2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader

General

Target
2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader
Size 1.3MB
Sample261102-yncjkawyds
SHA256 a57d9c3b271e4af700f453d130408b30dba17f795252f42b0bfab8fc04c3033b
MD5 e52a026472c1aee67d4df0ae7b4930f4
SHA1 d4343b4e345360bb9a7cb52145132329851ac7ba
SHA512 0288f01b50d86dccea7f13f46643620407c1635e41966392562e76557825bba084cae884adfe75c26b6138ba0d1d40ece732dc9ae12af5d5140586d0efa03cdb
SSDEEP 24576:k4ZZQufMz4MMMMMMf8XB6D+InjioCsqjnhMgeiCl7G0nehbGZpbD:kEZQUu4MMMMMMf8YDtnNGDmg27RnWGj
TLSH
T1B35517D195C38CDBD41A0A316474D9B7142A3F246B74A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader

File Explorer

2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader

.exe 1.3MB

2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader

IMPHASH 7a485fe51b5d2e1b8ee9e22c1d488fca
SHA256 a57d9c3b271e4af700f453d130408b30dba17f795252f42b0bfab8fc04c3033b
MD5 e52a026472c1aee67d4df0ae7b4930f4
SHA1 d4343b4e345360bb9a7cb52145132329851ac7ba
SHA512 0288f01b50d86dccea7f13f46643620407c1635e41966392562e76557825bba084cae884adfe75c26b6138ba0d1d40ece732dc9ae12af5d5140586d0efa03cdb
SSDEEP 24576:k4ZZQufMz4MMMMMMf8XB6D+InjioCsqjnhMgeiCl7G0nehbGZpbD:kEZQUu4MMMMMMf8YDtnNGDmg27RnWGj
TLSH
T1B35517D195C38CDBD41A0A316474D9B7142A3F246B74A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

53257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\StubExecutableZalo\bin\Release\Zalo.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CloseHandle OpenMutexW CreateMutexW GetCommandLineW CreateProcessW ReleaseMutex HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP FormatMessageW WideCharToMultiByte GetLastError CreateFileW FindFirstFileExW GetFileAttributesExW SetEndOfFile SetFilePointerEx MultiByteToWideChar GetStringTypeW QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW SetEnvironmentVariableW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree GetFileType GetFileSizeEx GetTimeZoneInformation FlushFileBuffers GetConsoleCP GetConsoleMode HeapAlloc ReadFile ReadConsoleW GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc IsValidCodePage GetACP WriteConsoleW

user32

MessageBoxW WaitForInputIdle AllowSetForegroundWindow

shell32

ShellExecuteW CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader

kernel32

user32

shell32

generic