390fc18c1e1db196a361982ace20
MD5 c928dff0d1a884bb6d2c15d0cd77b2b1
SHA1 8d9f3a9cc11748d73087a10e26bca11d192d4a6d
SHA512 addee2e4d582efcb9c5edc158480229bc4897bbd74e5b2368e81447db5819d2eaa9d6bd069e47ad66b03ae8f85e9ad28028ef06473ba429b33fb726a3408a200
SSDEEP 24576:74ZZQufMz4MMMMMMf8XB6D+InjiojsqjnhMgeiCl7G0nehbGZpbD:7EZQUu4MMMMMMf8YDtnNnDmg27RnWGj
TLSH
T1955517D195C38CDBD41A0A316474D9B7142A3F246B74A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

53257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\StubExecutableZalo\bin\Release\Zalo.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CloseHandle OpenMutexW CreateMutexW GetCommandLineW CreateProcessW ReleaseMutex HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP FormatMessageW WideCharToMultiByte GetLastError CreateFileW FindFirstFileExW GetFileAttributesExW SetEndOfFile SetFilePointerEx MultiByteToWideChar GetStringTypeW QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW SetEnvironmentVariableW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree GetFileType GetFileSizeEx GetTimeZoneInformation FlushFileBuffers GetConsoleCP GetConsoleMode HeapAlloc ReadFile ReadConsoleW GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc IsValidCodePage GetACP WriteConsoleW

user32

MessageBoxW WaitForInputIdle AllowSetForegroundWindow

shell32

ShellExecuteW CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader

kernel32

user32

shell32

generic