stealc | 2025-11-07_39f52e75c235c1ca31bc742cbdf2dd7a_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

General

Target
2025-11-07_39f52e75c235c1ca31bc742cbdf2dd7a_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 563KB
Sample251107-d4jbtshr5s
SHA256 a886802a0ddb6a28dde9f20d2934319c72f6d829b9b243ca102fb08540c45757
MD5 39f52e75c235c1ca31bc742cbdf2dd7a
SHA1 3943dc8f093aaecebd13cf152a247d96b31bea91
SHA512 33f4229c1584020eef3b2c6517bd91a35097c0b110d3bfa8ba9b268e4693a1c612680bde61283989862d7b8a45b7ef125845a588bed63038d07f9427cec33399
SSDEEP 12288:S4Bip+hUDYjjGpp3U0Bav65zdPPv3YZtF15kjHP8AT:SOiuUDYX+Ugaydp3l1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

default stealc

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://88.214.50.76

Attributes

url_path
/4c2a4d77801241fb.php

rc4.plain

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-11-07_39f52e75c235c1ca31bc742cbdf2dd7a_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

File Explorer

2025-11-07_39f52e75c235c1ca31bc742cbdf2dd7a_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 563KB

2025-11-07_39f52e75c235c1ca31bc742cbdf2dd7a_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH 142742dbf9c32803f23e9bf4191577a5
SHA256 a886802a0ddb6a28dde9f20d2934319c72f6d829b9b243ca102fb08540c45757
MD5 39f52e75c235c1ca31bc742cbdf2dd7a
SHA1 3943dc8f093aaecebd13cf152a247d96b31bea91
SHA512 33f4229c1584020eef3b2c6517bd91a35097c0b110d3bfa8ba9b268e4693a1c612680bde61283989862d7b8a45b7ef125845a588bed63038d07f9427cec33399
SSDEEP 12288:S4Bip+hUDYjjGpp3U0Bav65zdPPv3YZtF15kjHP8AT:SOiuUDYX+Ugaydp3l1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

95579

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcatW GetModuleFileNameA LoadLibraryA GetProcAddress GetCurrentProcess CloseHandle QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId MultiByteToWideChar GetStringTypeW GetLocaleInfoEx WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize CreateFileW

Sharing