2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader

General

Target
2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader
Size 1.3MB
Sample261113-dqm3vsfx2n
SHA256 3eab63d900b6c93a0d777ad2f448468fcee35feb66b11d495b5da8b5e36f1ed4
MD5 506b27204aeee6b7e1491648a18ddf8c
SHA1 a86be5dea755be29b2af1b5bce84480e383f20d6
SHA512 ebbc4d46c2bab2549aa525078f21ede7d9886dda4d2fe16c4dc69c8d9aa041b8f11bb2498483a5c9e4f2320716dd200267370f6851f6fb5a616085954e4d56f9
SSDEEP 24576:04ZZQufMz4MMMMMMf8XB6D+InjiogsqjnhMgeiCl7G0nehbGZpbD:0EZQUu4MMMMMMf8YDtnNcDmg27RnWGj
TLSH
T1105517D195C38CDBD41A0A316474D9B7542A3F246B34A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader

File Explorer

2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader

.exe 1.3MB

2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader

IMPHASH 7a485fe51b5d2e1b8ee9e22c1d488fca
SHA256 3eab63d900b6c93a0d777ad2f448468fcee35feb66b11d495b5da8b5e36f1ed4
MD5 506b27204aeee6b7e1491648a18ddf8c
SHA1 a86be5dea755be29b2af1b5bce84480e383f20d6
SHA512 ebbc4d46c2bab2549aa525078f21ede7d9886dda4d2fe16c4dc69c8d9aa041b8f11bb2498483a5c9e4f2320716dd200267370f6851f6fb5a616085954e4d56f9
SSDEEP 24576:04ZZQufMz4MMMMMMf8XB6D+InjiogsqjnhMgeiCl7G0nehbGZpbD:0EZQUu4MMMMMMf8YDtnNcDmg27RnWGj
TLSH
T1105517D195C38CDBD41A0A316474D9B7542A3F246B34A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

53257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\StubExecutableZalo\bin\Release\Zalo.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CloseHandle OpenMutexW CreateMutexW GetCommandLineW CreateProcessW ReleaseMutex HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP FormatMessageW WideCharToMultiByte GetLastError CreateFileW FindFirstFileExW GetFileAttributesExW SetEndOfFile SetFilePointerEx MultiByteToWideChar GetStringTypeW QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW SetEnvironmentVariableW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree GetFileType GetFileSizeEx GetTimeZoneInformation FlushFileBuffers GetConsoleCP GetConsoleMode HeapAlloc ReadFile ReadConsoleW GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc IsValidCodePage GetACP WriteConsoleW

user32

MessageBoxW WaitForInputIdle AllowSetForegroundWindow

shell32

ShellExecuteW CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader

kernel32

user32

shell32

generic