stealc | 2025-11-26_856097e30404782027fc002b15f1e2c4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

General

Target
2025-11-26_856097e30404782027fc002b15f1e2c4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 563KB
Sample251126-e7bxlaxpeq
SHA256 3d60101b655ed0016c14812cc8cf9fc70773ccfb8d47049d5c33c15df7d9594d
MD5 856097e30404782027fc002b15f1e2c4
SHA1 d368f8a536a843922db06be3ff1fff8eb1ea76ba
SHA512 1cdab47d55d0aaaf05420df113d588388e6689894fbaa0cf793b7e0ae3c0f398e1009091d49f0349b2c279e04bd3f2c507f8b83f1c172942914def77178ab602
SSDEEP 12288:Yp4jIZ0jcf/mXlQhr6acs13XsSdv3YZtF15kjHj4T:Yp4K0jcHDcknHV3x4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

3 stealc

Malware Config

Extracted

Family

stealc

Botnet

3

C2

http://88.214.50.76

Attributes

url_path
/20e1a9f6de594e28.php

rc4.plain

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-11-26_856097e30404782027fc002b15f1e2c4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

File Explorer

2025-11-26_856097e30404782027fc002b15f1e2c4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 563KB

2025-11-26_856097e30404782027fc002b15f1e2c4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH 142742dbf9c32803f23e9bf4191577a5
SHA256 3d60101b655ed0016c14812cc8cf9fc70773ccfb8d47049d5c33c15df7d9594d
MD5 856097e30404782027fc002b15f1e2c4
SHA1 d368f8a536a843922db06be3ff1fff8eb1ea76ba
SHA512 1cdab47d55d0aaaf05420df113d588388e6689894fbaa0cf793b7e0ae3c0f398e1009091d49f0349b2c279e04bd3f2c507f8b83f1c172942914def77178ab602
SSDEEP 12288:Yp4jIZ0jcf/mXlQhr6acs13XsSdv3YZtF15kjHj4T:Yp4K0jcHDcknHV3x4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

95579

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcatW GetModuleFileNameA LoadLibraryA GetProcAddress GetCurrentProcess CloseHandle QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId MultiByteToWideChar GetStringTypeW GetLocaleInfoEx WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize CreateFileW

Sharing