2026-06-26_a4d4e2ca360216b944632401486ac98a_amadey_cobalt-strike_elex_luca-stealer_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_a4d4e2ca360216b944632401486ac98a_amadey_cobalt-strike_elex_luca-stealer_njrat_play
Size 120KB
Sample260629-qqc9waev21
SHA256 e8160be8d7cc93c11fd1ffc98a191bf3af0764b5c3117131700f9482510c5044
MD5 a4d4e2ca360216b944632401486ac98a
SHA1 a28ce35486e2130523a5233bd734c7df68d66d45
SHA512 d3e3ff4bbccd24db02c6cf7e10ec5efd31def8b0e67c3b7c4371e58ef33f2da16cd7636c8a772523d78dacecc6188d97dc7d556da3150cd2913e22e868eee712
SSDEEP 3072:wog0lbIqzJL6MmSe93A57SDW3hJ0X61tQFhJiKsyWkgl9G5J:E0lt6AeZA57S+gKgsrXG5J
TLSH
T131C38C01B5C1C472D9B5593018A8EAB19A3DF8700F749DEB73D816B99F382C19A35EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_a4d4e2ca360216b944632401486ac98a_amadey_cobalt-strike_elex_luca-stealer_njrat_play

File Explorer

2026-06-26_a4d4e2ca360216b944632401486ac98a_amadey_cobalt-strike_elex_luca-stealer_njrat_play

.exe 120KB

2026-06-26_a4d4e2ca360216b944632401486ac98a_amadey_cobalt-strike_elex_luca-stealer_njrat_play

IMPHASH bebbbb84b59c8c5bdde46bd85b4c6dcc
SHA256 e8160be8d7cc93c11fd1ffc98a191bf3af0764b5c3117131700f9482510c5044
MD5 a4d4e2ca360216b944632401486ac98a
SHA1 a28ce35486e2130523a5233bd734c7df68d66d45
SHA512 d3e3ff4bbccd24db02c6cf7e10ec5efd31def8b0e67c3b7c4371e58ef33f2da16cd7636c8a772523d78dacecc6188d97dc7d556da3150cd2913e22e868eee712
SSDEEP 3072:wog0lbIqzJL6MmSe93A57SDW3hJ0X61tQFhJiKsyWkgl9G5J:E0lt6AeZA57S+gKgsrXG5J
TLSH
T131C38C01B5C1C472D9B5593018A8EAB19A3DF8700F749DEB73D816B99F382C19A35EB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32NextW SetEvent lstrcatW Process32FirstW CloseHandle GetLastError LocalFree WTSGetActiveConsoleSessionId QueryFullProcessImageNameW ConnectNamedPipe lstrlenW DecodePointer ProcessIdToSessionId CreateEventW CreateToolhelp32Snapshot OpenProcess DisconnectNamedPipe ResumeThread CreateFileW WaitForSingleObject GetUserDefaultUILanguage CreateNamedPipeW GetModuleFileNameW TerminateProcess GetFileSizeEx CreateThread ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW WriteConsoleW

advapi32

LookupPrivilegeValueW RegisterServiceCtrlHandlerExW SetSecurityDescriptorDacl AdjustTokenPrivileges SetTokenInformation AllocateAndInitializeSid SetServiceStatus SetEntriesInAclW OpenProcessToken FreeSid InitializeSecurityDescriptor CreateProcessAsUserW StartServiceCtrlDispatcherW DuplicateTokenEx

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shlwapi

PathRemoveFileSpecW

Name

.text

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_a4d4e2ca360216b944632401486ac98a_amadey_cobalt-strike_elex_luca-stealer_njrat_play

kernel32

advapi32

shell32

ole32

userenv

shlwapi

generic