metasploit | 2026-06-30_42f1d69ee431632ae12e209010f3017b_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_42f1d69ee431632ae12e209010f3017b_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 833KB
Sample260630-23cdwsbv2w
SHA256 19826a2f23fdd5a5ad5df956d92fc4a75075e58298dea6d976ff02a8732ea1c3
MD5 42f1d69ee431632ae12e209010f3017b
SHA1 a9800a0705a6a23d2c0da371aed068ddab17faa0
SHA512 2bc3f00901748b9cef035cb145fe4b48c9e12188836e2cdc39af58fa5b08dd140fc3886f5eabcbd8779270bc6ad4ae06c6dd714940685961ae7fe3dba42cc597
SSDEEP 12288:PBhA3SfDkVs+k3mI62ATai/QqzlFCl7yZVrLnJtZsbTTeIhcUXeLYhnRY:5iifDk0/AT71Cl7UpsX2UXoqR
TLSH
T1C1059E02B6D18471F192017A0A3BF77E6E3DB1105B25C9C7C3E4D99859622E2EA3F35E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

192.168.0.242:443

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_42f1d69ee431632ae12e209010f3017b_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-06-30_42f1d69ee431632ae12e209010f3017b_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 833KB

2026-06-30_42f1d69ee431632ae12e209010f3017b_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 4e2502eead9c4f9bdce714ff55832165
SHA256 19826a2f23fdd5a5ad5df956d92fc4a75075e58298dea6d976ff02a8732ea1c3
MD5 42f1d69ee431632ae12e209010f3017b
SHA1 a9800a0705a6a23d2c0da371aed068ddab17faa0
SHA512 2bc3f00901748b9cef035cb145fe4b48c9e12188836e2cdc39af58fa5b08dd140fc3886f5eabcbd8779270bc6ad4ae06c6dd714940685961ae7fe3dba42cc597
SSDEEP 12288:PBhA3SfDkVs+k3mI62ATai/QqzlFCl7yZVrLnJtZsbTTeIhcUXeLYhnRY:5iifDk0/AT71Cl7UpsX2UXoqR
TLSH
T1C1059E02B6D18471F192017A0A3BF77E6E3DB1105B25C9C7C3E4D99859622E2EA3F35E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

839680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ClearCommBreak CloseHandle CompareStringW ConnectNamedPipe CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreatePipe CreateProcessA CreateThread DecodePointer DeleteCriticalSection DeleteFileA EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileA FindFirstFileExW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommState GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableA GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemTimeAsFileTime GetThreadTimes GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetWindowsDirectoryA GlobalMemoryStatus HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LocalAlloc LocalFileTimeToFileTime LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex RtlUnwind SetCommBreak SetCommState SetCommTimeouts SetConsoleMode SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitNamedPipeA WideCharToMultiByte WriteConsoleW WriteFile

user32

FindWindowA GetCapture GetClipboardOwner GetCursorPos GetForegroundWindow GetQueueStatus SendMessageA

advapi32

AllocateAndInitializeSid CopySid EqualSid GetLengthSid GetUserNameA InitializeSecurityDescriptor RegCloseKey RegCreateKeyExA RegEnumKeyA RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA SetSecurityDescriptorDacl SetSecurityDescriptorOwner

Name

.text

Size

591KB

Virtual Size

591KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.voltbl

Size

512B

Virtual Size

156B

Characteristics

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Extracted

Signatures

File Explorer

2026-06-30_42f1d69ee431632ae12e209010f3017b_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

kernel32

user32

advapi32

generic