2026-11-03_5df7f1464a0a3c1fc313791ce4f6e2b4_amadey_avoslocker_coinminer_elex_luca-stealer_lynx_njrat

General

Target
2026-11-03_5df7f1464a0a3c1fc313791ce4f6e2b4_amadey_avoslocker_coinminer_elex_luca-stealer_lynx_njrat
Size 1.9MB
Sample261104-x4es7atzev
SHA256 2204175ce6e4b8c7e47d72166901ec202edaf66486e9b5dc0d5b8e46f8e3cd64
MD5 5df7f1464a0a3c1fc313791ce4f6e2b4
SHA1 eb6fe0f760e63e48b8acbf9161f910b4341d3361
SHA512 d5020469ecb6a8c3a384b021e1eb6556e2cd76121885a296ceb59fad0ded9f0b300e429c75a1f44f3eef0f60cd2a47410dd1871d6bee89aaf73f57725a447b0b
SSDEEP 24576:3+OqvCfeAfTxCaHsK+fM2jEaNZBqoeW7V6tGLfHtqls+0Y:O1vC2A7oksDM2jh3BqS7YtGL/Als
TLSH
T1DA95E0107966C032E53542B00EB9DFB6A47DAD684F6106CBB7C41A3A5E306E36B31F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_5df7f1464a0a3c1fc313791ce4f6e2b4_amadey_avoslocker_coinminer_elex_luca-stealer_lynx_njrat

File Explorer

2026-11-03_5df7f1464a0a3c1fc313791ce4f6e2b4_amadey_avoslocker_coinminer_elex_luca-stealer_lynx_njrat

.exe 1.9MB

2026-11-03_5df7f1464a0a3c1fc313791ce4f6e2b4_amadey_avoslocker_coinminer_elex_luca-stealer_lynx_njrat

IMPHASH 9a4ec6df9961336be7b0c3fb06920c1b
SHA256 2204175ce6e4b8c7e47d72166901ec202edaf66486e9b5dc0d5b8e46f8e3cd64
MD5 5df7f1464a0a3c1fc313791ce4f6e2b4
SHA1 eb6fe0f760e63e48b8acbf9161f910b4341d3361
SHA512 d5020469ecb6a8c3a384b021e1eb6556e2cd76121885a296ceb59fad0ded9f0b300e429c75a1f44f3eef0f60cd2a47410dd1871d6bee89aaf73f57725a447b0b
SSDEEP 24576:3+OqvCfeAfTxCaHsK+fM2jEaNZBqoeW7V6tGLfHtqls+0Y:O1vC2A7oksDM2jh3BqS7YtGL/Als
TLSH
T1DA95E0107966C032E53542B00EB9DFB6A47DAD684F6106CBB7C41A3A5E306E36B31F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

189235

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_1qqq7\rc_bugfix_master_\Build\Release\WPSOffice\office6\kcrashdumper.pdb

kernel32

GetCommandLineW CreateFileW CloseHandle GetLastError OpenProcess GetSystemDirectoryW ReadProcessMemory GetSystemWow64DirectoryW FreeLibrary GetProcAddress LoadLibraryW GetTempPathW GetModuleFileNameW WideCharToMultiByte DecodePointer RaiseException HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection OpenThread GetProcessTimes GetSystemTimeAsFileTime GetModuleHandleExW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW ReadFile RemoveDirectoryW SetFileAttributesW WriteFile EnterCriticalSection LeaveCriticalSection GetCurrentProcessId GetCurrentThreadId GetSystemInfo OpenFileMappingW MapViewOfFile UnmapViewOfFile MoveFileExW VerSetConditionMask GetEnvironmentVariableW GetModuleHandleW lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW VerifyVersionInfoW MultiByteToWideChar SetEnvironmentVariableW CreateProcessW ExpandEnvironmentStringsW Sleep GetCurrentProcess GetCurrentThread ProcessIdToSessionId WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLongPathNameW SetStdHandle VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW QueryPerformanceCounter InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW SetEndOfFile SetFilePointerEx EncodePointer LCMapStringEx GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx CreateEventW InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess OutputDebugStringW RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle ExitProcess GetCommandLineA GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode GetFileSizeEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_5df7f1464a0a3c1fc313791ce4f6e2b4_amadey_avoslocker_coinminer_elex_luca-stealer_lynx_njrat

kernel32

generic