2025-09-17_3357b96f7baef169e28ed5a24ea79f59_amadey_bitrat_cobalt-strike_dragonforce_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2025-09-17_3357b96f7baef169e28ed5a24ea79f59_amadey_bitrat_cobalt-strike_dragonforce_elex_luca-stealer_lynx_njrat
Size 418KB
Sample250917-dxfmcstyey
SHA256 0dfe23ab86cb5c1bfaf019521f3163aa5315a9ca3bb67d7d34eb51472c412b22
MD5 3357b96f7baef169e28ed5a24ea79f59
SHA1 84d3cba5b7cdcd1a231d1a1d860337bdae0dae84
SHA512 e322f199d088df685e09a347baf9558c9c3e608bbd3360d6b7e251da6675b2039624d29dbc7ef288a83899c9eac37a2be1978ae11c2ff66923a803c983ce0915
SSDEEP 12288:FnvxplpMAX99S4B009MqyQMKNT7LofAD8xE:FvxplpMAtU4Bl9MdQFT7LoIoS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-09-17_3357b96f7baef169e28ed5a24ea79f59_amadey_bitrat_cobalt-strike_dragonforce_elex_luca-stealer_lynx_njrat

File Explorer

2025-09-17_3357b96f7baef169e28ed5a24ea79f59_amadey_bitrat_cobalt-strike_dragonforce_elex_luca-stealer_lynx_njrat

.exe 418KB

2025-09-17_3357b96f7baef169e28ed5a24ea79f59_amadey_bitrat_cobalt-strike_dragonforce_elex_luca-stealer_lynx_njrat

IMPHASH d428b0554d443c341b28703744573111
SHA256 0dfe23ab86cb5c1bfaf019521f3163aa5315a9ca3bb67d7d34eb51472c412b22
MD5 3357b96f7baef169e28ed5a24ea79f59
SHA1 84d3cba5b7cdcd1a231d1a1d860337bdae0dae84
SHA512 e322f199d088df685e09a347baf9558c9c3e608bbd3360d6b7e251da6675b2039624d29dbc7ef288a83899c9eac37a2be1978ae11c2ff66923a803c983ce0915
SSDEEP 12288:FnvxplpMAX99S4B009MqyQMKNT7LofAD8xE:FvxplpMAtU4Bl9MdQFT7LoIoS
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

218065

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpW GetCommandLineW CreateMutexA DeleteFileW GetCurrentProcessId CopyFileW WideCharToMultiByte lstrcmpiW IsWow64Process CancelIo CreateTimerQueueTimer EnterCriticalSection DeleteTimerQueue LeaveCriticalSection InitializeCriticalSection GetQueuedCompletionStatus ExitThread PostQueuedCompletionStatus Sleep GlobalAlloc GlobalFree CreateThread GetLogicalDriveStringsW CreateIoCompletionPort CreateTimerQueue DeviceIoControl TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetModuleHandleW VirtualAlloc WaitForMultipleObjects LoadLibraryW FindClose GetUserDefaultLCID IsValidLocale lstrlenW MoveFileW lstrcpyW CreateProcessW SetFilePointerEx GetNativeSystemInfo lstrcatW GetLastError Wow64RevertWow64FsRedirection SetFileAttributesW GetFileAttributesW WaitForSingleObject FindNextFileW GetLocaleInfoW LCMapStringW SetEndOfFile GetProcessId Wow64DisableWow64FsRedirection WriteFile GetCurrentProcess ReadFile MapViewOfFile CreateFileMappingW GetProcAddress CloseHandle LoadLibraryA CreateFileW GetModuleFileNameW HeapReAlloc ReadConsoleW EnumSystemLocalesW FindFirstFileW VirtualProtect DeleteCriticalSection GetFileSizeEx WriteConsoleW HeapSize FlushFileBuffers GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetConsoleMode GetACP IsValidCodePage FindFirstFileExW SetFilePointer GetCurrentThreadId GetLocalTime MultiByteToWideChar SetLastError FreeLibrary ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetStringTypeW QueryPerformanceCounter InitializeCriticalSectionEx EncodePointer DecodePointer LocalFree LCMapStringEx GetSystemTimeAsFileTime GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle ExitProcess GetModuleHandleExW HeapAlloc HeapFree GetFileType GetConsoleOutputCP

user32

wsprintfW SystemParametersInfoW

advapi32

GetTokenInformation OpenProcessToken RegOpenKeyExW InitializeSecurityDescriptor RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegQueryInfoKeyW RegCloseKey SetSecurityDescriptorDacl CryptAcquireContextA CryptImportKey QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService OpenServiceW CryptEncrypt CryptGenRandom LookupAccountSidW

shell32

CommandLineToArgvW

ole32

CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

rstrtmgr

RmEndSession RmRegisterResources RmShutdown RmStartSession RmGetList

netapi32

NetShareEnum NetApiBufferFree

iphlpapi

GetIpNetTable

shlwapi

StrStrIA StrStrIW

ws2_32

gethostname WSAGetLastError inet_ntoa gethostbyname setsockopt WSAStartup WSASocketW shutdown closesocket WSAIoctl bind htons WSAAddressToStringW WSACleanup getsockopt

Sharing

General

Malware Config

Signatures

File Explorer

2025-09-17_3357b96f7baef169e28ed5a24ea79f59_amadey_bitrat_cobalt-strike_dragonforce_elex_luca-stealer_lynx_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

rstrtmgr

netapi32

iphlpapi

shlwapi

ws2_32

generic