2026-07-18_e28f64147407b44fd4f608c9f09e3f4e_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_e28f64147407b44fd4f608c9f09e3f4e_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer
Size 287KB
Sample260718-gre1esds9t
SHA256 079f2838b6995c667acfd7389e2f4144254f7ad99732b8c08c64f05b6cdac1e1
MD5 e28f64147407b44fd4f608c9f09e3f4e
SHA1 ca67035c528b3730be878c6a64d5e2b29072d7ea
SHA512 28e2bdb94c58c61e98821b456537e62760b4b144b61c8e07d2791984f3548c9c2a6fb3467ca3ff28e5517e298864d8141ea5d1a8768a007fc38dd400173d0c15
SSDEEP 6144:bX+ZKeS4QOo2eBNn3YY38K0+88SfLpCQBYqAOHtol:bbeS47o2eBNn3gMSk8HUl
TLSH
T112547CD1B5A1CC72F4F3043608389B7555BEB929FB2146DB63841A3D8E336C35E31AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-18_e28f64147407b44fd4f608c9f09e3f4e_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer

.exe 287KB

2026-07-18_e28f64147407b44fd4f608c9f09e3f4e_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer

IMPHASH 66429f68f8174f6c6f55ada76f0fcfff
SHA256 079f2838b6995c667acfd7389e2f4144254f7ad99732b8c08c64f05b6cdac1e1
MD5 e28f64147407b44fd4f608c9f09e3f4e
SHA1 ca67035c528b3730be878c6a64d5e2b29072d7ea
SHA512 28e2bdb94c58c61e98821b456537e62760b4b144b61c8e07d2791984f3548c9c2a6fb3467ca3ff28e5517e298864d8141ea5d1a8768a007fc38dd400173d0c15
SSDEEP 6144:bX+ZKeS4QOo2eBNn3YY38K0+88SfLpCQBYqAOHtol:bbeS47o2eBNn3gMSk8HUl
TLSH
T112547CD1B5A1CC72F4F3043608389B7555BEB929FB2146DB63841A3D8E336C35E31AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

9c:e9:f3:2f:b7:81:73:ab:07:bc:b2:f0:ff:eb:d6:9b:a5:c7:38:e2:9f:58:b5:54:19:1e:e7:dc:46:fc:4b:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Chains

Jul 8, 2026

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Serial Number

05:c1:5b:a9:90:8e:f7:0e:96:df:d8:52:23:95:77:1d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 12, 2025 - Dec 14, 2027

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

76143

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

DropboxUpdateProxy32.pdb

ole32

CLSIDFromProgID CoCreateInstance CoInitializeEx

oleaut32

SysAllocString VariantClear

shell32

CommandLineToArgvW

kernel32

TlsSetValue CreateFileW HeapSize ReadConsoleW GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionEx GetCommandLineW LocalFree WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCommandLineA RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue WriteConsoleW TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType HeapReAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_e28f64147407b44fd4f608c9f09e3f4e_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer

ole32

oleaut32

shell32

kernel32

generic