2026-05-30_eb60a3212be1de84503462ff1d0ecf4c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-30_eb60a3212be1de84503462ff1d0ecf4c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader
Size 603KB
Sample260530-ryw8dsft4v
SHA256 e3c6b8e49422ef0606a0ea0eebc5b2c2cc8afca1e3428e7c99d209616b39c50b
MD5 eb60a3212be1de84503462ff1d0ecf4c
SHA1 d89df09721ef9dc51b06089851e229ae522a1c9a
SHA512 a686ade5871574906edcfae93b93be21408f9e3585cf9485ed72d2b3ad30f1ffffc569d2d53f14874f11d2beed9decac3de367e2903aeabf2dbe8ade6546555c
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXw:N0vHyyLj8trn3wsliuWXw
TLSH
T1E4D4BF2439E0C072D27601310D6AE7A4973EF6704B2289D777D4AFBD2E315C1EB25AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-30_eb60a3212be1de84503462ff1d0ecf4c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader

File Explorer

2026-05-30_eb60a3212be1de84503462ff1d0ecf4c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader

.exe 603KB

2026-05-30_eb60a3212be1de84503462ff1d0ecf4c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader

IMPHASH 76f7dd29aed520404918753e473bf84c
SHA256 e3c6b8e49422ef0606a0ea0eebc5b2c2cc8afca1e3428e7c99d209616b39c50b
MD5 eb60a3212be1de84503462ff1d0ecf4c
SHA1 d89df09721ef9dc51b06089851e229ae522a1c9a
SHA512 a686ade5871574906edcfae93b93be21408f9e3585cf9485ed72d2b3ad30f1ffffc569d2d53f14874f11d2beed9decac3de367e2903aeabf2dbe8ade6546555c
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXw:N0vHyyLj8trn3wsliuWXw
TLSH
T1E4D4BF2439E0C072D27601310D6AE7A4973EF6704B2289D777D4AFBD2E315C1EB25AA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

62:07:11:04:26:77:3c:87:b2:04:64:fb:3a:fb:b7:b3:81:82:52:01:8f:64:db:a8:e9:f9:b8:d1:3d:49:e5:1d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Chains

Jun 14, 2023

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

06:0e:2f:8f:9e:1b:8b:e5:18:d5:fe:2b:69:cf:cc:b1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 9, 2023 - Mar 11, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

172599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

StringFromGUID2 IIDFromString

shell32

SHGetFolderPathA SHGetFolderPathW

user32

GetMessageA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA MsgWaitForMultipleObjectsEx IsWindowUnicode

kernel32

RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetDllDirectoryA FileTimeToSystemTime LocalFree MultiByteToWideChar WideCharToMultiByte WaitForSingleObject LoadLibraryExW OpenMutexA DeleteFileA FindClose GetFileAttributesA RemoveDirectoryA SetFileAttributesA CloseHandle SetLastError GetCommandLineW GetTempPathA GetCurrentProcess GetSystemDirectoryA GetNativeSystemInfo GetModuleFileNameA GetModuleHandleExW Sleep GetCurrentProcessId GetCurrentThreadId GetLocalTime DecodePointer ReadFile SetHandleInformation CreatePipe PeekNamedPipe TerminateProcess GetExitCodeProcess CreateProcessA GetModuleHandleExA LoadResource LockResource SizeofResource FindResourceA FreeLibrary GetProcAddress LoadLibraryW CreateFileW SetFilePointerEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetStringTypeW InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW GetSystemTimeAsFileTime GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers QueryPerformanceCounter GetFileSizeEx ReadConsoleW SetEndOfFile GetCurrentDirectoryW HeapReAlloc GetTimeZoneInformation HeapSize FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW CompareStringW InitializeSListHead RtlUnwind FormatMessageW HeapFree HeapAlloc GetCommandLineA GetStdHandle GetModuleFileNameW ExitProcess SetStdHandle SystemTimeToTzSpecificLocalTime GetFileInformationByHandle CreateDirectoryW GetFullPathNameW GetDriveTypeW GetFileType GetConsoleMode GetConsoleOutputCP WriteFile TlsFree TlsSetValue TlsGetValue IsProcessorFeaturePresent TlsAlloc

advapi32

RegCreateKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegQueryValueExA RegOpenKeyExA

oleaut32

SysFreeString GetErrorInfo

msi

ord168 ord67 ord189 ord31 ord141 ord160 ord158 ord91 ord117 ord115 ord137 ord159 ord8 ord44 ord204

version

GetFileVersionInfoA VerQueryValueW GetFileVersionInfoSizeA

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-30_eb60a3212be1de84503462ff1d0ecf4c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader

PE Signature issue

ole32

shell32

user32

kernel32

advapi32

oleaut32

msi

version

generic