2026-07-03_4a214e48db099b8e00ccd77c71b82314_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_4a214e48db099b8e00ccd77c71b82314_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 699KB
Sample260703-a7ftbsht3x
SHA256 03361c8cd1ae3df8b89f208c1f4f66e92ae7eee6e803ea66f0f386f6a163ab88
MD5 4a214e48db099b8e00ccd77c71b82314
SHA1 6e5738c7935913a1d8b57fb664f22ceaa8cd955e
SHA512 6a48752f1c14ebd3162d52a34ca8d41723c0d82cd22e2d6ad182d7575a5271feaa3e3ef32ddf78a4331b23dd87a89c64e768e84dd48d4976cfe9085ce2d2957a
SSDEEP 12288:LOO6gvSOFdnHw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LDf7nHw6Bh0lhSMXlemqth5yRX30GS
TLSH
T10AE4AD2472E5C072F0B22A3019B89AA56A3E7D709F7585DF3388466D5E71BC1DA31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-03_4a214e48db099b8e00ccd77c71b82314_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

File Explorer

2026-07-03_4a214e48db099b8e00ccd77c71b82314_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 699KB

2026-07-03_4a214e48db099b8e00ccd77c71b82314_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH 1193bc223dad681f22f8248608cbb592
SHA256 03361c8cd1ae3df8b89f208c1f4f66e92ae7eee6e803ea66f0f386f6a163ab88
MD5 4a214e48db099b8e00ccd77c71b82314
SHA1 6e5738c7935913a1d8b57fb664f22ceaa8cd955e
SHA512 6a48752f1c14ebd3162d52a34ca8d41723c0d82cd22e2d6ad182d7575a5271feaa3e3ef32ddf78a4331b23dd87a89c64e768e84dd48d4976cfe9085ce2d2957a
SSDEEP 12288:LOO6gvSOFdnHw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LDf7nHw6Bh0lhSMXlemqth5yRX30GS
TLSH
T10AE4AD2472E5C072F0B22A3019B89AA56A3E7D709F7585DF3388466D5E71BC1DA31B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e5:0b:45:b9:26:f8:e1:0c:7e:8c:e7:c5:87:57:27:4a:fb:86:76:eb:ec:6b:d4:74:fc:ab:f6:41:03:1e:5a:b4

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 6, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cd

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 12, 2022 - May 11, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:c0:55:a4:8d:c3:64:15:c5:4b:00:01:00:00:01:c0

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 4, 2022 - Feb 2, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

106938

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\1\s\psexec\exe\Win32\Release\psexec.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

netapi32

NetServerEnum NetApiBufferFree

ws2_32

gethostname WSAStartup inet_ntoa gethostbyname

mpr

WNetCancelConnection2W WNetAddConnection2W

kernel32

SetFileAttributesW DuplicateHandle DisconnectNamedPipe SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW CreateEventW WaitForMultipleObjects GetCurrentProcessId GetFileTime GetExitCodeProcess ResumeThread GetVersion SetProcessAffinityMask CopyFileW ReadConsoleW SetConsoleCtrlHandler SetConsoleTitleW HeapReAlloc GetEnvironmentVariableW GetFileAttributesW ReadFile GetConsoleScreenBufferInfo MultiByteToWideChar VerifyVersionInfoW FormatMessageA FindResourceW SizeofResource LockResource LoadResource FreeLibrary GetSystemDirectoryW GetTickCount GetCurrentProcess Sleep WaitForSingleObject SetEvent CloseHandle WriteFile DeleteFileW CreateFileW VerSetConditionMask SetThreadGroupAffinity SetPriorityClass GetModuleFileNameW LocalFree SetEndOfFile LocalAlloc GetProcAddress GetModuleHandleW GetFileType GetCommandLineW GetStdHandle LoadLibraryExW GetVersionExW SetLastError GetComputerNameW GetLastError FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW HeapSize TerminateProcess RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetConsoleCP SetStdHandle CreateThread ExitThread FreeLibraryAndExitThread GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetConsoleMode ReadConsoleInputW GetFileSizeEx SetFilePointerEx

comdlg32

PrintDlgW

advapi32

CreateProcessAsUserW CryptHashData CryptCreateHash CryptDecrypt CryptEncrypt CryptImportKey CryptExportKey CryptDestroyKey CryptDeriveKey CryptGenKey CryptReleaseContext CryptAcquireContextW StartServiceW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle OpenProcessToken LsaEnumerateAccountRights LsaOpenPolicy LsaClose LsaFreeMemory SetSecurityInfo GetSecurityInfo SetEntriesInAclW LookupPrivilegeValueW SetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAce FreeSid AllocateAndInitializeSid AddAce AddAccessAllowedAce RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegCreateKeyW RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_4a214e48db099b8e00ccd77c71b82314_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

PE Signature issue

version

netapi32

ws2_32

mpr

kernel32

comdlg32

advapi32

generic