2026-06-04_8eef3317b5325fb0c5c7bf1d66c696e5_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat

General

Target
2026-06-04_8eef3317b5325fb0c5c7bf1d66c696e5_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat
Size 482KB
Sample260604-3twlvagy6v
SHA256 9fb5d85c1d5485b9e973ac110f5f11cd12dc93a4c0df2a385f4e782c7c6e0e44
MD5 8eef3317b5325fb0c5c7bf1d66c696e5
SHA1 c7641ca180909797926d15f79bec54e8ee266187
SHA512 29f1d1bda35b5e7e29b2b749d465f94df2fd5466e9ef9d2abc66f4d575b2542e8aab9021271e65d7167ac33c9a251c8d495fbb76bb5b1c36d5a1b2e10592c3c9
SSDEEP 6144:K/iUSZjwncjMvjC1ducFnDq8zOgyVrB7qT6xCIh4zDj2pS7QZ7o:iA0nnJcFnD5IO6xe6pSUZ7o
TLSH
T1C8B45A0DEA518433C42E2B31FDE4FFB4076D2AA02B7586CBB7D03A6B7A602C1D535566
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-04_8eef3317b5325fb0c5c7bf1d66c696e5_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat

File Explorer

2026-06-04_8eef3317b5325fb0c5c7bf1d66c696e5_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat

.exe 482KB

2026-06-04_8eef3317b5325fb0c5c7bf1d66c696e5_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat

IMPHASH 953ddbeaf8260a562016edb32b006967
SHA256 9fb5d85c1d5485b9e973ac110f5f11cd12dc93a4c0df2a385f4e782c7c6e0e44
MD5 8eef3317b5325fb0c5c7bf1d66c696e5
SHA1 c7641ca180909797926d15f79bec54e8ee266187
SHA512 29f1d1bda35b5e7e29b2b749d465f94df2fd5466e9ef9d2abc66f4d575b2542e8aab9021271e65d7167ac33c9a251c8d495fbb76bb5b1c36d5a1b2e10592c3c9
SSDEEP 6144:K/iUSZjwncjMvjC1ducFnDq8zOgyVrB7qT6xCIh4zDj2pS7QZ7o:iA0nnJcFnD5IO6xe6pSUZ7o
TLSH
T1C8B45A0DEA518433C42E2B31FDE4FFB4076D2AA02B7586CBB7D03A6B7A602C1D535566
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

58037

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc HeapFree GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW

version

VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_8eef3317b5325fb0c5c7bf1d66c696e5_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat

kernel32

version

generic