General
- Target 2026-03-27_7881fe90829845e0239b27f959cdadcb_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_remcos
- Size 417KB
- Sample260327-thd3zsds5k
- SHA256 cc50c7528eced8efef93a16974f38919793a0b2db4c5d5615f33f3d6b48d277b
- MD5 7881fe90829845e0239b27f959cdadcb
- SHA1 3e51debfc8a8bb4ada091177d483a92e052217a1
- SHA512 06bcb4fa67fc422b8669be3839c8dd2eeb793b0a4d130d6378da2a5cb4ed16de308c60490d25c4c268c3a77cd59eed9471013dfeee384a533071447bade14394
- SSDEEP 12288:MXyHTfxyxfLot/eoWBXkTLL/+gJuGumEaheXo23Eht6:1zfxyxDCG70L7RZhef3P
- TLSH T1BB947D207842C033C61192715E68FFB685DDB9659F7109DBBBD40F3B6E201E26A35E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-03-27_7881fe90829845e0239b27f959cdadcb_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260130-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-27_7881fe90829845e0239b27f959cdadcb_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
Resource
win11-20260130-en
2 signatures
150 seconds
Malware Config
Extracted
Family
-
amadey
Version
-
4.42
Botnet
-
9c9aa5
C2
-
http://185.215.113.43
Attributes
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
rc4.plain
Targets
-
- Target 2026-03-27_7881fe90829845e0239b27f959cdadcb_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_remcos
- Size 417KB
- SHA256 cc50c7528eced8efef93a16974f38919793a0b2db4c5d5615f33f3d6b48d277b
- MD5 7881fe90829845e0239b27f959cdadcb
- SHA1 3e51debfc8a8bb4ada091177d483a92e052217a1
- SHA512 06bcb4fa67fc422b8669be3839c8dd2eeb793b0a4d130d6378da2a5cb4ed16de308c60490d25c4c268c3a77cd59eed9471013dfeee384a533071447bade14394
- SSDEEP 12288:MXyHTfxyxfLot/eoWBXkTLL/+gJuGumEaheXo23Eht6:1zfxyxDCG70L7RZhef3P
- TLSH T1BB947D207842C033C61192715E68FFB685DDB9659F7109DBBBD40F3B6E201E26A35E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10