2026-05-31_0ccf7eb908ce37bb04689a127537a68d_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-31_0ccf7eb908ce37bb04689a127537a68d_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader
Size 396KB
Sample260531-tkkcsacs2x
SHA256 95e79f4463e33b0f0f619f17f469913051a2af0d4b57b7220adfd7351644f8df
MD5 0ccf7eb908ce37bb04689a127537a68d
SHA1 82e087f40726981a53c3d182893ba338359ba5e2
SHA512 28011d3cad4d5f3d8979e306870e94096cfd2272b3e4a16246acbd99f34e753804f413cc7b86a10efa6a4211c76045da578bff6fad27383342dcb95a01bbe609
SSDEEP 6144:nHcj3eY4Pmp/RwxuybHGybMb3Q/W7Gj4NlToKeJvxZOHhf:n8j3auVyuyzGybMFNNlZWvx4Bf
TLSH
T1AC84AF21B9C0C471D52604321464DF768A39FC345BA149CFB3AD7A29CF722D25B36AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-31_0ccf7eb908ce37bb04689a127537a68d_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-05-31_0ccf7eb908ce37bb04689a127537a68d_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader

.exe 396KB

2026-05-31_0ccf7eb908ce37bb04689a127537a68d_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader

IMPHASH a0134d609f618d627a963155ef434726
SHA256 95e79f4463e33b0f0f619f17f469913051a2af0d4b57b7220adfd7351644f8df
MD5 0ccf7eb908ce37bb04689a127537a68d
SHA1 82e087f40726981a53c3d182893ba338359ba5e2
SHA512 28011d3cad4d5f3d8979e306870e94096cfd2272b3e4a16246acbd99f34e753804f413cc7b86a10efa6a4211c76045da578bff6fad27383342dcb95a01bbe609
SSDEEP 6144:nHcj3eY4Pmp/RwxuybHGybMb3Q/W7Gj4NlToKeJvxZOHhf:n8j3auVyuyzGybMFNNlZWvx4Bf
TLSH
T1AC84AF21B9C0C471D52604321464DF768A39FC345BA149CFB3AD7A29CF722D25B36AAF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\T\M\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb

kernel32

WaitForSingleObject CreateFileW DisconnectNamedPipe GetLastError SetEvent CloseHandle CreateThread ResetEvent GetProcAddress LocalFree DeleteCriticalSection GetCurrentProcessId GetModuleHandleW TransactNamedPipe GetFileType CreateEventA WaitNamedPipeW ConnectNamedPipe LocalAlloc GetCurrentThreadId VerSetConditionMask VerifyVersionInfoW CreateNamedPipeA WaitForMultipleObjects PeekNamedPipe OpenProcess GetOverlappedResult FlushFileBuffers InitializeCriticalSection LoadLibraryA FreeLibrary WideCharToMultiByte Sleep GetCommandLineA MultiByteToWideChar TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreA GetCurrentThread OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateMutexW LeaveCriticalSection CreateNamedPipeW WriteFile GetCurrentProcess EnterCriticalSection SetLastError SetNamedPipeHandleState InitializeCriticalSectionEx ReadFile

user32

GetMessageA DispatchMessageA TranslateMessage

advapi32

OpenThreadToken OpenProcessToken GetTokenInformation ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA

shell32

SHGetFileInfoW

ole32

CoWaitForMultipleHandles

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_except_handler4_common memchr __current_exception_context memmove memset __CxxFrameHandler3 __current_exception memcpy __std_exception_destroy __std_exception_copy __std_terminate memcmp _CxxThrowException _purecall

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function terminate _controlfp_s _set_invalid_parameter_handler _invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo _crt_atexit _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

strlen strtok_s wcstok_s wcscat_s wcscpy_s

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswscanf __stdio_common_vsnwprintf_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-31_0ccf7eb908ce37bb04689a127537a68d_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_lynx_njrat_smoke-loader

kernel32

user32

advapi32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic