2026-05-06_bc7f6a70ed3380ec78e7f2cb12095826_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-06_bc7f6a70ed3380ec78e7f2cb12095826_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 727KB
Sample260506-mlvftabs5n
SHA256 b4d9c4d6d3a11f9c4fce1bc9a1fba169b5c7b9b67ebefbe21aaecc7f942817e7
MD5 bc7f6a70ed3380ec78e7f2cb12095826
SHA1 ba22724632592fca96ad2fc261a3829f1f4eb0c6
SHA512 a5e23bae2d56d193ba2ae1636f287684de5d3ac9657083c7c300eb455cf16aa04379d5a1087f906d27e9983e857c5afd213d045ad10a153d62ff90aa2fdeb07c
SSDEEP 12288:DWIS6Gp7mVwHMQO/+7rxJkCbH+AISDjtGZLUA4IbUCmblz4Oq9/7r2e+YhGamVLq:KeGp7mVv/w1GZLUA4Ib4z4Oo7r2efhGU
TLSH
T1F2F49EC1FBC350F3D6C3117652B367BA1E3A6A019702E9D3C2942E6559206E2AE3F74D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-06_bc7f6a70ed3380ec78e7f2cb12095826_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

File Explorer

2026-05-06_bc7f6a70ed3380ec78e7f2cb12095826_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 727KB

2026-05-06_bc7f6a70ed3380ec78e7f2cb12095826_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH d623e46316c519d722aa57112724b17f
SHA256 b4d9c4d6d3a11f9c4fce1bc9a1fba169b5c7b9b67ebefbe21aaecc7f942817e7
MD5 bc7f6a70ed3380ec78e7f2cb12095826
SHA1 ba22724632592fca96ad2fc261a3829f1f4eb0c6
SHA512 a5e23bae2d56d193ba2ae1636f287684de5d3ac9657083c7c300eb455cf16aa04379d5a1087f906d27e9983e857c5afd213d045ad10a153d62ff90aa2fdeb07c
SSDEEP 12288:DWIS6Gp7mVwHMQO/+7rxJkCbH+AISDjtGZLUA4IbUCmblz4Oq9/7r2e+YhGamVLq:KeGp7mVv/w1GZLUA4Ib4z4Oo7r2efhGU
TLSH
T1F2F49EC1FBC350F3D6C3117652B367BA1E3A6A019702E9D3C2942E6559206E2AE3F74D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

563820

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpW lstrcpyW GetComputerNameW MultiByteToWideChar GetGeoInfoA GetGeoInfoW GetUserGeoID FindClose FindFirstFileW FindNextFileW GetFileAttributesExW lstrcatW FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte SystemTimeToFileTime GetCurrentProcessId GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileA GetVersionExA LoadLibraryA CreateFileA OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep HeapSize HeapValidate UnmapViewOfFile GetVersionExW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer lstrlenA OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate ReadFile LocalAlloc InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetFileInformationByHandle GetLocalTime FileTimeToSystemTime GetConsoleOutputCP GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW lstrcatA lstrcpyA LocalFree GetTickCount GetFileAttributesW DeleteFileW DecodePointer LoadLibraryW GetProcAddress FreeLibrary GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation SetFilePointerEx GetConsoleMode GetFileType LCMapStringW CompareStringW GetStdHandle GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError lstrlenW DeleteCriticalSection GlobalFree GlobalAlloc GetModuleFileNameW ExitProcess CloseHandle WriteFile CreateFileW GetEnvironmentVariableW AreFileApisANSI CopyFileW InitializeCriticalSectionEx GetProcessHeap HeapFree HeapAlloc GetLastError LockFile IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW GetCurrentThreadId InitializeSListHead RtlUnwind WriteConsoleW

user32

ReleaseDC SendMessageW GetDesktopWindow DestroyWindow IsWindow

advapi32

RegQueryValueExW CryptAcquireContextA CryptReleaseContext CryptGenRandom RegOpenKeyW GetCurrentHwProfileW

shlwapi

PathFindFileNameW wnsprintfW StrStrW wnsprintfA

ole32

OleUninitialize CoCreateInstance OleInitialize

oleaut32

SysAllocString SysFreeString SafeArrayAccessData SafeArrayUnaccessData SafeArrayCreateVector VariantInit

wininet

HttpOpenRequestW InternetOpenW InternetConnectW

crypt32

CryptUnprotectData

gdi32

GetDIBits CreateCompatibleDC GetObjectW StretchBlt SelectObject CreateCompatibleBitmap GetDeviceCaps CreateDCA

iphlpapi

GetAdaptersInfo

avicap32

capGetDriverDescriptionA capCreateCaptureWindowW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_bc7f6a70ed3380ec78e7f2cb12095826_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

kernel32

user32

advapi32

shlwapi

ole32

oleaut32

wininet

crypt32

gdi32

iphlpapi

avicap32

generic