2026-05-29_62f335dd0294a5f1fba51914b51668b0_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-29_62f335dd0294a5f1fba51914b51668b0_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_medusalocker_njrat_remcos
Size 824KB
Sample260529-rlccfsds61
SHA256 bb8d6848ae0651c18f372979f0c6f52d8e5cea1188e3f70a93f9e561d044bfec
MD5 62f335dd0294a5f1fba51914b51668b0
SHA1 b5eded8ccf67df3b8c194de22f533c2287173043
SHA512 a9d85831a92fd1b6ff9f470252a525d86ef61c634c47ed2313eb2ef91549843f901b8a811854387f4451631a91a38ab9e4d1cef456435a5c11fdd805bba5fa3d
SSDEEP 12288:oJRwgcMpLPrpkq3vX78BXxbpAtQZ8qiBCOQeCMqhThATs9PBjvrEH7P:o1Lzp/vuoQZ38ABthwE9rEH7P
TLSH
T10D057BB02C9183ADC0D2023F3D759F6B79BDEA256A3C489672506EF85923081DF7BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-29_62f335dd0294a5f1fba51914b51668b0_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_medusalocker_njrat_remcos

File Explorer

2026-05-29_62f335dd0294a5f1fba51914b51668b0_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_medusalocker_njrat_remcos

.exe 824KB

2026-05-29_62f335dd0294a5f1fba51914b51668b0_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_medusalocker_njrat_remcos

IMPHASH c05108bbcc70b453013a2fc58ae6c10b
SHA256 bb8d6848ae0651c18f372979f0c6f52d8e5cea1188e3f70a93f9e561d044bfec
MD5 62f335dd0294a5f1fba51914b51668b0
SHA1 b5eded8ccf67df3b8c194de22f533c2287173043
SHA512 a9d85831a92fd1b6ff9f470252a525d86ef61c634c47ed2313eb2ef91549843f901b8a811854387f4451631a91a38ab9e4d1cef456435a5c11fdd805bba5fa3d
SSDEEP 12288:oJRwgcMpLPrpkq3vX78BXxbpAtQZ8qiBCOQeCMqhThATs9PBjvrEH7P:o1Lzp/vuoQZ38ABthwE9rEH7P
TLSH
T10D057BB02C9183ADC0D2023F3D759F6B79BDEA256A3C489672506EF85923081DF7BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

73:b5:e0:64:ce:78:f6:8a:33:dd:f0:c1:52:37:0a:ab:40:2e:9d:c3:8e:06:5e:81:b4:d3:f9:91:3b:66:a7:1b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Samsung Electronics Co.\, Ltd.,O=Samsung Electronics Co.\, Ltd.,L=Suwon-si,ST=Gyeonggi-do,C=KR

Chains

Nov 11, 2025

CN=Samsung Electronics Co.\, Ltd.,O=Samsung Electronics Co.\, Ltd.,L=Suwon-si,ST=Gyeonggi-do,C=KR

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=Samsung Electronics Co.\, Ltd.,O=Samsung Electronics Co.\, Ltd.,L=Suwon-si,ST=Gyeonggi-do,C=KR

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Samsung Electronics Co.\, Ltd.,O=Samsung Electronics Co.\, Ltd.,L=Suwon-si,ST=Gyeonggi-do,C=KR

Serial Number

19:71:58:5a:66:79:85:89:b0:e5:35:64

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 10, 2025 - Feb 11, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

89123

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\_dev\MigrationService\Release\MigrationService.pdb

kernel32

WideCharToMultiByte FindNextVolumeW GetTickCount GetExitCodeProcess InitializeCriticalSectionEx RaiseException DecodePointer DeleteCriticalSection QueryDosDeviceW LoadLibraryW GetCurrentDirectoryW SetCurrentDirectoryW GetModuleHandleW CreateNamedPipeW WaitForMultipleObjects DisconnectNamedPipe CreateEventW SetEvent GetOverlappedResult ExitProcess ConnectNamedPipe TerminateProcess OutputDebugStringW lstrcmpiW GetPrivateProfileStringW GetProcessHeap FindVolumeClose GetProcAddress GetWindowsDirectoryW GetLocalTime HeapAlloc CloseHandle CreateFileA GetLastError Sleep MultiByteToWideChar GetVersionExW CreateFileW WaitForSingleObject FindClose SetFilePointer GetModuleFileNameW DeviceIoControl WriteFile GetCurrentProcess FindNextFileW HeapFree FindFirstVolumeW GetVolumeInformationW ReadFile FreeLibrary CreateDirectoryW WriteConsoleW HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW HeapReAlloc SetStdHandle ReadConsoleW GetOEMCP GetACP IsValidCodePage CreateProcessW GetFileSizeEx GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle SetEnvironmentVariableW GetFileType GetCommandLineW GetCommandLineA GetModuleHandleExW ExitThread lstrcpynW lstrcatW lstrcpyW lstrlenW GetFileSize GetStringTypeW FindFirstFileExW GetFileAttributesExW SetFilePointerEx EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead LocalFree CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind

user32

wsprintfW TranslateMessage PeekMessageW DispatchMessageW GetMessageW

advapi32

CreateServiceW CloseServiceHandle OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceW StartServiceCtrlDispatcherW OpenServiceW QueryServiceStatusEx SetSecurityDescriptorDacl AllocateAndInitializeSid CopySid FreeSid InitializeSecurityDescriptor InitializeAcl GetLengthSid AddAccessAllowedAce RegCloseKey RegOpenKeyExW RegQueryValueExW RegFlushKey RegDeleteKeyW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity

oleaut32

SysFreeString SafeArrayGetUBound VariantInit SafeArrayDestroy VariantClear SysAllocString SafeArrayGetLBound SafeArrayGetElement

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

HttpQueryInfoW HttpOpenRequestW InternetOpenW InternetCloseHandle InternetConnectW HttpSendRequestW HttpAddRequestHeadersW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_62f335dd0294a5f1fba51914b51668b0_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_medusalocker_njrat_remcos

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

version

wininet

generic