2026-11-02_c20a00c0fdcbdc34d61c33e5c08d3129_amadey_elex_lynx_smoke-loader

General

Target
2026-11-02_c20a00c0fdcbdc34d61c33e5c08d3129_amadey_elex_lynx_smoke-loader
Size 1.3MB
Sample261102-3krarszy8j
SHA256 a83dd98308587170c6f4b206c16225d43268b7283bbd34229c6134ebee6d2c7a
MD5 c20a00c0fdcbdc34d61c33e5c08d3129
SHA1 9b67e9c481aa7bc14e4b9ca35ac7f049ee0af27b
SHA512 89490c207169409cede98e05e403f016ea6f0c07da9ebcdb425dad19c90aaa764af082e3beb33597a2f3e57cd21e6086853622050180ccb79a28266593eef880
SSDEEP 24576:e4wZQufMz4MMMMMMf8XB6D+InjiowdCN/j2GLl3iFSE33b9:e5ZQUu4MMMMMMf8YDtnN7N/j2U4FH
TLSH
T1F65518D195C38CDBD41A0A316478D9B7112A7F246B3493CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_c20a00c0fdcbdc34d61c33e5c08d3129_amadey_elex_lynx_smoke-loader

File Explorer

2026-11-02_c20a00c0fdcbdc34d61c33e5c08d3129_amadey_elex_lynx_smoke-loader

.exe 1.3MB

2026-11-02_c20a00c0fdcbdc34d61c33e5c08d3129_amadey_elex_lynx_smoke-loader

IMPHASH 7a485fe51b5d2e1b8ee9e22c1d488fca
SHA256 a83dd98308587170c6f4b206c16225d43268b7283bbd34229c6134ebee6d2c7a
MD5 c20a00c0fdcbdc34d61c33e5c08d3129
SHA1 9b67e9c481aa7bc14e4b9ca35ac7f049ee0af27b
SHA512 89490c207169409cede98e05e403f016ea6f0c07da9ebcdb425dad19c90aaa764af082e3beb33597a2f3e57cd21e6086853622050180ccb79a28266593eef880
SSDEEP 24576:e4wZQufMz4MMMMMMf8XB6D+InjiowdCN/j2GLl3iFSE33b9:e5ZQUu4MMMMMMf8YDtnN7N/j2U4FH
TLSH
T1F65518D195C38CDBD41A0A316478D9B7112A7F246B3493CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

53257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\StubExecutableZalo\bin\Release\Zalo.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CloseHandle OpenMutexW CreateMutexW GetCommandLineW CreateProcessW ReleaseMutex HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP FormatMessageW WideCharToMultiByte GetLastError CreateFileW FindFirstFileExW GetFileAttributesExW SetEndOfFile SetFilePointerEx MultiByteToWideChar GetStringTypeW QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW SetEnvironmentVariableW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree GetFileType GetFileSizeEx GetTimeZoneInformation FlushFileBuffers GetConsoleCP GetConsoleMode HeapAlloc ReadFile ReadConsoleW GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc IsValidCodePage GetACP WriteConsoleW

user32

MessageBoxW WaitForInputIdle AllowSetForegroundWindow

shell32

ShellExecuteW CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_c20a00c0fdcbdc34d61c33e5c08d3129_amadey_elex_lynx_smoke-loader

kernel32

user32

shell32

generic