2026-11-12_485b802462e35c0aca38028b226081de_amadey_avoslocker_elex_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_485b802462e35c0aca38028b226081de_amadey_avoslocker_elex_luca-stealer_lynx_njrat_smoke-loader
Size 1.5MB
Sample261113-ejc5rafy8j
SHA256 3def1c66f59414bfa8d67f41025709e125fd83d256f8c795589d1d58dc0efee8
MD5 485b802462e35c0aca38028b226081de
SHA1 514580330338b4ed2658032b69d03681fda4b318
SHA512 ec8677b16810c5d79aae54bcabd68e1ed6033809f8d22b36ebf0c1f231897d16fbe0fd025784a2c120be41ee610f95a0b3e978d593d7bf2dc435cab3f1be15af
SSDEEP 24576:zaO116FYDyPZmTGHf01VQo+aLqA1QZRumrEs+K:+26FYDyPZmTi01VQo+eqAimm
TLSH
T19165F1117790D032D56302315B68EA618A6DF8705F218BEF63E45A6EEE30BD0DA31F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_485b802462e35c0aca38028b226081de_amadey_avoslocker_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-11-12_485b802462e35c0aca38028b226081de_amadey_avoslocker_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 1.5MB

2026-11-12_485b802462e35c0aca38028b226081de_amadey_avoslocker_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH dcf5ae08720a7193594b5dbee64a501b
SHA256 3def1c66f59414bfa8d67f41025709e125fd83d256f8c795589d1d58dc0efee8
MD5 485b802462e35c0aca38028b226081de
SHA1 514580330338b4ed2658032b69d03681fda4b318
SHA512 ec8677b16810c5d79aae54bcabd68e1ed6033809f8d22b36ebf0c1f231897d16fbe0fd025784a2c120be41ee610f95a0b3e978d593d7bf2dc435cab3f1be15af
SSDEEP 24576:zaO116FYDyPZmTGHf01VQo+aLqA1QZRumrEs+K:+26FYDyPZmTi01VQo+eqAimm
TLSH
T19165F1117790D032D56302315B68EA618A6DF8705F218BEF63E45A6EEE30BD0DA31F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

99200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jenkins\workspace\Client.den\Client\Windows\release\bin\Release\CptService.pdb

kernel32

LoadLibraryW CopyFileW MoveFileW HeapReAlloc HeapSize TerminateProcess GetSystemInfo GetSystemDirectoryW GetVersionExW GetModuleHandleA GetModuleHandleW LoadLibraryExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetModuleHandleExW ResumeThread CreateFileMappingW OpenFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile GetFileSize GetPrivateProfileStringW WritePrivateProfileStringW QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId TerminateThread GetExitCodeThread SetEndOfFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW FlushFileBuffers SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetCurrentProcess GetProcessHeap HeapFree HeapAlloc SetLastError GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle FindNextFileW FreeLibrary FindClose DeleteFileW MultiByteToWideChar FileTimeToSystemTime lstrcpyW lstrcmpA LocalFree LocalAlloc GetProcAddress GetLocalTime InitializeCriticalSectionAndSpinCount GetFileAttributesW FileTimeToLocalFileTime WideCharToMultiByte GetCurrentProcessId DeleteCriticalSection DecodePointer RaiseException CloseHandle SetEvent GetLastError ProcessIdToSessionId CreateEventW OpenProcess CreateFileW WaitForSingleObject InitializeCriticalSectionEx LeaveCriticalSection GetModuleFileNameW GetCommandLineW EnterCriticalSection GetPrivateProfileIntW GetFileType WriteFile GetStdHandle ExitProcess ReadFile GetFileAttributesExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent OutputDebugStringW IsDebuggerPresent GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx EncodePointer WriteConsoleW

user32

GetSystemMetrics

advapi32

OpenSCManagerW ConvertStringSidToSidW QueryServiceStatusEx QueryServiceConfigW SetTokenInformation GetLengthSid CreateProcessAsUserW SetEntriesInAclW OpenServiceW StartServiceCtrlDispatcherW CloseServiceHandle SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid GetTokenInformation DuplicateTokenEx OpenProcessToken RegisterServiceCtrlHandlerExW SetServiceStatus

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetFolderPathW SHGetKnownFolderPath

ole32

CoTaskMemFree

shlwapi

PathFileExistsW PathRemoveFileSpecW PathAddBackslashW PathAppendW PathIsRelativeW PathFindFileNameW

rpcrt4

NdrServerCall2 RpcServerUseProtseqEpW RpcServerUnregisterIfEx RpcServerRegisterIf2 RpcBindingFree I_RpcBindingInqLocalClientPID

psapi

GetProcessImageFileNameW GetProcessImageFileNameA GetModuleFileNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_485b802462e35c0aca38028b226081de_amadey_avoslocker_elex_luca-stealer_lynx_njrat_smoke-loader

kernel32

user32

advapi32

shell32

ole32

shlwapi

rpcrt4

psapi

generic