2026-05-30_dc985f2d40a5393c5eb9732bf17d726c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-30_dc985f2d40a5393c5eb9732bf17d726c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader
Size 603KB
Sample260530-st5jmsgz7s
SHA256 29b646667dca90cddda219526b4a7df63d5491cfb97e4464d317fcafaa56f386
MD5 dc985f2d40a5393c5eb9732bf17d726c
SHA1 7f061ba40195ca90aec74e3167de6729725d072b
SHA512 7bc8918521ae8663a6ebbb873e9d0ff2f67b9f73e909562dd950eac374a6cdadcaf490661cc760a40e8f2d50f4b4dbde72d45ecd517b68431c28a6dc221842c2
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWX4:N0vHyyLj8trn3wsliuWX4
TLSH
T125D4BF2439E0C072D27601310D6AE7A4973EF6704B2289D777D4AFBD2E315C1EB25AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-30_dc985f2d40a5393c5eb9732bf17d726c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader

File Explorer

2026-05-30_dc985f2d40a5393c5eb9732bf17d726c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader

.exe 603KB

2026-05-30_dc985f2d40a5393c5eb9732bf17d726c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader

IMPHASH 76f7dd29aed520404918753e473bf84c
SHA256 29b646667dca90cddda219526b4a7df63d5491cfb97e4464d317fcafaa56f386
MD5 dc985f2d40a5393c5eb9732bf17d726c
SHA1 7f061ba40195ca90aec74e3167de6729725d072b
SHA512 7bc8918521ae8663a6ebbb873e9d0ff2f67b9f73e909562dd950eac374a6cdadcaf490661cc760a40e8f2d50f4b4dbde72d45ecd517b68431c28a6dc221842c2
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWX4:N0vHyyLj8trn3wsliuWX4
TLSH
T125D4BF2439E0C072D27601310D6AE7A4973EF6704B2289D777D4AFBD2E315C1EB25AA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

78:23:85:e7:ed:5d:7f:b5:20:c2:da:a8:9f:e5:c9:ac:ab:6b:1e:01:f5:d3:8e:16:f3:94:06:d3:6a:11:16:01

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Chains

Jun 14, 2023

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

06:0e:2f:8f:9e:1b:8b:e5:18:d5:fe:2b:69:cf:cc:b1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 9, 2023 - Mar 11, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

172599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

StringFromGUID2 IIDFromString

shell32

SHGetFolderPathA SHGetFolderPathW

user32

GetMessageA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA MsgWaitForMultipleObjectsEx IsWindowUnicode

kernel32

RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetDllDirectoryA FileTimeToSystemTime LocalFree MultiByteToWideChar WideCharToMultiByte WaitForSingleObject LoadLibraryExW OpenMutexA DeleteFileA FindClose GetFileAttributesA RemoveDirectoryA SetFileAttributesA CloseHandle SetLastError GetCommandLineW GetTempPathA GetCurrentProcess GetSystemDirectoryA GetNativeSystemInfo GetModuleFileNameA GetModuleHandleExW Sleep GetCurrentProcessId GetCurrentThreadId GetLocalTime DecodePointer ReadFile SetHandleInformation CreatePipe PeekNamedPipe TerminateProcess GetExitCodeProcess CreateProcessA GetModuleHandleExA LoadResource LockResource SizeofResource FindResourceA FreeLibrary GetProcAddress LoadLibraryW CreateFileW SetFilePointerEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetStringTypeW InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW GetSystemTimeAsFileTime GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers QueryPerformanceCounter GetFileSizeEx ReadConsoleW SetEndOfFile GetCurrentDirectoryW HeapReAlloc GetTimeZoneInformation HeapSize FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW CompareStringW InitializeSListHead RtlUnwind FormatMessageW HeapFree HeapAlloc GetCommandLineA GetStdHandle GetModuleFileNameW ExitProcess SetStdHandle SystemTimeToTzSpecificLocalTime GetFileInformationByHandle CreateDirectoryW GetFullPathNameW GetDriveTypeW GetFileType GetConsoleMode GetConsoleOutputCP WriteFile TlsFree TlsSetValue TlsGetValue IsProcessorFeaturePresent TlsAlloc

advapi32

RegCreateKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegQueryValueExA RegOpenKeyExA

oleaut32

SysFreeString GetErrorInfo

msi

ord168 ord67 ord189 ord31 ord141 ord160 ord158 ord91 ord117 ord115 ord137 ord159 ord8 ord44 ord204

version

GetFileVersionInfoA VerQueryValueW GetFileVersionInfoSizeA

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-30_dc985f2d40a5393c5eb9732bf17d726c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_rhadamanthys_smoke-loader

PE Signature issue

ole32

shell32

user32

kernel32

advapi32

oleaut32

msi

version

generic