2026-07-17_da6ff97417649013c2e82c59555e0186_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_da6ff97417649013c2e82c59555e0186_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat
Size 985KB
Sample260718-b829dsct7k
SHA256 6f41b47564784f80292e6cc0317fb700c2ce61dab376c7b256a7529e32a267b1
MD5 da6ff97417649013c2e82c59555e0186
SHA1 7e62296051238f0d8cc92d22259cb04571fe7ffa
SHA512 f3cf39b4cf9125e6f0535555369273dcc11fc95a6538acea8415dbcf532926c7b19e1e72ab40cf44b8e0a52b8c789379261dbddbc3b3c6edd2a96212035fed42
SSDEEP 12288:QkvzqetzQzYN3bNds3GuWx296E8qhtNJYs1cSEFf5ZeDDq7StH0r1aYUwm1OlJnQ:QCqWzQ8Ns2TS6E8qhtNJYdOkStiJUeni
TLSH
T1AC258C21354AC039C96241B25D39EB6A902DED760B3509DBB7D81F3D9B309D39B32E63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-17_da6ff97417649013c2e82c59555e0186_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat

.exe 985KB

2026-07-17_da6ff97417649013c2e82c59555e0186_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 64bda4e636449fa6d894191d6fed166f
SHA256 6f41b47564784f80292e6cc0317fb700c2ce61dab376c7b256a7529e32a267b1
MD5 da6ff97417649013c2e82c59555e0186
SHA1 7e62296051238f0d8cc92d22259cb04571fe7ffa
SHA512 f3cf39b4cf9125e6f0535555369273dcc11fc95a6538acea8415dbcf532926c7b19e1e72ab40cf44b8e0a52b8c789379261dbddbc3b3c6edd2a96212035fed42
SSDEEP 12288:QkvzqetzQzYN3bNds3GuWx296E8qhtNJYs1cSEFf5ZeDDq7StH0r1aYUwm1OlJnQ:QCqWzQ8Ns2TS6E8qhtNJYdOkStiJUeni
TLSH
T1AC258C21354AC039C96241B25D39EB6A902DED760B3509DBB7D81F3D9B309D39B32E63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

da:17:1f:11:26:7d:0c:78:d9:d1:07:a1:d8:73:d2:ad:85:5f:d9:7d:cf:8f:ac:09:f3:91:5b:d3:d5:10:9e:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=201812738K,CN=INNOVATIVE CONNECTING PTE. LIMITED,O=INNOVATIVE CONNECTING PTE. LIMITED,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Apr 16, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:33:3b:de:4c:a7:c5:7e:57:d0:3d:ec:dd:c8:53:b0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 7, 2026 - Apr 2, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

552639

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\360Work\trojan\bin\xpntroj.pdb

libcrypto-1_1

DH_free CONF_modules_unload BIO_new_mem_buf BIO_free BIO_new_file OPENSSL_sk_value OPENSSL_sk_num EVP_sha224 EVP_DigestFinal_ex X509_STORE_add_cert EVP_DigestUpdate EVP_DigestInit_ex EVP_MD_CTX_new X509_STORE_CTX_get_ex_data X509_STORE_CTX_get_error_depth X509_STORE_CTX_get_current_cert X509_VERIFY_PARAM_new X509_VERIFY_PARAM_free X509_VERIFY_PARAM_set_flags X509_free d2i_X509 X509_get_subject_name X509_NAME_get_index_by_NID X509_NAME_get_entry X509_NAME_ENTRY_get_data EVP_MD_CTX_free X509_get_ext_d2i PEM_read_bio_DHparams ERR_get_error ERR_clear_error ERR_reason_error_string GENERAL_NAMES_free BIO_ctrl_pending BIO_read BIO_write BIO_ctrl BIO_new_bio_pair

libssl-1_1

SSL_CTX_set_ciphersuites SSL_CTX_get_cert_store SSL_CTX_set_timeout SSL_CTX_free SSL_CTX_new SSL_CTX_set_cipher_list SSL_CTX_set_keylog_callback SSL_CTX_set_alpn_select_cb SSL_CTX_set_alpn_protos SSL_select_next_proto SSL_CTX_set_options SSL_CTX_use_PrivateKey_file SSL_CTX_use_certificate_chain_file SSL_CTX_get_verify_mode SSL_CTX_get_verify_callback SSL_CTX_set_verify SSL_CTX_set_default_passwd_cb SSL_CTX_set_default_passwd_cb_userdata SSL_CTX_get_default_passwd_cb_userdata SSL_CTX_set1_param SSL_CTX_ctrl TLS_method SSL_CTX_set_default_verify_paths SSL_CTX_load_verify_locations SSL_get_SSL_CTX SSL_CTX_set_ex_data SSL_CTX_get_ex_data SSL_get_ex_data_X509_STORE_CTX_idx SSL_set_bio SSL_set_session SSL_new SSL_free SSL_accept SSL_connect SSL_read SSL_write SSL_ctrl SSL_get_error SSL_shutdown SSL_get_shutdown SSL_set_ex_data SSL_get_ex_data SSL_session_reused SSL_get0_alpn_selected SSL_CTX_sess_set_new_cb SSL_CTX_sess_set_remove_cb

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreA

kernel32

GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileType HeapAlloc HeapFree GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW SetConsoleCtrlHandler ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread CreateFileW FreeLibrary InterlockedPushEntrySList RtlUnwind RaiseException GetCurrentThreadId GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleW SwitchToThread DecodePointer EncodePointer QueryPerformanceFrequency QueryPerformanceCounter CreateWaitableTimerA GetSystemTimeAsFileTime Sleep GetCurrentProcessId CreateMutexW ReleaseMutex CreateFileA SetStdHandle MultiByteToWideChar SetEndOfFile GetProcAddress GetModuleHandleA TlsSetValue HeapSize WriteConsoleW LoadLibraryExW VerifyVersionInfoA CloseHandle GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject WaitForMultipleObjects QueueUserAPC TerminateThread TlsAlloc TlsFree LocalFree FormatMessageA FormatMessageW WideCharToMultiByte VerSetConditionMask SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus InitializeCriticalSectionAndSpinCount SleepEx CreateEventW SetWaitableTimer TlsGetValue

ws2_32

WSAIoctl shutdown connect WSARecv __WSAFDIsSet freeaddrinfo getaddrinfo WSAStringToAddressW WSASocketW accept WSAStartup WSACleanup htonl ntohl ntohs WSASetLastError WSAGetLastError WSAAddressToStringW bind closesocket ioctlsocket getpeername getsockname getsockopt htons listen select setsockopt WSARecvFrom WSASend WSASendTo

mswsock

AcceptEx GetAcceptExSockaddrs

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_da6ff97417649013c2e82c59555e0186_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat

libcrypto-1_1

libssl-1_1

crypt32

kernel32

ws2_32

mswsock

generic